What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infected with rootkits win32:vanti-cc, kamso, possibly others and troj

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
dear all, thanks for help in advance. my pc is infected with multiple malware (rootkits, various win 32: kamso, vanti-cc, and trojans) located mostly in C:System Volume Information/_restore…… avast is not able to succesfully eliminate this. my pc ocasionally crashes (blaming the ATI card) and i have to unplug the alimentation cable and start it again. i have downloaded both malwarebytes and hijackthis and i attach both analysis files. thanks again. laika

Attachments:

Post #2
If you think you have rootkits then you should read this article. Notice it does not even mention the word rootkit but it all still applies:

rootkits
Post #3
have read the article and would like to ask the following: - what's the criteria for declaring a system "compromised"? is it the quantity of malware or the type of them? and how can i decide whether my system is "compromised"? - i use my pc for work and the info stored is helping me to earn my life. according to the article, even if i flatten my pc, if i reload this data (from backup) i may re-infect it. is there any way i can save my work related data? if reformatting is the only way, of course i have no other chance, but frankly i would be glad to come up with a handier solution. is there any other option?
Post #4
Iam not suggesting by any of your logs that you have rootkits, only going by what you posted.

Rootkits on board would be a compromised system.
A machine that has had core window files replaced/modified would be compromised.
A machine that has a virus that infects all .exe (or other extensions) would be compromised.
A machine that has a large quantity of any kind of malware on it could be compromised. So it could be compromised by the type of malware like rootkits and to myself (maybe not others) by the quantity of malware on board.
Its not always easy to know that your machine is compromised, some malware can be very apparent to a user, other malware not so much. Rootkits can hide from traditional AV and antimalware apps.

Some of the signs of malware.

We will get a tool to check for malware. Its called combofix. There is a guide to read first. Read the guide, download combofix to your desktop, disable any AV etc as explained in the guide. double click the icon and follow the prompts. post the combofix log in your reply.

Guide to using Combofix
Post #5
thanks shelf life.

please find the combofix log below:

best,
laika

—————————————————————————————-


ComboFix 09-07-11.02 - Laika Mihmih 12/07/2009 16:45.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.34.3082.18.1023.704 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Escritorio\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090711-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_AVPSYS
——-\Service_AVPsys


((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 )))))))))))))))))))))))))))))))
.

2009-07-12 01:48 . 2009-07-12 01:49 ——– d—–w- c:\archivos de programa\ERUNT
2009-07-12 01:20 . 2009-07-12 01:21 ——– d—–w- c:\archivos de programa\SpywareGuard
2009-07-11 12:19 . 2009-07-11 12:40 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-07-11 12:16 . 2009-02-09 11:50 2018304 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-07-11 12:16 . 2009-02-09 11:50 2060160 -c—-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-07-11 12:16 . 2009-02-09 11:50 2182912 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-07-11 12:16 . 2009-02-09 11:50 2138624 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-07-11 12:15 . 2008-10-24 11:10 453632 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2009-07-11 12:13 . 2008-06-14 17:59 272512 -c—-w- c:\windows\system32\dllcache\bthport.sys
2009-07-11 12:13 . 2008-06-14 17:59 272512 ——w- c:\windows\system32\drivers\bthport.sys
2009-07-10 20:00 . 2008-07-09 07:39 26488 —-a-w- c:\windows\system32\spupdsvc.exe
2009-07-10 20:00 . 2009-07-12 02:35 ——– d–h–w- c:\windows\$hf_mig$
2009-07-10 13:58 . 2009-07-10 13:58 ——– d—–w- c:\documents and settings\Laika Mihmih\Datos de programa\Malwarebytes
2009-07-10 13:58 . 2009-06-17 09:27 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-10 13:58 . 2009-07-10 13:58 ——– d—–w- c:\archivos de programa\Malwarebytes' Anti-Malware
2009-07-10 13:58 . 2009-07-10 13:58 ——– d—–w- c:\documents and settings\All Users\Datos de programa\Malwarebytes
2009-07-10 13:58 . 2009-06-17 09:27 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-08 10:07 . 2009-07-08 10:07 ——– d—–w- c:\archivos de programa\Trend Micro
2009-07-02 21:11 . 2009-07-02 21:12 ——– d—–w- c:\documents and settings\All Users\Datos de programa\Google Updater
2009-07-02 21:11 . 2009-07-02 21:15 ——– d—–w- c:\archivos de programa\Google
2009-07-01 13:59 . 2009-02-05 20:06 23152 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2009-07-01 13:59 . 2009-02-05 20:06 51376 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2009-07-01 13:59 . 2009-02-05 20:05 26944 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2009-07-01 13:59 . 2009-02-05 20:04 97480 —-a-w- c:\windows\system32\AvastSS.scr
2009-07-01 13:59 . 2009-02-05 20:08 93296 —-a-w- c:\windows\system32\drivers\aswmon.sys
2009-07-01 13:59 . 2009-02-05 20:08 94032 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2009-07-01 13:59 . 2009-02-05 20:07 114768 —-a-w- c:\windows\system32\drivers\aswSP.sys
2009-07-01 13:59 . 2009-02-05 20:07 20560 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-07-01 13:58 . 2009-02-05 20:11 1256296 —-a-w- c:\windows\system32\aswBoot.exe
2009-07-01 10:17 . 2009-07-10 12:46 ——– d—–w- c:\documents and settings\Laika Mihmih\Datos de programa\Spotify
2009-07-01 10:17 . 2009-07-01 10:17 ——– d—–w- c:\archivos de programa\Spotify
2009-07-01 01:23 . 2009-07-01 01:23 ——– d—–w- c:\documents and settings\Laika Mihmih\Datos de programa\Ahead
2009-06-21 21:29 . 2009-06-21 21:29 ——– d—–w- C:\UKI_pic_b

