I have been reading this forums for quite a while now and they always helped me and found solution to my problems until now.
I went on a travel and got away from my computer for 4 weeks. I brought home to usb devices, both pendrive kind a like mp3s.
Seems then, after I installed ESET Smart Security 4(had 3 before), and updated it, I found the Rootkit, and it lets me know it is still in, everytime i log in.
I downloaded malwarebytes, dr web cureit, lavasoft ad-aware, rootrepeal, spybot s&d, ccleaner, hijackthis and i still have my trusty eset SS.
I disabled system restore thingy, then went safe mode and did complete scans with dr web, malwarebytes, ad-aware, and i cant remember wich more, but i tryied almost everything.
I did this at least 4 times now in this 2 days. Sometimes one of the programs found something, next time none, other time found another thing with diferent program and so on.
Until last night lavasoft ad-aware found something, tryied to deleat it next restart, i restarted on safe mode and eset ss4, pops and shows me an alert i haven seen on the days before,
about an object:
\\?\globalroot\systemroot\system32\kbiwkmxrxuxysr.dll
threat:
a variant of Win32/Kryptik.ZV Trojan
It trys to deleat/quarantine/clean it but it fails every attempt.
Now, can someone please tell me how should i take the hijackthis report here, and if its needed on safe mode so I can get a hand with this, please?
Kind Regards,
Esteban
PD: so far the only thing its bothering me about the virus, or the only way i know its there. Its cause every usb disk i plug, it says its without format, when it has one.
and it seems to block my msn from conecting. But the rest seems ok, changeing the view of files from hidden/system files, works, and i can download and install and update any program OK
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay, but I will do my best to keep it as short as possible.
Great!
I really apreciate your efforts and the will to help me
I've made some advance myself, I used combofix 2 times, and now ESET smart security 4, dosent say the virus is still in the computer.
But the problem is that, i still cant open my usb pendrives, and cant connect to msn via windows live messenger. Wich I presume is a problem from this virus, since i can open the pendrives on other computers, telling me it is OK, and here it says it dosent have a format. And I do can go into msn but useing a diferent program, called pidgin.
Thanks in advance for everything!
Kind Regards,
Esteban
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:
Absence of symptoms does not always mean the computer is clean
Please do not run any scans or fixes without my direction.
Finally, stay with this topic until I give you the final 'All clear' post.
Note: If you are running Windows Vista, please run all of our tools by right clicking on them and clicking Run as Administrator
1) DDS [external image: Posted Image]
Please download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop.
2) GMER
Please download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and put it in your next reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
3) RR
You can use your current copy if you still have it, or otherwise…
Please download RootRepeal.zip. Save it to your Desktop. Alternate download links here or here. Please print these instructions, you will not have an Internet connection!
If you have a 3rd party "unzipping" program…use it to open the zipped file…then skip to Step 5. Otherwise…
Right click on RootRepeal.zip and select "Extract All"….
Click Next on the "Welcome to the Compressed (zipped) Folders Extraction Wizard."
Click on the Browse…button, then click on Desktop, then click OK.
Once done, check (tick) the Show extracted files box and click Finish.
Before running RootRepeal:
Disconnect from the Internet as your system will be unprotected while using this tool.
Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
Open the RootRepeal folder and double-click on RootRepeal.exe to launch it.
When the program opens, click the Report tab at the bottom, then click the Scan button.
In the Select Drives, dialog Please select drives to scan: select all drives showing, then click OK.
The scan can take some time to finish. Do not use the computer while the scan is running.
When the scan has completed, a list of files will be generated in the RootRepeal window.
Click on the Save Report button and save it as "rootrepeal.txt" to your desktop.
Close and exit RootRepeal
Double-click on the file rootrepeal.txt… Notepad will open… copy/paste the file contents in your next reply.
Make sure to enable your anti-virus, Firewall and any other security programs you disabled. Note: If RootRepeal cannot complete a scan and results in a crash report, try repeating the scan in "safe mode". 4) What You Will Need To Post:
Excuse me Raktor, the day I've posted this, I also posted my problem on another forum, and they started helping me telling me how to do a couple of things.
This is why I used combofix and such, so, to aboid doing the same thing or interrupting on your plan to help me, i want to link you to the other thread, so you see what happend so far from the day I posted the first things. Now, after reading it, tell me if I must continue with this plan you have.
Seems like im clean, but again I'm thinking that I'm not. Since i put a CD on my cd reader and its like i havent put anything there, and the first time I posted about this it was working, so maybe I've got a new virus, or its affecting something else. This happens with my usb memorys of 2gbs i have. I have 2, when I plug them to my computer, it says they dosent have a format, but when I plug them to another computer, they are OK.
Thanks for letting us know about the other forum. As per our policies, we'll close this topic, as two sites can't work on the same computer at the same time - it just doesn't work.
If Rorschach deems your remaining issues a technical and not a malware problem, our Tech Team will be glad to help you in the Microsoft Windows forums.
