spyware/virus named 'Troj/Rustok-N' [Closed] [Solved]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

3 Pages

1 2 3 >

spyware/virus named 'Troj/Rustok-N' [Closed] [Solved], I've got the dreaded 'Troj/Rustok-N' virus

Options

PeterBro View Member Profile	Jun 12 2009, 01:28 PM Post #1
Member Posts: 16 OS: Vista	Can somebody please take me through the paces to help me remove this virus named 'Troj/Rustok-N'? It would be greatly appreciated

Essexboy View Member Profile	Jun 12 2009, 01:31 PM Post #2
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	Please follow all of the steps in this section of the Malware Forum. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post the rooter and OTL Logs in this thread

PeterBro View Member Profile	Jun 12 2009, 02:05 PM Post #3
Member Posts: 16 OS: Vista	Thanks Essex but i've hit a snag, I've gotten to the step that says download mbam and it tells me Oops! This link appears to be broken.. I've tried to go to the web address manually and searching it etc. Should I be doing this all in safe mode rather than normal mode which i am currently in?

PeterBro View Member Profile	Jun 12 2009, 02:49 PM Post #4
Member Posts: 16 OS: Vista	Update tried to download mbam in safe mode and experienced the same problem

Essexboy View Member Profile	Jun 12 2009, 04:11 PM Post #5
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	OK in that case To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link. Download OTS to your Desktop Close ALL OTHER PROGRAMS. Double-click on OTS.exe to start the program. Check the box that says Scan All Users Under Additional Scans check the following: File - Lop Check File - Purity Scan Evnt - EvtViewer (last 10) Now click the Run Scan button on the toolbar. Let it run unhindered until it finishes. When the scan is complete Notepad will open with the report file loaded in it. Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it. Please attach the log in your next post. To attach a file, do the following: Click Add Reply Under the reply panel is the Attachments Panel Browse for the attachment file you want to upload, then click the green Upload button Once it has uploaded, click the Manage Current Attachments drop down box Click on to insert the attachment into your post

PeterBro View Member Profile	Jun 12 2009, 04:38 PM Post #6
Member Posts: 16 OS: Vista	Thank you very much so far EssexBoy. Here's my log OTS.Txt ( 182.77K ) Number of downloads: 82

Essexboy View Member Profile	Jun 13 2009, 04:55 AM Post #7
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	OK you appear to have a rootkit. I will reset your internet first so that you can download stuff. I note that you have Avira nad Norton which is your main Antivirus ? Start OTS. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button. CODE [Kill All Processes] [Unregister Dlls] [Registry - Safe List] < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ YN -> NameServer -> 85.255.112.24,85.255.112.118 < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ YN -> {80D8CA13-8438-4D45-8407-5CC1A29E9EBB}\\NameServer -> 85.255.112.24,85.255.112.118 (Dell Wireless 1505 Draft 802.11n WLAN Mini-Card) YN -> {9D5096D6-1BEC-4856-B9E0-8E96A0C291DE}\\DhcpNameServer -> 85.255.112.24,85.255.112.118 (Broadcom 440x 10/100 Integrated Controller) YN -> {9D5096D6-1BEC-4856-B9E0-8E96A0C291DE}\\NameServer -> 85.255.112.24,85.255.112.118 (Broadcom 440x 10/100 Integrated Controller) < Drives with AutoRun files > -> NY -> C:\autorun.inf [[autorun] \|;dczrddadllftaznqaeilvrhnqvplqovgdgjbplqgnjmgsrksleedvatpjvmw \| shellexecute="RECYCLER\S-4-3-52-100026612-100009763-100024268-2793.com c:\" \|;mlotyyigbjucdkkznddmgdwfhpspzasdizteipqaraehzblqowdwykaeghprghkwhvyeildijhkwxxyovowmbrclqummcxqd owfxeckm \| shell\Open\command="RECYCLER\S-4-3-52-100026612-100009763-100024268-2793.com c:\" \|;haqpiitqnmvurazwxddyxhxrpwinxelbekmlttkuzxoqmkpikrixczjxactgkqpxkmr \| shell=Open \| ] -> C:\autorun.inf [ NTFS ] NY -> D:\autorun.inf [[autorun] \|;btzxomrlbbbnluwjosobhuvsxnhn \| shellexecute="RECYCLER\S-4-3-52-100026612-100009763-100024268-2793.com d:\" \|;wovszvvusvdavvmljfxahllq \| shell\Open\command="RECYCLER\S-4-3-52-100026612-100009763-100024268-2793.com d:\" \|;ztmjkjxivunpwgdlcfkigbrsjvkqnincyltszpzgwlebvhdjbypxwbhvnmuiwpnih \| shell=Open \| ] -> D:\autorun.inf [ NTFS ] [Files/Folders - Created Within 30 Days] NY -> {5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job NY -> gxvxccount -> C:\Windows\System32\gxvxccount [Files/Folders - Modified Within 30 Days] NY -> gxvxccount -> C:\Windows\System32\gxvxccount [Empty Temp Folders] [Start Explorer] The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here. I will review the information when it comes back in. THEN Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. Link 1 Link 2 Link 3 -------------------------------------------------------------------- Double click on Combo-Fix.exe & follow the prompts. When finished, it will produce a report for you. Please post the C:\ComboFix.txt along with a OTListit log so we can continue cleaning the system. Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

PeterBro View Member Profile	Jun 14 2009, 02:37 AM Post #8
Member Posts: 16 OS: Vista	Hello again, I use Norton as my main antivirus and Avira as a second opinion. Regarding the code you sent to place within ots, no luck. I can copy/paste into the program just fine but as soon as a say run fix it goes for 30 seconds then the program freezes up or my system will freeze forcing me to restart the machine.

Essexboy View Member Profile	Jun 14 2009, 05:28 AM Post #9
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	OK go straight to Combofix and run it from safe mode if need be, it will complain but ignore that

Essexboy View Member Profile	Jun 15 2009, 03:47 AM Post #11
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	Looks better now 1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box. 2. Now copy/paste the entire content of the codebox below into the Notepad window: CODE File:: c:\windows\system32\vghd.scr Folder:: c:\program files\vghd 3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES 4. Save the above as CFScript.txt 5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again. THEN Please download Malwarebytes' Anti-Malware from Here. Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. 6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply: Combofix.txt A new OTListit log. MBAM Log

PeterBro View Member Profile	Jun 17 2009, 12:17 AM Post #12
Member Posts: 16 OS: Vista	Hello Essex. Here are all my logs. Combo Fix ComboFix.txt ( 67.24K ) Number of downloads: 114 MBAM attachment=31083:mbam_log...0_08_53_.txt] OTS OTS.Txt ( 185.29K ) Number of downloads: 6 Attached File(s) mbam_log_2009_06_17__00_08_53_.txt ( 821bytes ) Number of downloads: 8

Essexboy View Member Profile	Jun 17 2009, 02:32 AM Post #13
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	That doesn't look to bad - how is your computer running now ?

PeterBro View Member Profile	Jun 19 2009, 12:28 AM Post #14
Member Posts: 16 OS: Vista	Quite good actually thank you. Now i've got a seperate issue. It's on a dell laptop running xp. I've done the self cleaning steps until it asked to rename the mbam file in order for it to work and it will not load after installation.

Essexboy View Member Profile	Jun 19 2009, 02:26 AM Post #15
GeekU Moderator Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7	OK lets clear all my tools and tidy you up before we attack that problem Now the best part of the day ----- Your log now appears clean A good workman always cleans up after himself so..Run OTListit and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep We will now confirm that your hidden files are set to that, as some of the tools I use will change that Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading select Do not show hidden files and folders. Click Yes to confirm. Click OK. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems Upgrading Java: Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 14. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u14-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u13-windows-i586-p.exe and select "Run as an Administrator.") VISTA To manually create a new Restore Point Go to Control Panel and select System and Maintenance Select System On the left select Advance System Settings and accept the warning if you get one Select System Protection Tab Select Create at the bottom Type in a name i.e. Clean Select Create Now we can purge the infected ones Go back to the System and Maintenance page Select Performance Information and Tools On the left select Open Disk Cleanup Select Files from all users and accept the warning if you get one In the drop down box select your main drive i.e. C For a few moments the system will make some calculations Select the More Options tab In the System Restore and Shadow Backups select Clean up Select Delete on the pop up Select OK Select Delete You are now done SPRING CLEAN Download TFC to your desktop Open the file and close any other windows. It will close all programs itself when run, make sure to let it run uninterrupted. Click the Start button to begin the process. The program should not take long to finish its job Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean THEN Download and run Auslogics Disc Defragmenter Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes: SpywareBlaster to help prevent spyware from installing in the first place. SuperAntispyware Run weekly to keep your system clean It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit Microsoft Windows Update To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? Keep safe ON COMPLETION Could you now uninstal MBAM and then download and re-install a new copy. Let me know the result

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

3 Pages

1 2 3 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal spyware/virus named 'Troj/Rustok-N' [RESOLVED] 12	28 / 30,793	13th December 2008 - 07:48 PM Andy L started - last by RatHat
Virus, Spyware and Trojan Removal Spyware/virus named 'Troj/Rustok-N' [Closed]	6 / 825	12th February 2009 - 09:36 PM Dspence7891 started - last by emeraldnzl
Virus, Spyware and Trojan Removal 'Troj/Rustok-N' virus..... [Closed]	2 / 495	2nd June 2009 - 05:07 PM pwalker started - last by emeraldnzl
Virus, Spyware and Trojan Removal spyware/virus named 'Troj/Rustok-N [Solved] 12	22 / 612	16th July 2009 - 10:53 AM Ruken started - last by Rorschach112