Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Getting rid of a Rootkit Virus


  • Please log in to reply
No replies to this topic

#1 Albanach

Albanach

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:54 PM

Posted 09 December 2010 - 04:17 PM

My PC is running Windows XP Home Edition with SP 3. On that PC, I am also running Spybot, which is a freeware program to remove malware and tracking cookies from a PC. Recently, I experienced two problems on my PC :-

1) The PC was running very slowly even after I used CCleaner and TFC to remove all temporary files.

2) My ISP is AOL and they provide McAfee Internet Security Suite for firewall, spyware and virus protection. Several times each day I have noticed that some of the protection features of the McAfee ISS were disabled and I had to restore them to operation.

I contacted Spybot and they told me that my PC had probably been infected with a "rootkit virus". They suggested downloading, installing and running ComboFix.exe from BleepingComputer.com. After running ComboFix.exe and looking through the resultant log, the only suspected file I could find was displayed as :-

Rootkit scan 2010-12-01 17:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\sccfg.sys 20 bytes scan completed successfully
hidden files: 1


Using Windows Explorer, I did a search on the file name "sccfg.sys", starting at the root folder of C:\ and scanning all sub-folders, including "hidden files". The search did not find sccfg.sys! Since ComboFix found it, I don't understand why Explorer couldn't.

Now, I have two questions. How do I locate sccfg.sys and should I just delete it when found?

Edited by hamluis, 09 December 2010 - 04:55 PM.
Moved from XP to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users