Rootkits and Trojan horse

catfacee · Aug 10, 2012

I went through all of the procedures but when I rescanned with AVG again afterwards, I got most of the same problems. And I actually have a RKreport[2].txt where most of the Registry Entries and Particular Files said replaced or removed. After going through the procedures, the only differences I noticed was that going to Gmail (or to an https:// url in general) was now possible in Chrome, though it worked in Firefox before I went through the procedure. I also stopped getting redirected when I clicked on links in Google search. No more Adobe Flash updates either.

But even so, I don't think any of the rootkits were removed. I was wondering if you would need a record of my RKreport[2] or even my AVG scan logs. I also tried GMER and FRST for my rootkit problems, but beyond giving me more logs, I don't know if attempted at removing the rootkits.

I'm only allowed 4 attachments and I don't know if you need my GMER and FRST logs.

Thanks!

TimW · Aug 11, 2012

Please download ComboFix to your desktop and run it. Do not do anything while it runs. Attach the log when it is finished. Disable any AV software you have before running it.

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

catfacee · Aug 12, 2012

So I ran TDSSKiller and it said that SPTD.sys was at risk of being infected. I looked up the function of it and people said that its only use was for disk emulators like Daemon tools. So I took the risk and went ahead and used TDSSKiller to remove the threat. However, on reboot, windows failed to launch and had to undergo a recovery process, but I think that because of the recovery process, my computer was reset back to a time before the infection. I tried rescanning with AVG and none of the rootkits showed up.

To be sure, though, I still ran ComboFix and MGTools again. However, upon finishing ComboFix, I couldn't run any programs. A notification would simply pop up saying that I couldn't use a registry that was marked for deletion? But I rebooted and the problem disappeared. I just don't know if that incident has any significance.

Thanks again! Now I'm just wondering if, after the recovery process, my computer is now virus-free.

TimW · Aug 12, 2012

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Log in or Sign up

Rootkits and Trojan horse

catfacee Private E-2

Attached Files:

RKreport[1].txt

HitmanPro_20120809_2257.log

mbam-log-2012-08-09 (22-14-03).txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

catfacee Private E-2

Attached Files:

MGlogs.zip

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member