I have Troj/Rustok-N! How can I remove it!!!

View previous topic View next topic Go down

I have Troj/Rustok-N! How can I remove it!!!

Post by FireShadow on 19th July 2009, 4:48 pm

Hello, some sites I go to tell me that I have the Troj/Rustok-N trojan. Norton 360 wont detect it, and Spydoctor wont update. I downloaded Hijackthis and have the log. Here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:19 PM, on 7/19/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
c:\Program Files\Zune\ZuneNss.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ernesto Porras\Desktop\winlogon.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: {bfc6d409-bca6-074b-1ca4-85a20e9ac9dd} - {dd9ca9e0-2a58-4ac1-b470-6acb904d6cfb} - C:\WINDOWS\system32\vhcxow.dll (file missing)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - [You must be registered and logged in to see this link.]
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - [You must be registered and logged in to see this link.]
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Jigsaw Genius Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{085FA645-45C1-4E5F-B002-7ABCB8F4EFA0}: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C565F94-E69C-4A8C-B418-95B10FA3CFF2}: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{085FA645-45C1-4E5F-B002-7ABCB8F4EFA0}: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{085FA645-45C1-4E5F-B002-7ABCB8F4EFA0}: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.6,85.255.112.68
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 13813 bytes

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by Origin on 19th July 2009, 7:23 pm

Hello FireShadow,

Welcome to Geek Police, my name is Origin and I will be helping you today. Please keep the following in mind:

  • If you do not get a reply from me or another helper within 2 days, please reply to your topic with the phrase BUMP
  • If you have any cracked/pirated software in your computer delete them or we will not help you.
  • Only follow advise from Geek Police Staff and not a regular member.
  • Do NOT run any tool without Geek Police supervision as it could hinder your system useless.


  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: {bfc6d409-bca6-074b-1ca4-85a20e9ac9dd} - {dd9ca9e0-2a58-4ac1-b470-6acb904d6cfb} - C:\WINDOWS\system32\vhcxow.dll (file missing)
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL



  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by FireShadow on 19th July 2009, 8:55 pm

Thanks, here is the log...

Malwarebytes' Anti-Malware 1.39
Database version: 2421
Windows 5.1.2600 Service Pack 2

7/19/2009 4:53:46 PM
mbam-log-2009-07-19 (16-53-46).txt

Scan type: Full Scan (C:\|)
Objects scanned: 147070
Time elapsed: 58 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 15
Registry Values Infected: 1
Registry Data Items Infected: 9
Folders Infected: 2
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Program Files\Mozilla Firefox\components\srff.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prunnet (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpeedRunner (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{085fa645-45c1-4e5f-b002-7abcb8f4efa0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1c565f94-e69c-4a8c-b418-95b10fa3cff2}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{085fa645-45c1-4e5f-b002-7abcb8f4efa0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1c565f94-e69c-4a8c-b418-95b10fa3cff2}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{085fa645-45c1-4e5f-b002-7abcb8f4efa0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{1c565f94-e69c-4a8c-b418-95b10fa3cff2}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.6,85.255.112.68 -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\Ernesto Porras\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ernesto Porras\Application Data\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\components\srff.dll (Trojan.Agent) -> Delete on reboot.
c:\program files\AskSBar\bar\1.bin\A2HIGHIN.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\AskSBar\bar\1.bin\A2PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
c:\program files\AskSBar\bar\1.bin\NPASKSBR.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\vaijvbgg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\yuxfaenm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\documents and settings\ernesto porras\application data\speedrunner\config.cfg (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ernesto Porras\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by Origin on 20th July 2009, 3:39 pm

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Combo-Fix Log Part 1

Post by FireShadow on 20th July 2009, 4:39 pm

Combo-Fix Log Part 1:

ComboFix 09-07-19.04 - Ernesto Porras 07/20/2009 12:11.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.132 [GMT -4:00]
Running from: c:\documents and settings\Ernesto Porras\Desktop\Combo-Fix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Installer\1453a32f.msi
c:\windows\Installer\51846.msi
c:\windows\Installer\6a3cc.msi
c:\windows\Installer\73014.msi
c:\windows\system32\drivers\ESQULodybxijgcksvcgeqjwqkqhmpckbirvnj.sys
c:\windows\system32\qYbIRXbc.ini
c:\windows\system32\qYbIRXbc.ini2

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.]
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ESQULserv.sys


((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Malwarebytes
2009-07-19 19:45 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-19 19:45 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-19 16:27 . 2009-07-19 16:30 -------- d-----w- c:\documents and settings\Ernesto Porras\.SunDownloadManager
2009-07-18 14:34 . 2008-06-02 19:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-07-18 14:34 . 2008-06-02 19:19 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-07-18 14:34 . 2008-06-11 01:22 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-07-18 14:34 . 2008-06-02 19:19 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-07-18 14:33 . 2009-07-18 14:35 -------- d-----w- c:\program files\Spyware Doctor
2009-07-18 14:33 . 2009-07-18 14:33 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\PC Tools
2009-07-18 14:31 . 2009-07-18 14:33 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\GetRightToGo
2009-07-18 07:33 . 2009-07-18 07:33 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-07-18 07:33 . 2009-07-18 07:36 -------- d-----w- c:\program files\Roxio
2009-07-08 23:26 . 2009-07-08 23:26 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\InstallShield
2009-07-08 22:35 . 2009-07-08 22:35 -------- d-----w- c:\program files\AIM
2009-07-07 23:55 . 2009-07-07 23:55 -------- d-----w- c:\documents and settings\Ernesto Porras\Local Settings\Application Data\WinZip
2009-07-07 23:52 . 2009-07-07 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-07-07 23:12 . 2009-07-08 00:13 256 ----a-w- c:\windows\system32\pool.bin
2009-07-07 23:12 . 2009-07-07 23:12 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Research In Motion
2009-07-07 22:53 . 2009-07-07 22:53 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-07-07 22:52 . 2009-07-07 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-07-07 22:49 . 2009-07-18 07:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-07-07 22:49 . 2009-07-18 07:40 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-07-07 22:41 . 2009-01-09 20:18 27136 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2009-07-07 22:39 . 2009-07-18 07:07 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-07-07 22:39 . 2009-07-07 22:39 -------- d-----w- c:\program files\Research In Motion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 16:22 . 2008-12-30 04:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-19 16:39 . 2008-04-21 00:42 -------- d-----w- c:\program files\BitComet
2009-07-19 16:31 . 2008-04-05 13:54 -------- d-----w- c:\program files\Java
2009-07-19 15:45 . 2008-05-27 00:07 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-18 14:18 . 2008-04-05 03:10 37192 -c--a-w- c:\documents and settings\Ernesto Porras\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-07 23:48 . 2009-05-28 03:41 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\BitZipper
2009-07-07 23:21 . 2009-07-07 23:21 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-07-07 22:49 . 2008-04-05 02:07 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-07 19:59 . 2008-09-10 03:17 -------- d-----w- c:\program files\QuickTime
2009-07-05 17:03 . 2008-04-05 13:55 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\FrostWire
2009-07-03 03:38 . 2008-04-25 19:40 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Move Networks
2009-06-15 01:00 . 2009-05-27 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-06 00:51 . 2009-02-06 19:50 -------- d-----w- c:\program files\Norton Security Scan
2009-06-01 18:10 . 2009-06-01 17:50 8673792 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2009-06-01 17:51 . 2009-06-01 17:51 -------- d-----w- c:\program files\WebEx
2009-06-01 17:47 . 2009-06-01 17:47 -------- d-----w- c:\program files\Linksys
2009-05-30 14:10 . 2009-05-27 01:16 -------- d-----w- c:\program files\Norton 360
2009-05-30 13:30 . 2009-05-27 01:13 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-05-30 13:30 . 2009-05-27 01:13 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-30 13:30 . 2009-05-27 01:12 -------- d-----w- c:\program files\Symantec
2009-05-30 13:30 . 2008-12-30 04:16 806 -c--a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-05-30 13:30 . 2008-12-30 04:16 10635 -c--a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-28 02:01 . 2009-05-02 09:20 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-05-27 00:55 . 2008-12-30 04:28 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Symantec
2009-05-27 00:47 . 2009-01-20 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-05-27 00:47 . 2009-01-20 22:26 -------- d-----w- c:\program files\McAfee
2009-05-24 21:21 . 2009-05-24 21:21 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2009-05-05 04:09 . 2008-04-05 13:41 4876 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-02 09:22 . 2009-05-02 09:22 49152 ----a-r- c:\documents and settings\Ernesto Porras\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2009-06-12 12:54 . 2008-08-27 01:39 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-04-01 02:47 . 2009-05-28 13:40 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2000-06-05 22:47 . 2009-01-01 04:37 32768 -c--a-w- c:\program files\mozilla firefox\plugins\AppSub32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11390:TCP"= 11390:TCP:BitComet 11390 TCP
"11390:UDP"= 11390:UDP:BitComet 11390 UDP
"6881:TCP"= 6881:TCP:BitComet 6881 TCP
"6881:UDP"= 6881:UDP:BitComet 6881 UDP
"67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2009 6:06 AM 101936]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 10:32 PM 23888]

