Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rootkit.agent Removal


  • This topic is locked This topic is locked
2 replies to this topic

#1 recreatemedia

recreatemedia

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:24 PM

Posted 30 September 2008 - 08:18 PM

Here is my last log, I was directed to this forum by another user.

I would appreciate any help to remove these viruses.

Mod. edit: Previous topic here: http://www.bleepingcomputer.com/forums/t/171698/malwarebytes-anti-malware-problems/ ~ OB


Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 2

8:59:37 PM 9/28/2008
mbam-log-09-28-2008 (20-59-37).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 209448
Time elapsed: 1 hour(s), 56 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\legacy_windev-6626-509 (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\drivers\mrxdavv.sys (Rootkit.Agent.H) -> Delete on reboot.
C:\WINDOWS\system32\k86.bin (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.

Edited by Orange Blossom, 30 September 2008 - 08:25 PM.


BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,591 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:07:24 PM

Posted 11 October 2008 - 08:56 AM

I apologize for the very long delay. We have a huge backlog of HijackThis Logs to handle and it has been taking us greater time than normal to get caught up. If you are still having a problem, and want us to analyze your information, please reply to this topic stating that you still need help and I will work with you on resolving your computer problems. If your problem has been resolved, please post a reply letting us know so we can close your topic.

Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, feel free to create a new one.

Once again, I apologize for the delay in responding to this topic.

#3 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,591 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:07:24 PM

Posted 16 October 2008 - 08:45 AM

As there has been no response, I will be closing this topic. If you require help in the future please create a new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users