W32/Stanit infection

CricketB · Aug 10, 2010

Hi,

A few days ago Avira notified me of a W32/Stanit infection. I checked the virus definition online and wasn't particularly worried - I let Avira repair the file and continued using my computer the way I had before. Usually my system is behind a router with active firewall but that weekend I'd taken the tower to a relative's house and connected to a broadband modem directly, which is the only difference to my regular usage pattern.

Today a bunch of .exe files that I recognized began popping up in Avira as TR/patched.gen and W32/Stanit. I told Avira to repair the files where possible, then I ran another full system scan. Now a lot of the same files showed up with TR/Crypt.XPACK.Gen and TR/Dropper.Gen2 - I let Avira delete all affected files due to them all being downloaded setup packages for diverse programs.

Spooked that Avira may not be up to the task of finding and eradicating the problem, I also downloaded and ran TrendMicro's Housecall and Spybot Search & Destroy. To make sure the system was clean I went in search of some more detailed info on the infection and got here - I decided to run through the Malware removal procedure to make sure I got it all.

I followed the instructions and acquired the log files for my system. However, while SAS and Malwarebytes seem clean from what I can tell, I can't run RootRepeal with the following error message:

20:46:22: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)
20:46:22: DeviceIoControl Error! Error Code = 0x1e7
20:46:22: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)
Click to expand...

The computer doesn't show any signs of being aversely affected. Speed and performance appear normal and I haven't had any internet-related symptoms like pop-ups, redirects or connection issues.

I'd be grateful for any help, thank you.

TimW · Aug 10, 2010

Your logs are clean. I just suggest that you continue to keep all your AV and AS software up to date.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Support MajorGeeks with Geek Wear!

CricketB · Aug 10, 2010

Thank you. I finished the cleanup and it looks like the system is fine. I don't anticipate any further problems. I really appreciate the help.

TimW · Aug 10, 2010

You are quite welcome. Safe surfing.

Log in or Sign up

W32/Stanit infection

CricketB Private E-2

Attached Files:

SASLog08-10-2010.log

mbam-log-2010-08-10.txt

combofixlog.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

CricketB Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member