Zero access rootkit - afterwards

Viruses and worms
21

If we can clean it now I would love to, don’t wanna risk it once more.

Also, do you know what this is?

[Path][Folder name][File name][Extension][Size]
C:\Documents and Settings\Burak Yolacan\Local Settings\Application Data\BaCkDoOr_SyStEm\s_selector.exe_Url_nbjkdc30iatxpcrp4knjbgtyr1sy2exs0 Byte
C:\Documents and Settings\Burak Yolacan\Local Settings\Application Data\BaCkDoOr_SyStEm\s_selector.exe_Url_nbjkdc30iatxpcrp4knjbgtyr1sy2exs\2.1.0.00 Byte
C:\Documents and Settings\Burak Yolacan\Local Settings\Application Data\BaCkDoOr_SyStEm\s_selector.exe_Url_nbjkdc30iatxpcrp4knjbgtyr1sy2exs\2.1.0.0\user.configconfig372 Byte

Total number of folders = 2
Total number of files  = 1
Sum of file sizes = 372 Byte
22

Don’t recognise the format - Should be OK to delete them

I feel you are clean now but I would like to wait a bit just to be sure

23

I see 2 winsys2.exes on the pc; system32\reinstallbackups\0003\driverfiles and OTL\movedfiles

I will probably not be able to notice it for a while if this thing acts up again; not the main pc and I don’t use it much. any programs to scan the pc, say tomorrow or day after, to see if everything’s okay?

24

Aye and I will also remove the quarantined files

25

Uhm sorry but what…?
Nevermind, thank you for the help.

26

Sorry for the double post but I need to post an update.

First, got rid of nod32 and installed avast free.
Pc keeps freezing; 5 times now, forcing me to hard reset.
Winrar is acting funny; double clicking an archive runs winrar.exe but can’t see the UI. if I double click again I get another winrar.exe; I saw as much as 10 in first attempt to open archive. riht click-extract here extracts the archive but still can’t see the UI.
avast is set to scan documents when opening and writing. autosandbox is on but set to ask and didn’t ask anything yet.

Also I get a window (C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled) with a shortcut to adobegammaloader.exe inside at startup; its just annoying.
Any help?

27

How did you get rid of nod32 ?

There is also a removal tool you might want to try:
ESET/NOD32 Uninstall Tool - http://kb.eset.com/esetkb/index?page=content&id=SOLN2116 Make sure you choose the correct uninstaller for your ESET product and your OS (32bit or 64bit version), right click on the link and select Save As or Save File (As depending on your browser), save it to your desktop.

Also see http://thewebatom.net/uninstallers/security-software/, this has a collection of manufactures removal tools, so that should remove any remnants, registry, etc.

28

You didn’t check that page for a while did you? There is no uninstaller, just Uninstall-delete a few left over folders.
Ooh it’s buried down there under manual uninstall…
Lİnk to eset uninstaller: http://kb.eset.com/esetkb/index?page=content&id=SOLN2289

Second link has the program so I am gonna run it now.

Edit1: Okay uninstalled it completely. Winrar still acting funny, gonna reinstall I guess. Gonna see if pc still freezes too.

Edit2: Winrar back to normal after reinstall. gotta wait for freezes.

29

As I say once you are happy let me know and I will remove the tools cleanly