Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Rootkit infection


  • This topic is locked This topic is locked

#46
SpySentinel

SpySentinel

    R.I.P.

  • Retired Staff
  • 5,152 posts
Please download Dr.Web CureIt . Save it to your desktop:
  • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
  • This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, select Complete scan.
  • Click the green arrow Posted Image at the right, and the scan will start.
  • Click Yes to all if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click File and choose Save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
  • Please post the Dr.Web.txt report in your next reply
  • Close Dr.Web Cureit.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.
  • 0

Advertisements


#47
rshaffer61

rshaffer61

    Moderator

  • Topic Starter
  • Moderator
  • 34,114 posts
OK the scan has been running for 4 hours now on the Complete Scan and it's only about a 1\3 of the way through. So far it's found 226 suspicious files and still going. I have updated the neighbor so that she knows we are still working on this and that hopefully we are in the last stages of cleaning this all up. I am surprised as to the amount of issues it is finding now with all the other programs we have run on it to clear out the Vundo infection but I know that is why you all make sure before declaring it is healthy again.
I just wanted to say I appreciate you sticking with me through this and I hope she appreciates it in the end.
Next time I am telling her to log on and go through all this and then she can see how much there is to doing all this. :D
  • 0

#48
rshaffer61

rshaffer61

    Moderator

  • Topic Starter
  • Moderator
  • 34,114 posts
84.2 megs in size and everytime I try to copy and paste it FF crashes.
Here is the end of the log. Look at the time it took to complete. :D

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Scanned: 660736
Infected: 213
Modifications: 0
Suspicious: 9
Adware: 4
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 1
Deleted: 0
Renamed: 0
Moved: 224
Ignored: 0
Scan speed: 118 Kb/s
Scan time: 8:38:56
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Scanned: 691103
Infected: 213
Modifications: 0
Suspicious: 11
Adware: 4
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 1
Deleted: 2
Renamed: 0
Moved: 224
Ignored: 0
Scan speed: 51 Kb/s
Scan time: 9:27:13
  • 0

#49
rshaffer61

rshaffer61

    Moderator

  • Topic Starter
  • Moderator
  • 34,114 posts
BTW I did reboot the system this morning.
Not sure how to get all the info to you because with the amount of information it is showing it would probably take several post to get it all here. Zipping it will prob only bring it down to about 8.4 megs which I';m not sure but I think that is to large for a attachment still.
I could try to upload it to a outside file place like MediaFire if you want.
  • 0

#50
SpySentinel

SpySentinel

    R.I.P.

  • Retired Staff
  • 5,152 posts
Hi rshaffer61,

You are very welcome, and thanks for sticking in their :D

This is a very nasty infection and I have not seen it for some time now.


Sorry the scan took that long. If you could just upload the infection results from the log that would be great.
  • 0

#51
rshaffer61

rshaffer61

    Moderator

  • Topic Starter
  • Moderator
  • 34,114 posts
Well the owner has taken the system saying it is taking to long.
She is taking it back to the shop and wants the warranty to cover the cleaning.
I tried to tell her shops don't cover infections under warranty but she said she didn't want to wait for us to finish.
Sorry about all this and I'm sure you would have gotten it cleaned in another day or two.
Thanks for all your help with this.
This is what I get for being the neighborhood geek I guess :D
  • 0

#52
SpySentinel

SpySentinel

    R.I.P.

  • Retired Staff
  • 5,152 posts
No problem, you're very welcome ;)

Hope the shop can fix it without reformatting lol :D
  • 0

#53
SpySentinel

SpySentinel

    R.I.P.

  • Retired Staff
  • 5,152 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :D

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP