Rootkit attack

Status
Not open for further replies.
satyanjoy

satyanjoy

Explorer
avast detected rootkit in my pc. i delete it many times but no help.

my.php
[/URL][/IMG]

if I format my c drive n reinstall windows- will it work or I need to format my entire hdd-all the drives. I have data to be backup in other driver- if I burn those data will they carry the rootkit ?
 
If you format your C: the rootkit will be gone.But if the source is still there on another drive & if you run it after formatting, it will be back again.Check out RootkitRevealer 1.71 here & let me know the results.If possible switch over to Bit Defender or Kaspersky.
 
Rootkits are pita, the message keeps popping and avast dies.I shifted to latest nod32 and its alright now. Just formatting C won't help.
 
Winter said:
If you format your C: the rootkit will be gone.But if the source is still there on another drive & if you run it after formatting, it will be back again.Check out RootkitRevealer 1.71 here & let me know the results.If possible switch over to Bit Defender or Kaspersky.
Click to expand...

I am getting kaspersky from rahul within few days.
here is the rootkitrevealer result :
my.php
[/URL][/IMG]
 
Tanuj said:
Rootkits are pita, the message keeps popping and avast dies.I shifted to latest nod32 and its alright now. Just formatting C won't help.
Click to expand...

formatting is not my first choice.if possible any way I can remove it..how to do that - changing the antivirus system ??
 
Your results are showing that the infected files were deleted.Maybe you ran Avast just before the RR.The results should show presence of a .sys file in your C: if it really is a rootkit.Close all tasks, reboot & run RootkitRevealer once again.It's important to know the name of that rootkit in order to remove it.
 
i got the following result with GMER .It detected some sys file



-----

guys from yesterday I am hearing an annoying sound from my cpu-initially thought fan noise but tonight I noticed that my fdd light is on and the sound like when fdd is accessing the floppy in it-it seems that some application/os constantly trying to access the fdd

edit: i have downloaded malwarebyte's antimalware-trial version and scanning now-will update the result soon
 
None of those files can be seen as a threat.I just have doubts about spiq.sys & related files simply because there is no info about it anywhere but on Kaspersky forum & that too in Russian.Try out the other softwares suggested to you.Otherwise I'm sure Kaspersky will detect something.If it's sounding like a headache then simply do a Format-Reinstall.

FDD noise cannot be heard without a floppy disk in there.If there is one inside then remove it.If that isn't the case & it's sounding something like a random clicking noise then it's possibly comming out of your HDD.And that could mean your HDD is failing.Another possibility is that one of your dangling wires is getting in the path of your CPU/? fan.
 
Winter said:
None of those files can be seen as a threat.I just have doubts about spiq.sys & related files simply because there is no info about it anywhere but on Kaspersky forum & that too in Russian.Try out the other softwares suggested to you.Otherwise I'm sure Kaspersky will detect something.If it's sounding like a headache then simply do a Format-Reinstall.

FDD noise cannot be heard without a floppy disk in there.If there is one inside then remove it.If that isn't the case & it's sounding something like a random clicking noise then it's possibly comming out of your HDD.And that could mean your HDD is failing.Another possibility is that one of your dangling wires is getting in the path of your CPU/? fan.
Click to expand...

i checked with rootkit revealer by today morning after booting my pc ;

my.php
[/URL][/IMG]

my c drive look like this :



edit:

I have checked,,the sound is coming from the fdd and the greeen light is on. i have not open my cpu yet for checking dangling wire . will do that and let u know.

i am installing kaspersky online virus checking, I will also download the trail version and will do the thorough checking and update here.

edit 2:

just completed kespersky online scanning, here is the report :

my.php
[/URL][/IMG]

I have downloaded the kespersky internet security trial version. I will remove avast and use kespersky and try to remove the trojan;will update later.

edit3:

I am not able to install kespersky. getting the following error :

my.php
[/URL][/IMG]

it shows avg 8 installed installed in my pc. I used advanced system care free edition to remove any trace of it but no help. :(
 
Dude it happened today rite?

Check whether System restore is on or not.

If it is on try doing a system restore. Check restore dates and restore it to yesterday or day b4 yesterday

:D
 
rocky_pratik said:
Dude it happened today rite?

Check whether System restore is on or not.

If it is on try doing a system restore. Check restore dates and restore it to yesterday or day b4 yesterday

:D
Click to expand...

Not sure,,but from today if become worst. I am not able see the folders in my c drive.

I tried system restore to 14th apr. still the same problem.c drive content not showing. I delete the avg from registry and finally able to install kaspersky and run full scanning and its still going on
 
System Restore should be turned off during an infection as it has backup copies of registry entries, dll cache & monitored files & hence can can re-infect your system.Presence of more than one Anti-Virus can badly screw up your OS as well.

Trojan-Downloader.Win32.Agent.brk is a Rootkit & can be removed using F-Secure BlackLight

Trojan.Win32.VB.cre can be removed using Kaspersky, Bit Defender, Sunbelt Anti-Virus & F-Secure.

If the above doesn't work then I'll suggest a format-reinstall instead of wasting time & overloading your gray matter ;)
 
Winter said:
System Restore should be turned off during an infection as it has backup copies of registry entries, dll cache & monitored files & hence can can re-infect your system.Presence of more than one Anti-Virus can badly screw up your OS as well.

Trojan-Downloader.Win32.Agent.brk is a Rootkit & can be removed using F-Secure BlackLight

Trojan.Win32.VB.cre can be removed using Kaspersky, Bit Defender, Sunbelt Anti-Virus & F-Secure.

If the above doesn't work then I'll suggest a format-reinstall instead of wasting time & overloading your gray matter ;)
Click to expand...

yeah//// format - reinstall on the way ...ahoyyyy:hap2:
 
Status
Not open for further replies.
Top Bottom