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Part 2

Post by FireShadow on 20th July 2009, 4:40 pm

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-07-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-07-20 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 16:16]

2009-07-20 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 16:16]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ernesto Porras\Application Data\Mozilla\Firefox\Profiles\g27at549.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - plugin: c:\documents and settings\Ernesto Porras\Application Data\Mozilla\Firefox\Profiles\g27at549.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\kSolo\npAVX.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NpIpx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-20 12:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(396)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\windows\system32\ZuneBusEnum.exe
c:\program files\Zune\ZuneNss.exe
c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE
c:\program files\McAfee\Common Framework\Mctray.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
.
**************************************************************************
.
Completion time: 2009-07-20 12:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-20 16:31

Pre-Run: 27,281,391,616 bytes free
Post-Run: 27,350,335,488 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

225 --- E O F --- 2009-04-23 09:01

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by Origin on 21st July 2009, 5:43 pm

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\BitComet
c:\documents and settings\Ernesto Porras\Application Data\FrostWire

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11390:TCP"=-
"11390:UDP"=-
"6881:TCP"=-
"6881:UDP"=-


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Combo-Fix Results

Post by FireShadow on 21st July 2009, 9:36 pm

ComboFix 09-07-20.05 - Ernesto Porras 07/21/2009 17:21.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.192 [GMT -4:00]
Running from: c:\documents and settings\Ernesto Porras\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Ernesto Porras\Desktop\CFScript.txt
AV: Norton 360 *On-access scanning disabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
.

((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Malwarebytes
2009-07-19 19:45 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-19 19:45 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-19 19:45 . 2009-07-19 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-19 16:27 . 2009-07-19 16:30 -------- d-----w- c:\documents and settings\Ernesto Porras\.SunDownloadManager
2009-07-18 14:34 . 2008-06-02 19:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-07-18 14:34 . 2008-06-02 19:19 42376 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-07-18 14:34 . 2008-06-11 01:22 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-07-18 14:34 . 2008-06-02 19:19 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-07-18 14:33 . 2009-07-18 14:35 -------- d-----w- c:\program files\Spyware Doctor
2009-07-18 14:33 . 2009-07-18 14:33 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\PC Tools
2009-07-18 14:31 . 2009-07-18 14:33 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\GetRightToGo
2009-07-18 07:33 . 2009-07-18 07:33 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-07-18 07:33 . 2009-07-18 07:36 -------- d-----w- c:\program files\Roxio
2009-07-08 23:26 . 2009-07-08 23:26 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\InstallShield
2009-07-08 22:35 . 2009-07-08 22:35 -------- d-----w- c:\program files\AIM
2009-07-07 23:55 . 2009-07-07 23:55 -------- d-----w- c:\documents and settings\Ernesto Porras\Local Settings\Application Data\WinZip
2009-07-07 23:52 . 2009-07-07 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-07-07 23:12 . 2009-07-08 00:13 256 ----a-w- c:\windows\system32\pool.bin
2009-07-07 23:12 . 2009-07-07 23:12 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Research In Motion
2009-07-07 22:53 . 2009-07-07 22:53 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-07-07 22:52 . 2009-07-07 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-07-07 22:49 . 2009-07-18 07:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-07-07 22:49 . 2009-07-18 07:40 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-07-07 22:41 . 2009-01-09 20:18 27136 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2009-07-07 22:39 . 2009-07-18 07:07 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-07-07 22:39 . 2009-07-07 22:39 -------- d-----w- c:\program files\Research In Motion

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 21:01 . 2008-12-30 04:11 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-19 16:31 . 2008-04-05 13:54 -------- d-----w- c:\program files\Java
2009-07-19 15:45 . 2008-05-27 00:07 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-18 14:18 . 2008-04-05 03:10 37192 -c--a-w- c:\documents and settings\Ernesto Porras\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-07 23:48 . 2009-05-28 03:41 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\BitZipper
2009-07-07 23:21 . 2009-07-07 23:21 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-07-07 22:49 . 2008-04-05 02:07 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-07 19:59 . 2008-09-10 03:17 -------- d-----w- c:\program files\QuickTime
2009-07-03 03:38 . 2008-04-25 19:40 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Move Networks
2009-06-15 01:00 . 2009-05-27 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-06 00:51 . 2009-02-06 19:50 -------- d-----w- c:\program files\Norton Security Scan
2009-06-01 18:10 . 2009-06-01 17:50 8673792 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2009-06-01 17:51 . 2009-06-01 17:51 -------- d-----w- c:\program files\WebEx
2009-06-01 17:47 . 2009-06-01 17:47 -------- d-----w- c:\program files\Linksys
2009-05-30 14:10 . 2009-05-27 01:16 -------- d-----w- c:\program files\Norton 360
2009-05-30 13:30 . 2009-05-27 01:13 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-05-30 13:30 . 2009-05-27 01:13 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-30 13:30 . 2009-05-27 01:12 -------- d-----w- c:\program files\Symantec
2009-05-30 13:30 . 2008-12-30 04:16 806 -c--a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-05-30 13:30 . 2008-12-30 04:16 10635 -c--a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-28 02:01 . 2009-05-02 09:20 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2009-05-27 00:55 . 2008-12-30 04:28 -------- d-----w- c:\documents and settings\Ernesto Porras\Application Data\Symantec
2009-05-27 00:47 . 2009-01-20 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-05-27 00:47 . 2009-01-20 22:26 -------- d-----w- c:\program files\McAfee
2009-05-24 21:21 . 2009-05-24 21:21 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2009-05-05 04:09 . 2008-04-05 13:41 4876 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-02 09:22 . 2009-05-02 09:22 49152 ----a-r- c:\documents and settings\Ernesto Porras\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2009-06-12 12:54 . 2008-08-27 01:39 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-04-01 02:47 . 2009-05-28 13:40 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2000-06-05 22:47 . 2009-01-01 04:37 32768 -c--a-w- c:\program files\mozilla firefox\plugins\AppSub32.dll
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-21 21:01 . 2009-07-21 21:01 16384 c:\windows\Temp\Perflib_Perfdata_c8.dat
+ 2009-07-21 21:01 . 2009-07-21 21:01 16384 c:\windows\Temp\Perflib_Perfdata_314.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2/18/2008 3:37 PM 149352]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/5/2008 10:01 AM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2009 6:06 AM 101936]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 10:32 PM 23888]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [7/18/2009 10:33 AM 356920]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-07-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-07-21 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 16:16]

2009-07-21 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-04-08 16:16]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Ernesto Porras\Application Data\Mozilla\Firefox\Profiles\g27at549.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - plugin: c:\documents and settings\Ernesto Porras\Application Data\Mozilla\Firefox\Profiles\g27at549.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\kSolo\npAVX.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NpIpx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\MpcStar\Codecs\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-21 17:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3960)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-21 17:32
ComboFix-quarantined-files.txt 2009-07-21 21:31
ComboFix2.txt 2009-07-21 20:51
ComboFix3.txt 2009-07-20 16:32

Pre-Run: 27,281,444,864 bytes free
Post-Run: 27,225,919,488 bytes free

184 --- E O F --- 2009-04-23 09:01

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Just to let you know

Post by FireShadow on 21st July 2009, 9:56 pm

Hey Origin, just to let you know, the above is the log that I did the second time. The first time, the log showed up, but I had to restart the computer because no start menu or desktop icons showed up.

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by Origin on 22nd July 2009, 9:17 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Malware Results

Post by FireShadow on 22nd July 2009, 10:13 pm

Here is the log... No infections detected! Thanks Origin


Malwarebytes' Anti-Malware 1.39
Database version: 2482
Windows 5.1.2600 Service Pack 2

7/22/2009 6:10:47 PM
mbam-log-2009-07-22 (18-10-47).txt

Scan type: Quick Scan
Objects scanned: 89924
Time elapsed: 6 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

Re: I have Troj/Rustok-N! How can I remove it!!!

Post by Origin on 24th July 2009, 6:27 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Thanks

Post by FireShadow on 24th July 2009, 7:32 pm

Thanks Origin! The computer is running great now. I appreciate your help.

FireShadow
Novice
Novice

Posts Posts : 8
Joined Joined : 2009-07-19
OS OS : XP
Points Points : 27000
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum