08-21-2009 07:27 AM
I've done a few scans of my system and attached them. Hopefully there'll help diagnose my problem.
My problem is when I try and do a scan Norton says: "Scanning start up files....", but it doesn't show the name of the files being scanned or the number of files scanned. Also Norton pops up a box saying Trojan Horse detected. What surprises me is that if Norton knows the files there then why doesn't it given the name and then delete it.
Thanks for your help. I hope that I've posted this to the right place?
Solved! Go to Solution.
08-21-2009 08:23 AM
You do appear to have one of the ESQUL rootkit variants. I believe Quads is already aware of it and will be along later in the day to assist you.
08-21-2009 12:32 PM
If you have Spybot S&D installed remove it
Also during the restarts with Avenger if Your PC has a Startup repair center like with HP and Toshiba tell it to start Normally if it kicks in.
1. Download Avenger to your desktop,
Unzipped version http://homepages.slingshot.co.nz/~crutches/Avenger
OR Creators website http://swandog46.geekstogo.com/avenger2/avenger2.h
2. Click to run "Avenger.exe" (right click "Run as Administrator" if using Vista)
3. In the "Input script here:" copy and paste the script between the lines
Drivers to disable:
Drivers to delete:
Files to delete:
Registry keys to delete:
Here is a screenshot (script updated since shot)
Make sure the "Automatically disable any rootkits found" is NOT selected
4. Click "Execute"
You will be asked to restart the PC click "Yes", when the PC restarts the load screen will takes slightly longer, then when it looks as though windows is loading the PC will restart again.
Then when Windows fully loads the Avenger log will be loaded, showing files it could or could not find.
5. Restart the PC again, then see if you can install Update and run Malwarebytes http://www.filehippo.com/download_malwarebytes_ant
You have a DNS Changer so you may have to do a scan remove what it finds, then update MBAM, then run another Full Scan
08-23-2009 06:06 AM
Thanks for the quick response. I've tried what you asked me to do with little success. The GMER Didn't fully work but I've attached what it did do and the other Sling shoot thing just crashed, reports attached.
Also I have another computer, running XP that's very slow. I'm going to try and run the two programs that you suggested on that computer it might help?
08-23-2009 09:45 AM
The GMER and Rootrepeal utilities are for scans only. They are not supposed to do anything else. The error code that Rootrepeal caused is usually generated by malware. These problems will need to be dealt with by Quads. He will be available later due to time zone differences. If you have run any other programs or utilities to try to resolve this infection, other than what you have told us already, please let us know.
08-24-2009 12:45 PM
What do you mean by Scripts?
I've also tried Superantispyware and Anti-malware. Neither would work. I can download them but they won't run and I did try to run them as administrator. What should I try next?