Solved Help in removing rootkit

luvs2collect

New Member
Messages
7
I just ran a rogue killer scan and it shows that I have a rootkit. I would appreciate any help in removing
this. See report:

Thanks,

Karen



RogueKiller V10.4.1.0 (x64) [Feb 19 2015] by Adlice Software
mail : Contact
Feedback : Adlice forum
Website : RogueKiller download
Blog : Adlice Software - malware analysis
Operating System : Windows 8.1 (6.3.9600 ) 64 bits version
Started in : Safe mode with network support
User : Karen [Administrator]
Mode : Delete -- Date : 02/22/2015 07:07:12
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 0 ¤¤¤
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 1 ¤¤¤
[C:\WINDOWS\System32\drivers\etc\hosts] 127.0.0.1 localhost
¤¤¤ Antirootkit : 1 (Driver: Not loaded [0xc000035f]) ¤¤¤
[IAT:Addr(Hook.IEAT)] (iexplore.exe @ wow64.dll) ntdll.dll - memcpy : C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE @ 0x11038d0
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST500LM012 HN-M5 SATA Disk Device +++++
--- User ---
[MBR] 7ea2c00f60c9dbfb7304f609c967be1e
[BSP] 5246beb6805e95d217c41c2452eedadd : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 300 MB
1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 616448 | Size: 100 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 821248 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 1083392 | Size: 475961 MB
4 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 975851520 | Size: 450 MB
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_DEL_02162015_124609.log - RKreport_DEL_02192015_034046.log - RKreport_DEL_02192015_035043.log - RKreport_DEL_02192015_114150.log
RKreport_SCN_02162015_124134.log - RKreport_SCN_02192015_033604.log - RKreport_SCN_02192015_034900.log - RKreport_SCN_02192015_113451.log
RKreport_SCN_02202015_213834.log - RKreport_SCN_02222015_070618.log
 

My Computer

System One

  • OS
    windows 8.1
    Computer type
    Laptop
    System Manufacturer/Model
    samsung

My Computer

System One

  • OS
    windows 8.1 Update 1 Pro 64bit
    System Manufacturer/Model
    Pavillion H8-1202
    CPU
    I7-2600 @ 3.4 GHz
    Motherboard
    PEGATRON
    Memory
    8 GB
    Graphics Card(s)
    NIVDIA GeForce GT 520
    Sound Card
    Realtek ALC656GR CODEC
    Monitor(s) Displays
    Samsung SyncMaster S22B350
    Screen Resolution
    1920X1080 32 bit color
    Hard Drives
    Samsung 850 EVO SSD 500GB
    Keyboard
    Razer Blackwidow Ultimate 2013
    Mouse
    Logitech M510

My Computer

System One

  • OS
    Win 8 and Linux (MINT)
    Computer type
    Laptop
    System Manufacturer/Model
    Lenovo Win 8 & Toshiba Linux
    Monitor(s) Displays
    Samsung SyncMaster
If you are not getting any rootkit reports from all the scans you've tried it is possible that RogueKiller has already cleaned it out for you.
 

My Computer

System One

  • OS
    windows 8.1 Update 1 Pro 64bit
    System Manufacturer/Model
    Pavillion H8-1202
    CPU
    I7-2600 @ 3.4 GHz
    Motherboard
    PEGATRON
    Memory
    8 GB
    Graphics Card(s)
    NIVDIA GeForce GT 520
    Sound Card
    Realtek ALC656GR CODEC
    Monitor(s) Displays
    Samsung SyncMaster S22B350
    Screen Resolution
    1920X1080 32 bit color
    Hard Drives
    Samsung 850 EVO SSD 500GB
    Keyboard
    Razer Blackwidow Ultimate 2013
    Mouse
    Logitech M510
If you are still concerned about this, I recommend you go to bleeping computer, join that site and open a topic in the "Am I infected?" forum. People there will help you for free, and are quite knowledgeable about malware.

Am I infected? What do I do? Forum - BleepingComputer.com
 

My Computer

System One

  • OS
    Win 8.1 Pro
    Computer type
    PC/Desktop
    System Manufacturer/Model
    Home Built
    CPU
    Intel i5-4590
    Motherboard
    MSI h97 PC Mate
    Memory
    Kingston Valu Ram 2 x 8 gb
    Graphics Card(s)
    Radeon r7 265
    Monitor(s) Displays
    Viewsonic 22" flat display
    Screen Resolution
    1920 x 1080
    Hard Drives
    Samsung 250 gb 840 evo SSD,
    WD Blue 1 TB HD,
    Fantom 2 TB ext HD
    PSU
    Corsair 600 W
    Case
    Antec 1
    Cooling
    stock CPU cooler, 4 x case fans, GPU fan and P/S fan
    Keyboard
    HP ps/2 keyboard
    Mouse
    Logitech Trackman Marble
    Internet Speed
    50 mb/s
    Browser
    Chrome
    Antivirus
    Norton Security Suite
If you want to see if there is indeed a rootkit hiding on you drive, then you need to look at it with GParted. This is a bootable partition manager that will allow you to see the contents of your drive, including any hidden partitions.

Rootkits generally cloak themselves from Windows disk management. This application will show the entire contents of the disk.

GParted -- A free application for graphically managing disk device partitions

D/L GParted, select the medium you wish to use & run it at boot time. Any rootkit will show up, usually at the end of the drive, as a hidden boot partition between 1 to 10 MB depending on the variant. If such an item is present, you have confirmation & can take steps to remove it.
 

My Computer

System One

  • OS
    Win 7 32, Win 7 64 Pro, Win 8.1 Pro
    Computer type
    PC/Desktop
    System Manufacturer/Model
    It's a Dell, Dude.
    CPU
    Intel Caffinated Core Duo
    Motherboard
    Father is bored too.
    Memory
    4 GB
    Graphics Card(s)
    NVidia something-or-another
    Monitor(s) Displays
    24" HD TV/Monitor/Alternative Dimensional Viewing Portal
    Screen Resolution
    Fuzzy after a couple drinks
    Hard Drives
    2 or 3, depending on if it's a night they're arguing about having a "split personality crisis" because I partitioned the drive.
    Case
    Don't get on my case....man
    Cooling
    Scotch on the rocks on the weekends..
    Keyboard
    Mad Catz Cyborg V7. Or maybe Cyborg Catz Are Mad At V7's??? I know it lights up...far out.
    Mouse
    currently being stalked by the cat...
    Internet Speed
    Never fast enough...
    Browser
    Defeated by Mario...wait...OH...BRowser...
    Antivirus
    Various
Back
Top