Norton Internet Security / Norton AntiVirus

[tragic82]

Hello, I hope I'm not being a complete idiot here, but I could really use some help. I believe my computer has become infected with some form of virus or malware. I am subscribed to NIS 2009, but this has stopped working, following an my accidental opening of a pop-up... Although the icons for Live Update and NIS 2009 can still be found in my programs list, they do not launch when clicked. Alongside this, system tools such as disk defrag and system restore refuse to operate. I have run anti-malware software (Malwarebyte's Anti-Malware) which discovered some infected files and removed them. The problems have persisted. I have also run online malware scanners which failed to find a problem, and repeated uses of Anti-Malware have not uncovered any further infected files. Any help would be greatly appreciated! Thank you.

[mdturner]

Welcome to the Norton Community

Please run a SysProt log for us so we can check your system for rootkit activity. You will need to disable Norton auto-protect while you run the scan, as well as any other antimalware program you may have installed on your PC.

Once it is downloaded to your desktop, right click on the SysProt icon, go to properties, and click unblock and apply.

Choose log, check all the boxes except show hidden objects only and then scan.

You will be able to post the log here using the "add attachments" link just below the orange post button.

http://homepages.slingshot.co.nz/~crutches/SysProt

[tragic82]

thanks for your help, here's the SysProt log

[mdturner]

You appear to have a rootkit infection on your system. I will pass your deatils on to someone who will be able to assist with removal. In the meantime please do not attempt cleanup yourself as often this can make thngs worse.

[tragic82]

thank you very much, I'll try not to do anything too stupid in the meantime!

[Quads]

Hi

I have sent you a personal Message, look for the Yellow Envelope near the upper right hand corner.

Quads 

[Quads]

Hi

Continuation of Stage 1,  File removal  (same program to continue step 1)

Now the registry entries will be greyed out I think, will get them later.

Tick (check) these entries (little square box beside each entry) Only the entries below, not the others

---

C:\WINDOWS\system32\rotscxlsrttimm.dll
C:\WINDOWS\system32\rotscxbnrjlksr.dat

C:\WINDOWS\system32\drivers\rotscxkdulrscp.sys
C:\WINDOWS\system32\rotscxamryfwxi.dll
C:\WINDOWS\system32\rotscxdvblovrb.dat

---

Then click the Clean items button

Follow the prompts to remove them and restart your computer.

After reboot, a dialog box displays the files you selected for removal and the action taken.

Step 2 after  Once I know that is completed

Quads 

[tragic82]

I've cleaned those files and rebooted, Norton appears to be functioning normally now. However,  I'm assuming there are still some issues to deal with, so onto Stage 2 I guess?

[Quads]

Hi

Step 2. Detect - Delete any buddies

Download, Install, Update the definitions and run a Full Scan with Malwarebytes  http://www.filehippo.com/download_malwarebytes_anti_malware/

By the way did you already have Norton install and everything running Ok before you got infected??

There could be a step 3 depending on what happens 

Quads  

[tragic82]

yes, NIS was installed and running normally before the infection. I have run a full scan with Malwarebytes, I'll attach a logfile of what it found.