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-12 14:24 . 2001-08-24 11:00 51068 —-a-w- c:\windows\system32\perfc00A.dat
2009-07-12 14:24 . 2001-08-24 11:00 362204 —-a-w- c:\windows\system32\perfh00A.dat
2009-05-26 21:16 . 2009-04-07 00:37 ——– d—–w- c:\archivos de programa\FinePixViewer
2009-05-07 15:43 . 2004-08-19 13:42 346112 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:52 . 2004-08-19 13:42 662016 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2004-08-19 13:42 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:10 . 2004-08-19 13:30 1846784 —-a-w- c:\windows\system32\win32k.sys
2009-04-15 15:17 . 2004-08-19 13:42 584192 —-a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"NBJ"="c:\archiv~1\Ahead\NEROBA~1\NBJ.exe" [2005-02-10 1937408]
"swg"="c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"QuickTime Task"="c:\archivos de programa\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\archivos de programa\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\archivos de programa\Java\jre6\bin\jusched.exe" [2009-02-02 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\archivos de programa\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avast!"="c:\archiv~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-05-17 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\Laika Mihmih\Men£ Inicio\Programas\Inicio\
ERUNT AutoBackup.lnk - c:\archivos de programa\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
SpywareGuard.lnk - c:\archivos de programa\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
ExifLauncher2.lnk - c:\archivos de programa\FinePixViewer\QuickDCF2.exe [2009-4-7 303104]
Microsoft Office.lnk - c:\archivos de programa\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
ZyAIR USB Utility.lnk - c:\archivos de programa\ZyAIR USB Utility\ZyAIR.exe [2009-1-28 516096]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\iTunes\\iTunes.exe"=
"c:\\Archivos de programa\\Spotify\\spotify.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [01/07/2009 15:59 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [01/07/2009 15:59 20560]
R3 ZD1201U(ZyXEL);ZyAIR B-220 IEEE 802.11b Wireless LAN Driver (USB)(ZyXEL);c:\windows\system32\drivers\ZD1201U.sys [28/01/2009 22:41 55168]
R3 ZDNDIS5;ZDNDIS5 NDIS Protocol Driver;c:\windows\system32\ZDNDIS5.sys [28/01/2009 22:41 15872]
S2 gupdate1c9fb5adf51044;Servicio Google Update (gupdate1c9fb5adf51044);c:\archivos de programa\Google\Update\GoogleUpdate.exe [02/07/2009 23:14 133104]
.
Contents of the 'Scheduled Tasks' folder

2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-07-12 c:\windows\Tasks\Google Software Updater.job
- c:\archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-02 21:11]

2009-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2009-07-02 21:14]

2009-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2009-07-02 21:14]
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{02696AD5-FF96-454b-9E00-81DA8B79B678} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://blackle.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xportar; a Microsoft Excel - c:\archiv~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Laika Mihmih\Datos de programa\Mozilla\Firefox\Profiles\u6g2mds5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.blackle.com/
FF - plugin: c:\archivos de programa\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\archivos de programa\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-12 16:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3116)
c:\windows\system32\msi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
c:\archivos de programa\Alwil Software\Avast4\ashServ.exe
c:\archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\archivos de programa\Bonjour\mDNSResponder.exe
c:\archivos de programa\Java\jre6\bin\jqs.exe
c:\archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
c:\archivos de programa\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\ati2evxx.exe
c:\archivos de programa\SpywareGuard\sgbhp.exe
c:\archivos de programa\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-07-12 16:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-12 14:51

Pre-Run: 132.443.295.744 bytes libres
Post-Run: 132.417.966.080 bytes libres

165 — E O F — 2009-07-12 02:35
Post #6
hi,

You didnt install the recovery console. Combofix log looks ok. I see you have malwarebytes installed, is it updated and coming up clean after a scan?
you mentioned most malware was in;

located mostly in C:System Volume Information/_restore.

