My machine was rebooting unexpectedly. So I started the avast scanner, which found:
Rbot-akk on the file expl0rer.pif.
This was one was apparently fixed by avast. But then, avast found a Troj-gen on driv.sys. When moving it to the chest, avast was keeping asking what to do with the file… I think because the trojan was installed as a service, so I had to reboot in safe mode and remove all occurrencies in the registry. I found also entries with ssprotecter, which is bad.
The trojan is also known as TROJ_ROTKIT.E by Trend Micro.
Now, I am running again the scanner, not sure the machine is clean though.
I have: Win 2000 SP4, Avast 4.6, VPS 0540-3 6-10-2005.
You have a rootkit running as a Windows service. You will have to disable the service before you can remove the malware. avast! cannot do this for you. Pleas see these threads:
I have done a reboot scan as described by one of your links, I have removed rdriv.sys with regedit… Nothing to do: it keeps coming back!!! Also another file under system32 is suspect:
msnmsdn.exe (registry name: MsnAutostart).
It will keep coming back unless you follow the instructions fully. Print out the threads so you can follow the relevant points step by step when you are off-line.
I don’t see any reference to having run hijackthis, these rootkits don’t just come as a single file there is often other elements to ensure that it is restored.
Have you done a google search on rdriv.sys there is lots of hits on it and one that would appear relevant indicates “Added by the W32.Spybot.NLX worm. This is the rootkit element of this infection.” Which is exploiting vulnerabilities long ago patched by MS so you need to ensure your OS is updated. http://www.bleepingcomputer.com/startups/rdriv.sys-8753.html
Follow that on to the information about the W32.Spybot.NLX worm.
DavidR, I cannot post from the infected machine. Anyway, the first run of hijackthis found ‘svhosts’ which is known to be ‘undesirable’ by bleepingcomputer. It was not enough to remove it: the rootkit was still there… The next suspect entry looks like this:
04 - HKLM..\RunServices: [MsnAutostart] msnmsdn.exe
Are you running two AVs as indicated by this entry, it often causes conflict and doesn’t provide twice the protection?
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated - D:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
The others you will have to check (ignore the entries for avast obviously) are they programs that you have installed or do they relate to hardware that you installed, etc.
Assuming that you know the BHO iFinger then no problem?
Do you use the extra toolbar for windows media player?
You don’t need really need Quicktime or winamp to start at boot-up, they will start automatically according to the file associations for them when you click on a media file link.
The two entries for msnmsdn.exe should be fixed in HJT and the service will also need to be disabled. The fact that there is only one hit on google is suspicious as if it were anything to do with microsoft msn or msdn there would be lots of hits. Th single hit on google isn’t old 22/9/2005 you can click the translate this page to the right of the google hit (not that there is much of use, but the google translate is handy for the future).
If it is still there then you will have to repeat the exercise, once the other elements are removed that may stop it returning.
An fdisk, format and reinstall is likely to be the final option but that too is or can be a painful operation.
Have you tried the UnHackMe that Polonus gave the link for?
This is one of the only rootkit detectors that is able to actually remove rootkit infection, however, apparently it doesn’t take much modification to create another variant and avoid both detection or removal.
*Ewido Security Suite
[*]Install ewido security suite
[*]Launch ewido, there should be a big E icon on your desktop, double-click it.
[*]The program will prompt you to update click the OK button
[*]The program will now go to the main screen
[*]You will need to update ewido to the latest definition files.
[*]On the left hand side of the main screen click update
[*]Click on Start
[*]The update will start and a progress bar will show the updates being installed
[*]After the updates are installed exit Ewido.
Reboot your computer into Safe Mode.
Open the rdrivrem folder and double-click rdrivRem.bat to run the program - follow the instructions on the screen. After it’s complete, rdriv.txt will be created in the rdrivRem folder.
Double-click the Ewido Security Suite icon to run the program.
[*]Click on scanner
[*]Click Complete System Scan
[*]Let the program scan the machine
While the scan is in progress you will be prompted to clean the first infected file it finds. Choose “remove”, then put a check next to “Perform action on all infections” in the left corner of the box so you don’t have to sit and watch Ewido the whole time. Click OK.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report[list]
[]Click Save report
[]Save the report to your desktop
[*]Exit Ewido
Post back with the contents of rdriv.txt, the Ewido log and a new HijackThis log.
However, you might not see any indications at all. Only the AV detection of the file. You will also see this file in a HJT full startup report.
rdrivrem will remove all of the known registry entries and files to date. rdriv.sys is indeed a rootkit, and it’s recommended by many to do a complete format and re-install once a system has been compromised by a rootkit. However, I’m not completely convinced that it’s necessary. Once the files/regs are removed, it’s impossible for it to continue to work, except that it may have allowed other malware to be installed. Making sure a system is free of any other malware should remove any risk the rootkit may have introduced.
www.atribune.org is a site run by fellow malware fighter Atribune, and yes, it’s a very useful site.
>:( What’s the bottom line here?