Rootkit/trojan/virus Infection Help Please

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > Am I infected? What do I do?

When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

Rootkit/trojan/virus Infection Help Please

Options

doones View Member Profile	Dec 6 2007, 08:37 AM Post #1
New Member Group: Members Posts: 3 Joined: 6-December 07 Member No.: 174,814	Hope someone can help. Avast has found win32:Agent-KIR [Trj], related to the ip6fw.sys file. It can isolate it, but it comes back after rebooting. Spyware Doctor 5 has found Rootkit.Agent.EY and Trojan-Dropper.Agent.BE. After several scan/fix runs I can get a clean scan. Until the next reboot. AVG Anti-Rootkit has detected ctl_w32.sys as a hidden system file. I could not find any information on whether the file was necessary and did not delete it. Computer seems to be operating normally besides trying to open hidden IE processes. Thank you

quietman7 View Member Profile	Dec 6 2007, 09:13 AM Post #2
Bleepin' Janitor Group: Global Moderator Posts: 14,074 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Rootkits are very dangerous because they use advanced techniques as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use them as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect your computer from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breech. Although the rootkit has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the rootkit has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS - "When should I re-format?". Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. If AVG found ctl_w32.sys, you can have it remove that file. You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please download ATF Cleaner by Atribune & save it to your desktop. DO NOT use yet. Please download and install SUPERAntiSpyware Free Double-click SUPERAntiSypware.exe and use the default settings for installation. An icon will be created on your desktop. Double-click that icon to launch the program. If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.) Under "*General and Startup", make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked. Under "Configuration and Preferences", click the Preferences* button. Click the Scanning Control tab. Under Scanner Options make sure the following are checked (leave all others unchecked): Close browsers before scanning. Scan for tracking cookies. Terminate memory threats before quarantining. Click the "Close" button to leave the control center screen and exit the program. Do not run a scan just yet. Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Double-click ATF-Cleaner.exe to run the program. Under Main "*Select Files to Delete" choose: Select All. Click the Empty Selected* button. If you use Firefox browser click Firefox at the top and choose: Select All Click the Empty Selected button. If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser click Opera at the top and choose: Select All Click the Empty Selected button. If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator". Scan with SUPERAntiSpyware as follows: Launch the program and back on the main screen, under "*Scan for Harmful Software" click Scan your computer. On the left, make sure you check C:\Fixed Drive. On the right, under "Complete Scan", choose Perform Complete Scan* and click "Next". After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". Make sure everything has a checkmark next to it and click "Next". A notification will appear that "*Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. If asked if you want to reboot, click "Yes" and reboot normally. To retrieve the removal information after reboot, launch SUPERAntispyware again. Click Preferences, then click the Statistics/Logs tab.* Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. Now lets try a different ARK tool. Download Sophos Anti-rootkit & save it to your desktop. Be sure to read the Sophos Anti-Rookit User Manual. A copy of this manual (sarman.pdf) can also be found inside the program folder after installation. Double-click sarsfx.exe to begin the installation, read the license agreement and click Accept. Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install. A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now". Click Yes. Make sure the following are checked: Running processes Windows Registry Local Hard Drives Click "Start scan". Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper panel. When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK to continue. Click on the suspicious file to display more information about it in the lower panel which also includes whether the item is recommended for removal. Files tagged as Removable: No are not marked for removal and cannot be removed. Files tagged as Removable: Yes (clean up recommended) are marked for removal by default. Files tagged as Removable: Yes (but clean up not recommended) are not marked for removal because Sophos did not recognize them. These files will require further investigation. Select only items recommended for removal, then click "Clean up checked items". You will be asked to confirm, click Yes. A pop up window will appear advising the cleanup will be done when you restart your computer. Click "Restart Now". After reboot, a dialog box displays the files you selected for removal and the action taken. Click Empty list and then click Continue to re-scan your computer a second time to ensure everything was cleaned. Note: Close all open windows, programs, and DO NOT USE the computer while scanning. If the scan is performed while the computer is in use, false positives may appear in the scan results. This is caused by files or registry entries being deleted automatically. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009

doones View Member Profile	Dec 6 2007, 09:56 AM Post #3
New Member Group: Members Posts: 3 Joined: 6-December 07 Member No.: 174,814	Thanks, I do not have any sensitive information on the computer but I will go ahead and reformat/reinstall. Was hoping that would not be necessary.

quietman7 View Member Profile	Dec 6 2007, 10:14 AM Post #4
Bleepin' Janitor Group: Global Moderator Posts: 14,074 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Although we probably could remove these rootkit files, that's the decision I would have made if it were me. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009

doones View Member Profile	Dec 6 2007, 11:10 AM Post #5
New Member Group: Members Posts: 3 Joined: 6-December 07 Member No.: 174,814	Should I do anything special for the re-format/re-install? The plan is to simply boot from the WinXP CD and re-format the C: partition and re-install, leaving the data on the other (clean) partitions intact. (I have only formatted/installed to new drives) This post has been edited by doones: Dec 6 2007, 11:12 AM

quietman7 View Member Profile	Dec 6 2007, 02:05 PM Post #6
Bleepin' Janitor Group: Global Moderator Posts: 14,074 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Reinstalling Windows without first wiping the hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Starting over, reformatting the drive and performing a clean install removes everything. "How to reformat and reinstall Windows XP - Method #1" "How to reformat and reinstall Windows XP - Method #2" These links include detailed step by step instructions: "Clean Install Windows XP". "XP Clean Install Interactive Setup". "Clean Install Procedure with Illustrative Screen Captures". Reformatting a hard disk deletes all data. Before doing anything, you should back up all your critical files. This means not only all your data files, but also those applications and software setup programs you may have saved to your hard drive. You should also include updated driver software, applications patches, service packs, bug fixes and any other enhancements that may have downloaded and saved. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009

« Next Oldest · Am I infected? What do I do? · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 9th January 2009 - 03:07 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Malware Removal Guides