Backdoor Trojan: I NEED HELP!!!

sleeperkid · Jul 16, 2007

I've had some sort of trojan/spyware on my comp for a week now and neither Adaware, Spybot, Spysweeper, AVG, or AVG Spyware has been able to get rid of it completely. All the aforementioned programs do a great job at removing chunks of the malware (i.e. cookies, etc) but upon rebooting and launching Explorer (or even Firefox) I start getting popups galore and major slowdown to the point that my Windows Media Player starts playing AVI's in a majorly slow stutter!!! Internet and processor speed also seems to suffer greatly once it kicks in.

Also, when attempting to restart my computer in SAFE MODE the screen simply goes black and I can't get to it...although I HAVE been able to access SAFE MODE with NETWORKING.

As far as I can tell via Spysweeper the malware "Might" be identified as a "Trojan-Backdoor-Rustock", but I'm not sure if this is the case.

All the previously mentioned spyware detectors are completely up to date... I am running Windows XP 2002 (service pack 2) Pro on 3 gigs of DDR Ram along with an AMD Athlon 64 X2 Dual Core Processor 4400+ (2.21 Ghz).

I am giving Spysweeper and Spybot another try, but I have a feeling it'll still live and breathe after the checkup. Any help for this poor noobish boy would be appreciated!!!

chaslang · Jul 16, 2007

Welcome to Major Geeks!

If you have or think you have a Rustock infection, run the below:

Rustock.b - msguard, pe386, & lzx32 RootKit Removal

If you still have problems, continue on with the below procedure.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis
Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy - only for Windows XP, 2K, & NT users

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

sleeperkid · Jul 16, 2007

I tried the rustock removal last night and all it did was cause an "error" shutdown. Still trying my spyware software...so we'll see what happens, but so far it's still in there...

chaslang · Jul 16, 2007

If you would like our help, you need to follow the procedure I gave to you and attach the 6 requesed logs.

Log in or Sign up

Backdoor Trojan: I NEED HELP!!!

sleeperkid Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sleeperkid Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member