We can clean all this out as a last step when we are done.

You can post the MBAM log:

Once the program has loaded, select Perform FULL SCAN, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click **Remove Selected.**

**A restart of your computer most likely will be required to remove some items.**

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Post the log in your reply.
Post #7
hi shelf life, everything seems weird. i've run malwarebytes as you instructed, but twice. on the first run, it found 20 infected objects all located in avast's folder!!!! i have started this thread based on avast's findings (reported as located in system volume information_restore) and i do remember having downloaded avast from its original provider's page. but who can safely say such a thing, anyway? i have deleted removed all selected at the end and saved the log. on the second run (this time with avast disabled but still on the computer), malwarebytes detected 20 infected objects again, this time all of them located in system volume information_restore folder. didn't delete these but saved the log results. please find both logs below. for the time being i'm confused; is it that the rootkits can move around or never disclose their real location and appear now here now there, or is it that the avast i downloaded carried itself these? for the time being, i've uninstalled avast. may re-install depending on your answer, of course. thanks and best, laika ps: combofix said that it successfully installed the recovery console, although according to the log, something must have impeded that. malwarebytes 1st run (avast enabled) …………………………………………………………………… Malwarebytes' Anti-Malware 1.38 Versión de la Base de Datos: 2418 Windows 5.1.2600 Service Pack 2 13/07/2009 16:07:32 mbam-log-2009-07-13 (16-07-32).txt Tipo de examen : Examen Completo (A:\|C:\|E:\|F:\|G:\|H:\|I:\|) Objetos examinados: 119378 Tiempo transcurrido: 28 minute(s), 15 second(s) Procesos en Memoria Infectados: 0 Módulos en Memoria Infectados: 0 Claves del Registro Infectadas: 0 Valores del Registro Infectados: 0 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 0 Ficheros Infectados: 20 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos en Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: (No se han detectado elementos maliciosos) Valores del Registro Infectados: (No se han detectado elementos maliciosos) Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: (No se han detectado elementos maliciosos) Ficheros Infectados: c:\archivos de programa\alwil software\Avast4\A0016435.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016419.com (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016421.com (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016438.com (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016441.exe (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016442.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016454.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016457.exe (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016479.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016482.exe (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016485.exe (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016486.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0016497.dll (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0020101.exe (Worm.Magania) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0021110.exe (Worm.Magania) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0021125.exe (Worm.Magania) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0024393.com (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0024394.com (Spyware.OnlineGames) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0024395.exe (Worm.Magania) -> Delete on reboot. c:\archivos de programa\alwil software\Avast4\A0024400.exe (Worm.Magania) -> Delete on reboot. 2nd malwarebytes run (avast present but disabled): …………………………………… Malwarebytes' Anti-Malware 1.38 Versión de la Base de Datos: 2418 Windows 5.1.2600 Service Pack 2 13/07/2009 16:29:33 mbam-log-2009-07-13 (16-29-16)_AVDISABLED.txt Tipo de examen : Examen Completo (A:\|C:\|E:\|F:\|G:\|H:\|I:\|) Objetos examinados: 119237 Tiempo transcurrido: 15 minute(s), 39 second(s) Procesos en Memoria Infectados: 0 Módulos en Memoria Infectados: 0 Claves del Registro Infectadas: 0 Valores del Registro Infectados: 0 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 0 Ficheros Infectados: 20 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos en Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: (No se han detectado elementos maliciosos) Valores del Registro Infectados: (No se han detectado elementos maliciosos) Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: (No se han detectado elementos maliciosos) Ficheros Infectados: c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP103\A0020101.exe (Worm.Magania) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP103\A0021110.exe (Worm.Magania) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP103\A0021125.exe (Worm.Magania) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP106\A0024393.com (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP106\A0024394.com (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP106\A0024395.exe (Worm.Magania) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP106\A0024400.exe (Worm.Magania) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP96\A0016419.com (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016421.com (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016435.dll (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016438.com (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016441.exe (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016442.dll (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016454.dll (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016457.exe (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016479.dll (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016482.exe (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016485.exe (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016486.dll (Spyware.OnlineGames) -> No action taken. c:\system volume information\_restore{2452a6b9-2198-413d-8f2a-88992f9ccbd3}\RP97\A0016497.dll (Spyware.OnlineGames) -> No action taken.
Post #8
and …. i've run malwarebytes the 3rd time (avast unistalled now). all the 20 infected objects are in the same place fine and well. don't know whether removing these may cause any problem in my system, i'll wait for your answer. thanks again.
Post #9
hi laika222,
ok, thanks for all the info.

on the first run, it found 20 infected objects all located in avast's folder!!!!

