Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: Rootkit-pakes.M  (Read 4998 times)

0 Members and 1 Guest are viewing this topic.

leem

    Topic Starter


    Greenhorn

    Thanked: 1
    Rootkit-pakes.M
    « on: August 17, 2009, 06:06:12 PM »
    Hi,

    This is my first post and am desperate for advice regarding the removal of the Rootkit-pakes.M.

    OK first things first, the history.

    I've just started the standalone again having not used it for months.  Got it all cleaned up and had it running nice n fast. On 16 Aug I went to the site FMportals.com and AVG 8.5 flashed up with a warning that the site was dangerous. Before I could do anything it appeared that I had been attacked/downloaded the trojan unwittingly.

    I actually figured it had been a false alarm until starting the PC on 17 Aug, when AVG Resident shield flagged up the rootkit sitting at the following filepath:

    C://WINDOWS//system32/drivers/ntfs.sys

    This was also accompanied by a couple of other related files, opening a back door.  AVG was able to get rid of these files but not the rootkit. (cont)
    Logged

    leem

      Topic Starter


      Greenhorn

      Thanked: 1
      Re: Rootkit-pakes.M
      « Reply #1 on: August 17, 2009, 06:08:44 PM »
      I then tried ccleaner before stumbling upon your wesbite.

      I have now followed your step by step guide and will attach the logs.

      What concerns me though is that none of the logs makes mention of the rootkit-pakes.M trojan BUT have found several others including win98.exe and a couple more.

      All your help and advice will be most greatfuly received!

      Here come the logs...
      Logged

      leem

        Topic Starter


        Greenhorn

        Thanked: 1
        Re: Rootkit-pakes.M
        « Reply #2 on: August 17, 2009, 06:14:04 PM »
        SAS Log

        [attachment deleted by admin]
        Logged

        leem

          Topic Starter


          Greenhorn

          Thanked: 1
          Re: Rootkit-pakes.M
          « Reply #3 on: August 17, 2009, 06:16:08 PM »
          MBam Log and Sniper Log

          [attachment deleted by admin]
          Logged

          leem

            Topic Starter


            Greenhorn

            Thanked: 1
            Re: Rootkit-pakes.M
            « Reply #4 on: August 17, 2009, 06:17:19 PM »
            Also, just how dangerous is this rootkit and what are the consequences of leaving it in place?
            Logged

            SuperDave

            • Malware Removal Specialist
            • Moderator


              • Genius
              • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Re: Rootkit-pakes.M
            « Reply #5 on: August 17, 2009, 07:44:42 PM »
            Leem, your HJT log looks quite clean. The two scans you ran before cleaned up some infections. Here is some information about rootkits and there are also some tools you can use to scan your machine. I also noticed that you have no Firewall running on your computer. You should activate the Windows Firewall or better yet, download one of these free third-party firewalls which are superior to the Windows Firewall found here. Personally, I prefer ZoneAlarm. You should keep SAS and MBAM on your computer and run them weekly but you should also add programs such as Spybot S&D, Ad-Aware, and SpywareBlaster to protect against malware and spyware. They're all free. Wait a few days to see if the resident specialists have any other things for you to do. If not, try these tips. Oops, almost forgot. You should download and install Service Pack 3 which will give you additional protection.
            Logged
            Windows 8 and Windows 10 dual boot with two SSD's

            leem

              Topic Starter


              Greenhorn

              Thanked: 1
              Re: Rootkit-pakes.M
              « Reply #6 on: August 18, 2009, 11:39:10 PM »
              Hi Superdave,

              Many thanks for all of you advice.  I had previously been told that running Windows firewall alone was sufficient and had gotten rid of my Zonealarm.  I have no idea how the windows firewall got turned off though...

              Anyway.  I did as you said and added Commodo, which so far seems a little less intrusive then Zonealarm, so I'm happy there on all counts.

              I am keeping the SAS and MBAM to complement AVG 8.5, as well as running CCleaner.  The big difference that cleaned the virus though was the Windows SP.  It seems that when it installed it uninstalled the infected old drivers (which have now been CCleaned!)

              So again, many, many thanks :-D

              I currently run AVG. I also now have sas and MBAM. Do the spybot/adaware/spywareblaster programme slow the machine down much? Why so many programmes that seemingly serev the same function? Or do they all do something alightly different?
              Logged

              SuperDave

              • Malware Removal Specialist
              • Moderator


                • Genius
                • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Re: Rootkit-pakes.M
              « Reply #7 on: August 19, 2009, 05:51:51 PM »
              Quote
              I currently run AVG. I also now have sas and MBAM. Do the spybot/adaware/spywareblaster programme slow the machine down much? Why so many programmes that seemingly serev the same function? Or do they all do something alightly different?
              I'm currently running SpywareBlaster, Spybot S&D and Threatfire as well as Avast AV and there is no slowness in my computer. Evil once told me that a layered approach was the best way to protect against Viruses and infections.
              Logged
              Windows 8 and Windows 10 dual boot with two SSD's

              Helpmeh



                Guru

              • Roar.
                • Thanked: 123
                • Yes
                • Yes
              • Computer: Specs
              • Experience: Familiar
              • OS: Windows 8
              Re: Rootkit-pakes.M
              « Reply #8 on: August 19, 2009, 05:59:09 PM »
              When it comes to AV, 2 is not often better than one. If you find 2 free ones that truly are compatible with each other, tell me!
              Logged
              Where's MagicSpeed?
              Quote from: 'matt'
              He's playing a game called IRL. Great graphics, *censored* gameplay.

              SuperDave

              • Malware Removal Specialist
              • Moderator


                • Genius
                • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Re: Rootkit-pakes.M
              « Reply #9 on: August 19, 2009, 07:54:10 PM »
              Right. Only one AV at a time but for spyware & malware you can run as many as you want. Plus a good firewall that blocks outgoing as well as incoming.
              Logged
              Windows 8 and Windows 10 dual boot with two SSD's

              w4s

              • Guest
              Re: Rootkit-pakes.M
              « Reply #10 on: August 21, 2009, 07:14:30 PM »
              I had the same problem ::)
              Tried Spybot and Malwarebytes. Neither could clean it up. :P
              Tried going back to a restore point (Start -> Accessories -> System Tools -> System Restore). Did not work for me.

              Finally went to microsoft for help. They suggested I run the scanner at onecare.live.com. Seems to have worked so far.... ;D


              Logged
              Pages: [1]   Go Up
              « previous next »