rootkit/virus that i just cant seem to get rid of... help?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by daemorok, Jan 21, 2008.

  1. daemorok

    daemorok Private E-2

    Lets see where to start...

    3 hidden (they only show up when i use F-secure blacklight) files that keep reappearing every reboot or every other reboot:
    all in c:\windows\media
    F9999warxy99.dll
    fuwarxyus.dll
    simwarxyd.wav

    2 files that seem to come back every reboot (they show up as soon as my comp pulls an IP address)
    c:\windows\system32\drivers\smtpdrv.sys (nod32 detects as Win32/Agent.NBT worm)
    this one has a few names
    c:\windows\temp
    BN11.tmp
    BNF.tmp
    BN1FF.tmp
    BN21.tmp
    BN12.tmp
    BN57.tmp
    (these all come up as Win32/Wigon trojan in NOD32)

    Ive done a full scan with ESET NOD32 Business Edition v 3.0.621.0
    AVG Anti Spyware
    Ad-Aware
    Spybot

    They all cleaned something, but these files keep coming back

    the 2 files above are called by svchost.exe
    there is also a hidden version of iexplore.exe showing up when i use process explorer from sysinternals, if i kill it, eventually it will return.

    and thats all ive got so far...
     
  2. daemorok

    daemorok Private E-2

    its fixed :)
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Are you sure about that?


    If you really want to be sure, or if still having problems, please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    READ & RUN ME FIRST. Malware Removal Guide
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds