win32k.sys:1 / 2 rootkit troubles

pryogene · Sep 6, 2009

Hi. when i run certain programs i have a tendency to have tskmgr running.
When i noticed MSA.exe and A.exe i realised, "Hay! ive contracted a virus!", i imediately sought help on removal, did so, and then realised i have a rootkit after running multiple antivirus programs, 3 of which the rootkit has lovingly killed for me (avira, avast, malwarebytes - avg was unaffected). I ran a 5th program, AVG anti rootkit which picked up win32k.sys:1 and win32k.sys:2 in C:\windows\, on further inspection, the 'real' file is actually in System32.
Someone please help me, the majority of my software library is being slowly killed off

thanks in advance

chaslang · Sep 10, 2009

Welcome to Major Geeks!

pryogene said: ↑

I ran a 5th program, AVG anti rootkit which picked up win32k.sys:1 and win32k.sys:2 in C:\windows\, on further inspection, the 'real' file is actually in System32.
Click to expand...

You are sort of on the right track but the win32k.sys file in system32 has nothing to do with the problem. The real problem is that either one are several of the below system32 files are infected:

eventlog.dll
netlogon.dll
scecli.dll

Run this Win32KDiag - How to run and attach the log. It will help us determine which file(s) we need to fix.

Also try running this GMER - running with a random name and attach the log.

See: HOW TO: Attach Items To Your Post

pryogene · Sep 10, 2009

I was aware that the file in system 32 was nothing to do with the problem, it just struck me as strange.

However, i have managed to clean my computer of the rootkit, after following the vista cleanup procedure on this site.

HOWEVER, i must stress a few things:

For this particular rootkit, SuperAntiSpyware and malwarebytes were killed off.
ComboFix is about the only thing that ran, though it did solve my problem.

Thankyou for your reply =]

chaslang · Sep 14, 2009

You're welcome.

pryogene said: ↑

HOWEVER, i must stress a few things:

For this particular rootkit, SuperAntiSpyware and malwarebytes were killed off.
ComboFix is about the only thing that ran, though it did solve my problem.
Click to expand...

Yes we know that which is why the instructions stress to run all steps. You may still be having problems that you are yet unaware of. These infections can cause residual damage. Most notiably, permissions issues like you noticed with SAS and MBAM.

Log in or Sign up

win32k.sys:1 / 2 rootkit troubles

pryogene Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

pryogene Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member