MBAM must have found these items in Avast's quarantine folder. Most likely these items where already remove by avast and put in a folder for safe keeping. Most AV have a option to delete the contents of this folder
I dont know why it didnt find them in the system restore archive the first time, unless your machine had created a new restore point and they got put in there and MBAM found them on the next scan?

In any case we can make a new clean restore point as a last step. You can have MBAM delete whatever it finds. These items arent rootkits and it is possible for malware to get backed up in the system restore archives.
You can reinstall and update Avast. run MBAM and delete whatever it finds.
Post #10
hi shelf life, at this stage both MBAM and Avast declare my system clean after having run both several times in a paranoid vein :-). my pc keeps on first freezing for a few seconds and eventually crashing afterwards whatsoever, especially when typing (on writing pad or simply emails). i have to unplug main cable and restart the machine again. so maybe i should look up for another problem. …. shall we declare the problem solved, as far as malware is concerned? my most sincere thanks for your guidance and patience. laika
Post #11 last edited
ok good. You are welcome. I believe we can call you malware free. You can uninstall combofix like this: start>run and type in combofix /u click ok or enter Note: there is a space after the x and before the / Keep malwarebytes and always check for updates before a scan. Its good practice to keep it updated even if you dont scan that much. The paid version offers auto-updating. Combofix is very good at finding stealth objects like rootkits, but it didnt find any on your machine. You mentioned rootkits in your topic title. did one of your apps find a rootkit on your machine? we can get a tool just for rootkits if needed.
Post #12
hi, it was avast which named these as rootkits, this is how and why i came to start this thread. initially it found: win32: rootkit-gen (rtk) win32: vanti-cc (rtk) win32: kamso (trj) win32: trojan-gen (other). don't know why combofix couldn't find any or which of the two programs we can rely on more. what do you think?
Post #13 last edited
and now into trouble! wanted to uninstall combofix but i mistakenly clicked on the icon on my desktop. even if i go to start>run typing command for uninstall it wouldn't go away now. is it ok if i run it for the last time, disabling the necessary firewal, AV, etc. before trying uninstall? i'm sorry, i fell into the well of stupidity for some secs.
Post #14
ok no problem. If Avast found these items then it must have removed them. your re-scan with a updated avast was good:

Avast declare my system clean


To remove combofix we can get another tool; I will post back as soon as i can find a good link to the tool.
Post #15
download OTM to your desktop. Double click the icon. Click on the green CleanUp! button and follow the prompts.

To make a new restore point the why and how:

One of the features of Windows ME, XP and Vista is the System Restore option, however if malware infects a computer it is possible that the malware could be backed up in the System Restore archive. Therefore, clearing the restore points is a good idea after malware is removed and your computer appears to be functioning ok.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore. (deletes old possibly infected restore points)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore. (makes a new restore points on a clean system)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK, then reboot

and last: some tips for you:

10 Tips for Reducing Your Risk To Malware:
The Short Version

1) It is essential to Keep your OS,(Windows) browser (IE, FireFox) and other software up to date to "patch" vulnerabilities that could be exploited. This is also true for web based applications like Java, Adobe Flash/Reader, QuickTime etc. Check there version status here.

2) Know what you are installing to your computer. Alot of software can come bundled with unwanted add-ons, like adware, toolbars and malware. Do not install any files from ads, popups or random links. Do not fall for fake warnings about virus and trojans being found on your computer and your then prompted to install software to remedy this. See also the signs that you may have malware on your computer.

3) Install and keep updated: one antivirus and two or three anti-malware applications. If not updated they will soon be worthless. Scanning frequency is a function of your computer habits.

4) Refrain from clicking on links or attachments you receive via E-Mail, IM, IRC, Chat Rooms or Social Networking Sites, no matter how tempting or legitimate the message may seem.

5) Don't click on ads/pop ups or offers from websites requesting that you need to install software, media players or codecs to your computer–for any reason.

6) Don't click on offers to "scan" your computer. Install ActiveX Objects with care. Do you trust the website?

7) Set up and use limited (non-privileged) accounts for everyday use, rather than administrator accounts. Limited accounts can help prevent *malware from installing.*

8) Install and understand the limitations of a software firewall.

9) Consider using an alternate browser and E-mail client. Internet Explorer and OutLook Express are popular targets for malicious code because they are widely used. All browsers can have vulnerabilities but statistically it is the most commonly used browser that will tend to be targeted the most See also: Hardening or Securing Internet Explorer.

10) Warez, cracks etc are very popular for carrying malware payloads. Avoid. If you install files via p2p networks then you are much more likely to encounter malicious code. Do you trust the source? Do you really need another malware source?

A longer version in link below.

Happy Safe Surfing.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI