Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

TROJ/RUSTOK-N INFECTION--PLEASE HELP!


  • This topic is locked This topic is locked
3 replies to this topic

#1 MONGO57

MONGO57

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:COLUMBUS,OHIO
  • Local time:03:19 PM

Posted 25 January 2009 - 04:44 PM

Attached File  Attach.txt   7.02KB   5 downloadsAttached File  Attach.txt   7.02KB   5 downloadsHELLO EVERYONE,

I'M NEW TO THIS FORUM SO I APOLOGIZE FOR ANY PROTOCOL MISTAKES. 1-23-09 I FIRST NOTICED SERIOUS PROBLEMS WITH MY LAPTOP.HERE ARE THE SYMPTOMS AND WHAT I HAVE DONE SO FAR TO RESPOND TO THE APPEARENT MALWARE/TROJAN ATTACK:

- NORTON INTERNET SECURITY 2009 INFORMS ME ABOUT SECURITY BREECH-"BACKDOOR TIDESERVLINF". SUPPOSEDLY
THIS WAS CORRECTED BY NIS2009.
- NIS INSTRUCTED ME TO RESTART COMPUTER TO FINISH RESOLVING SECURITY BREECH.WHEN I REBOOTED, NIS WAS
NON FUNCTIONAL, NOT RUNNING.
- ALSO,INTERNET EXPLORER WOULD NOT ACCESS INTERNET,I COULD NOT ACCESS C DRIVE(JUST GOT ERROR
MESSAGE).
- I TRIED TO USE SYSTEM RETSORE TO ROLL BACK TO 1-17-09, SYSTEM RESTORE WOULD LOCK UP. I TRIED USING
SYSTEM RESTORE IN SAFE MODE WITH THE SAME "LOCK UP".
- I USED"NORTON_REMOVAL_TOOL.EXE' ONCE.
- I USED "NISO9EN.EXE" TO RESTORE NIS2009.
- WHEN NIS WAS RESTORED I NOTICED THAT IT COULD NOT RETREIVE UPDATES OR MAINTAIN ADVANCED
PROTECTION.
- I DID REGAIN INTERNET ACCESS AND WAS ABLE TO DOWNLOAD NIS UPDATES VIA THE NORTON WEBSITE. NIS STILL
WILL NOT CONNECT AUTOMATICALLY TO THE NORTON WEBSITE.
- ATTEMPTED TO PERFORM A FULL SYSTEM SCAN WITH NIS---SCAN WAS WAY TOO BRIEF AND ONLY SCANNED A
COUPLE THOUSAND FILES I ALSO TRIED A SCAN IN SAFE MODE WITH SIMILAR RESULTS.
- WHEN ON THE INTERNET I NOTICED NUMEROUS SITE REDIRECTS AND ONE REDIRECT INFORMED ME THAT I HAD A
VIRUS 'Troj/Rustok-N' AND THAT I SHOULD BUY THEIR PROGRAM. I DID NOT BUY THEIR %^(^&(^&#%#@ anti virus
program(they probably started the virus in the first place!!).

- TO SUM UP: -I HAVE A NORTON INTERNET SECURITY PROGRAM THAT WILL NOT PERFORM A FULL SYSTEM SCAN
-INTERNET EXPLORER IS CONSTANTLY REDIRECTING TO ALL TYPES OF WEBSITES.
-NORTON INTERNET SECURITY ALERTS ME TO A SECURITY WARNING BUT WILL NOT FIX THE PROBLEM
-I THINK THAT I HAVE 'Troj/Rustok-N' INFECTING MY COMPUTER AND POSSIBLY SOME OTHER MALWARE
YET TO BE DETERMINED.


ANY HELP WILL BE GREATLY APPRECIATED.

THANKS, MONGO57

BC AdBot (Login to Remove)

 


#2 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:19 PM

Posted 06 February 2009 - 05:15 PM

Hi

My name is Extremeboy (or EB for short), and I will be helping you with your log.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

If you do not make a reply in 5 days, we will need to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the Posted Image button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the Posted Image button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.



Posted ImageRootkit Threat

Unfortunatly One or more of the identified infections is a Rootkit/backdoor trojan.

IMPORTANT NOTE:Rootkits and backdoor Trojans are very dangerous because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. You should change each password by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Although the rootkit has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because this malware has been removed the computer is now secure. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. The malware may leave so many remnants behind that security tools cannot find them. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. Tell me if you wish to proceed or not.

With Regards,
Extrmeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#3 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:19 PM

Posted 09 February 2009 - 03:31 PM

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 days the topic will need to be closed.

Thanks for understanding. :thumbup2:

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#4 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:19 PM

Posted 11 February 2009 - 05:15 PM

Hello.

Due to Lack of feedback, this topic is now Closed.

If you need this topic reopened, please Send Me a Message. In your message please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic in the Hijackthis-Malware Removal forum.

With Regards,
Extremeboy

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users