Hacktool Virus removal

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

Your not clean! Please follow the steps I gave you in message # 2. You did not follow any of it including how to install, run and attach HijackThis log. Run the READ & RUN ME steps first.

 

We need to get these three services removed:

O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe (file missing)
O23 - Service: NTLOAD - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe (file missing)
O23 - Service: NTSVCMGR - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe (file missing)

Here is how we will remove the services.

1) Deleting NTBOOTMGR

• Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to NTBOOTMGR (or if not found look for NTBOOT) ... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.
  
• Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste NTBOOTMGR into the box that opens, and press "OK". If that does not work try entering the short name: NTBOOT

2) Deleting NTLOAD

• Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to NTLOAD then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.
  
• Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste NTLOAD into the box that opens, and press "OK".

3) Deleting NTSVCMGR

• Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to NTSVCMGR then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.
  
• Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste NTSVCMGR into the box that opens, and press "OK".

Now exit HJT and do not reboot if it asks you to. We will reboot later.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/059e55eeba96c29f4b15/netzip/RdxIE601.cab

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete (if found):

C:\Program Files\Common Files\TEKNUM~1\update.exe
C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.
.

 

You're welcome. Your log is clean. Are you having any other malware problems?

If Norton still detects: C:\WINDOWS\SYSTEM\DRIVER\csrss.exe
then delete the file. If necessary, boot into safe mode to delete the file.

 

It is referred to by many names:
Trojan.Runas.A
Trojan.Servu.AZ
Backdoor.Iroffer.14b2B
Win32:Trojano-1332

I have not seen it referred to as Hacktool. There are maybe 25 or 30 Hacktool related trojans out there.

At anyrate, it is gone.

Spy Sweeper is one of the better tool out there. This is a 14 day trial version so you can check it out. I have used Webroot's Spy Sweeper since they first released it. I like it.

Outlook Express and Outlook just like any mail tool can be attacked. Sometime it is just up to the end user to be a lot smarter about what they click on in email. Most virus scan programs will also scan your email. You can check what mail programs people like and why over in the Software Forum.

 

You're welcome. Make sure you work thru the below too:

How to Protect yourself from malware!