Rootkit, whistler detected

Viruses and worms
1

Can’t seem to get rid of this problem. Don’t really know what it does. I ran a couple of different scans and will attach the logs. Any help would be appreciated.

2

Hi there whilst I look at the OTS log

Re-Run aswMBR

Click Scan

On completion of the scan

Click the FIXMBR Button

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswmbrwhistler-1.gif

Save the log as before and post in your next reply

3

Once you have rebooted from fixing the MBR - run this. On completion can you let me know what problems remain

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.

[Unregister Dlls]
[Win32 Services - Safe List]
YN -> (CLTNetCnService) Symantec Lic NetConnect service [Auto | Stopped] -> 
[Files/Folders - Modified Within 30 Days]
NY ->  w6dak3i1gmd88gjinwo48abl2xgq64 -> C:\Users\Karen\AppData\Local\w6dak3i1gmd88gjinwo48abl2xgq64
NY ->  w6dak3i1gmd88gjinwo48abl2xgq64 -> C:\ProgramData\w6dak3i1gmd88gjinwo48abl2xgq64
[Files - No Company Name]
NY ->  w6dak3i1gmd88gjinwo48abl2xgq64 -> C:\Users\Karen\AppData\Local\w6dak3i1gmd88gjinwo48abl2xgq64
NY ->  w6dak3i1gmd88gjinwo48abl2xgq64 -> C:\ProgramData\w6dak3i1gmd88gjinwo48abl2xgq64
[Custom Scans]
YY ->  junction.exe -> C:\junction.exe
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

4

Wow, thanks for the speedy response. Here is the next log.

5

Once OTS has run its fix could you let me know what problems remain

6

Here is the next OTS log, I will run avast scan and see if anything is detected now.

7

Ok let me know the result ;D

8

Avast just finished a full scan without detecting anything. Looks like you’ve cured another one. Thank you very much.

9

Run OTS and hit the cleanup button - then enjoy ;D

10

Only TDSS infection

Not interesting ;D

11

Not now that aswmbr hits the latest version ;D

12

so it is steel interesting ;D

We steel have no TDSS, weak, and we use MBRcheck, but it is the same

13

I had same problem. Avast cant remove MBR: Wistler-B [rootkit]. Seems like Kapsersky free removal tool did it with a simple scan and then restart :slight_smile: