rootkits or trojans?

McFeist · Jun 22, 2009

Hello, Avast has been detecting some bad stuff on my computer for the past couple of weeks during both routine scans and on startup scans with the following files: Win32Trojan-gen, Win32:RustNT, and Win32Rootkit-gen. Iin addition, Spybot detected Virtumonde.sdn and PWS.Small.bs. So I found this forum and have followed all the steps (I think) under Read and Run Me First.

Of note, my computer is functioning normally at this point and has never shown any obvious signs of infection. As of right now, Avast and Spybot are not finding anything after going through Read and Run Me.

I would greatly appreciate any help in cleaning my computer of these infections that may still be lurking. I'm trying to avoid reformatting the hard drive if possible. I am attaching the log files as instructed.

Thank you so much.

McFeist · Jun 22, 2009

Woops, here are the attachments. The last one to follow in a reply.

McFeist · Jun 22, 2009

And the last attachment...

dr.moriarty · Jun 24, 2009

Welcome, McFeist!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

dr.moriarty · Jun 27, 2009

Hello, McFeist

The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

I strongly recommend that you clean up your Desktop immediately leaving only links. Do not store downloads, exe files, iso files....etc on your Desktop. First it is not a safe place to keep them (i.e., you may loose them due to malware, and a cluttered Desktop is an easy hiding place for malware), and last but not least it can have an effect on your PCs performance.

An observation - Ad-Aware is not as effective as SUPERAntiSpyware and Malwarebytes that we had you install. So we suggest that you uninstall Ad-Aware (unless you purchased it) to avoid wasting any system resources on it.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed

Spybot - Search & Destroy 1.5.2.20

Note: You have Adobe Reader v 6.0.1 through v 6.0.6 Update installed. The current Abode Acrobat and Reader version is 9.
Click to expand...

Step 2:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
Click to expand...

After clicking Fix, exit HJT.

Step 3:
You have a left-over service from Norton. Please run the below, re-boot, then run it again.
Norton Removal Tool (SymNRT) 2009.0.5.26

Step 4:
There is an update to SUPERAntiSpyware available.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Step 5:
Open CCleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!

Step 6:
Now run a new full scan of your system with SAS

Step 7:
Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Please attach the below logs to your next reply:

C:\MGlogs.zip

New updated SASlog.txt

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

McFeist · Jun 28, 2009

Thank you. New logs are attached.

I took your advice and cleaned up the Desktop (still have work to do on it) and removed Ad-Aware and the Spybot file you mentioned.

I did install some software a few days ago before this was posted; my apologies. I installed IE 8 and Identity Finder Home Edition, and I had to re-install my firewall right after the first scanning session; for some reason I wasn't able to re-enable it, but now it is fine.

I had no problems running scans, and my computer seems to be doing fine.

dr.moriarty · Jun 29, 2009

Hi!

McFeist said:

I did install some software a few days ago before this was posted; my apologies.
Click to expand...

No harm done this time because you had nothing serious - we caution against this to prevent having to deal also with partial downloads, corrupted or broken applications.

Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"AAWTray.exe"=-
Click to expand...

If you get a message that the fix was successful, then:

Using Windows Explorer - navigate to and delete:
C:\Program Files\Lavasoft

*Your logs look good! It is time to do our final steps .

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (=This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

If we had you run Avenger, you can delete all files related to Avenger now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware

Click to expand...

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

McFeist · Jun 29, 2009

Thank you so much. Everything worked in those last steps just as it was supposed to. Bless you for your help and taking the time to look at all those logs. This was a very interesting process; I am just so grateful that I don't even have the words to express it.

Do you accept donations? I was trying to figure that out by looking around the site, but I can't find information on how to donate.

dr.moriarty · Jun 29, 2009

You're Welcome!

Perhaps you would like to purchase something from JINX to display your "geekiness".

If not - your "Thanks!" is quite enough!

dr.m

Log in or Sign up

rootkits or trojans?

McFeist Private E-2

McFeist Private E-2

Attached Files:

combofix_log.txt

RRlog.txt

SAS_log.txt

mbam-log.txt

McFeist Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

dr.moriarty Malware Super Sleuth Staff Member

McFeist Private E-2

Attached Files:

MGlogs.zip

NewLog_SAS.txt

dr.moriarty Malware Super Sleuth Staff Member

McFeist Private E-2

dr.moriarty Malware Super Sleuth Staff Member