08-21-2009 10:54 PM - edited 08-21-2009 11:45 PM
Hello. So after hours of researching online, I believe I have the nasty ESQUL rootkit problem. When I try to click Internet Explorer, the message with the globalroot\system32\ESQUL[randomletters] pops up. When I click "OK" a windows message shows up telling me that JAVA isn't working properly and needs to be shut down. After that, IE appears to be running properly, but it probably isn't really, right?
I used to have Symantec Endpoint Protection, but the malware wouldn't let me run a scan, and so I tried deleting it with Hijackthis. I'm not sure if it worked, but basically I don't think I have any Anti-virus protection on my PC right now. I also stupidly tried running Combofix by myself, and the famous bluescreen showed up and I'd have to restart my computer.
I'm not sure if I'm posting in the right place, but please help me if you can! I would really appreciate it.
Solved! Go to Solution.
08-22-2009 01:16 AM
08-22-2009 12:21 PM
I tried running the Sysprot; I checked the boxes and clicked Create Log. The blue bar on the bottom was showing that it was scanning, but then a windows message popped up saying "you need admin privileges....sysprot failed to launch" ( something along those lines). My account is an administrator account, so I don't know what the problem is. I clicked ok, and then another window popped up from the program itself with the options of either running a scan on "all drives" or just running a scan of the "root drive". When I tried to run a scan on all drives, the Sysprot program would freeze and stop responding, so I just ran it on the "root drives."
Here is the log attached.
08-22-2009 02:59 PM
If you have Spybot S&D installed remove it
Also during the restarts with Avenger if Your PC has a Startup repair center like with HP and Toshiba tell it to start Normally if it kicks in.
1. Download Avenger to your desktop,
Unzipped version http://homepages.slingshot.co.nz/~crutches/Avenger
OR Creators website http://swandog46.geekstogo.com/avenger2/avenger2.h
2. Click to run "Avenger.exe" (right click "Run as Administrator" if using Vista)
3. In the "Input script here:" copy and paste the script between the lines
Drivers to disable:
Drivers to delete:
Files to delete:
Registry keys to delete:
Here is a screenshot (script updated since shot)
Make sure the "Automatically disable any rootkits found" is NOT selected
4. Click "Execute"
You will be asked to restart the PC click "Yes", when the PC restarts the load screen will takes slightly longer, then when it looks as though windows is loading the PC will restart again.
Then when Windows fully loads the Avenger log will be loaded, showing files it could or could not find.
5. Restart the PC again, then see if you can install Update and run Malwarebytes http://www.filehippo.com/download_malwarebytes_ant
08-23-2009 12:13 AM - edited 08-23-2009 12:14 AM
Hello, so Avenger worked fine. Attached is the log for Avenger.
I then installed, updated, and ran a full scan with Malwarebytes. It found three Trojans, and I tried removing them. Attached is the log for that as well.
Also, I don't think I have Spybot.