Rootkit, Hur Får Jag Bort Skiten?

[Gäst KawaiiNekoFTW]

Hejsan, installerade om datorn i förrgår, och glömde självklart installera antivirus!

När jag idag instalelrade avast, fick jag se att jag har ett rootkit och virus (som den skapat typ)

 

Hittade inte nå sätt att få bort de så jag installerade om, kollade även så mina andra diskar var cleana.

 

Men nu ni...

 

Avast varnar direkt om att jag har ett rootkit och tvingar på mig en boot-scan för att ta bort den.

 

Det funkar dock inte så bra...

 

Installade avast innan jag ens kopplade i nätverkskabeln denna gång, vad i helvete ska jag göra???

[woody]

Det kan vara ett falskt alarm men formaterade du hela hårddisken som Windows är installerat på och har du några andra enheter inkopplade till datorn som kanske kan vara smittade?

 

Pröva att ladda ner GMER och Kaspersky TDSSKiller.

[Gäst KawaiiNekoFTW]

Det kan vara ett falskt alarm men formaterade du hela hårddisken som Windows är installerat på och har du några andra enheter inkopplade till datorn som kanske kan vara smittade?

 

Pröva att ladda ner GMER och Kaspersky TDSSKiller.

Efter lite tips på SweC så laddade jag ner Malwarebytes och startade safe mode.

Hittade då 98 virus som jag tog bort (herregud)

 

WiipoD (ja, jag tänker inte ljuga om nåt) skickade en RAT till mig som jag öppnade, sen dess har de hållit på typ.

 

 

Och japp, tog "remove" när jag skulle reinstalla, och jag hade scannat dom andra hårddiskarna innan jag började.

 

 

Här har du även loggen:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

 

Database version: 6702

 

Windows 6.1.7600 (Safe Mode)

Internet Explorer 8.0.7600.16385

 

2011-05-28 20:45:07

mbam-log-2011-05-28 (20-45-07).txt

 

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)

Objects scanned: 577930

Time elapsed: 41 minute(s), 19 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 98

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

(No malicious items detected)

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

e:\$RECYCLE.BIN\s-1-5-21-1463629727-1693443722-1234792734-1001\$RL9KZNT\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.

e:\$RECYCLE.BIN\s-1-5-21-1463629727-1693443722-1234792734-1001\$RL9KZNT\keygen.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully.

e:\sumomo mo momo mo\{smartassembly} 4.0.3414\Crack\{smartassembly}.exe (Trojan.Agent) -> Quarantined and deleted successfully.

f:\Nyttc090a07-920b-47de-8128-230139741788.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nyttc090a07-920b-47de-8128-230139741788_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nyttc090a07-920b-47de-8128-230139741788_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\113778658-0[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1294376414252.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350738213.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350738213_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_3.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_4.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_5.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_6.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_7.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_8.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1295350781378_9.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1300814736869.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1300814736869_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1300814736869_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295_3.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295_4.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1302399360295_5.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1303262902090.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\1303262914959.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\161496_100000836679104_512870_q[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\174496_1148472607_1886780_q[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\174496_1148472607_1886780_q[1]_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\203287_100000241601395_2163756_q[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\206502_205320096163859_100000576093396_696200_443702_s[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\208007_207362049293372_142486635780914_711749_667422_s[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\211974_724553248_7106917_q[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\216334_148008781931775_100001679613428_321814_6478355_s[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\217323_207020899327487_142486635780914_708442_6758874_s[1].jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\217323_207020899327487_142486635780914_708442_6758874_s[1]_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\5f7bb4c2-7b16-4f1b-b649-ec41af17190c.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\5f7bb4c2-7b16-4f1b-b649-ec41af17190c_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\5f7bb4c2-7b16-4f1b-b649-ec41af17190c_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\app_full_proxy[2]_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\custom_1290321306302_08dueling19guest.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\custom_1290321306302_08dueling19guest_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\dsc00016_edit0.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\dsc00016_edit0_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\dsc00016_edit0_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\dsc00032_3.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\d_4.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\IMB18C~1.JPG (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\imb18c~1_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\img4_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\keycatcher_button17.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\safe_imagecandl4ma.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\safe_imagecar9lmrb.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\safe_image[9]_5.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\safe_image[9]_6.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\safe_image[9]_7.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\thumbnailcawsoqcz.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\thumbnailcawsoqcz_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\thumbnailcawsoqcz_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_10.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_11.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_12.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_13.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_14.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_15.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_16.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_17.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_18.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_19.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_3.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_4.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_5.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_6.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_7.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_8.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\tits01_9.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\ytbvygq9wtqxc&feature=youtube_gdata.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\ytbvygq9wtqxc&feature=youtube_gdata_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\ytbvygq9wtqxc&feature=youtube_gdata_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{09650115-97a0-4b7a-a363-2f94a5f013f0}.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{86d2e943-0cc2-4539-9419-88908491ce8d}.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{86d2e943-0cc2-4539-9419-88908491ce8d}_1.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{86d2e943-0cc2-4539-9419-88908491ce8d}_2.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{86d2e943-0cc2-4539-9419-88908491ce8d}_3.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

f:\Nytt\{ad0aa881-ba80-4445-991a-df3e5df2b463}.jpg (Extension.Mismatch) -> Quarantined and deleted successfully.

h:\$RECYCLE.BIN\s-1-5-21-2073066569-2727047744-730239013-1000\$RG3EQMH\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.

h:\$RECYCLE.BIN\s-1-5-21-2073066569-2727047744-730239013-1000\$RG3EQMH\keygen.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully.

h:\Games\PC\call of duty4-razor1911+keygen and crack\rzr-cod4.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

h:\Programs\adobe.flash.pro.cs5.multi\keygen.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

h:\Programs\adobe.photoshop.cs5.extended.v12.0.multilingual.incl.keymaker-core\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.

h:\Programs\adobe.photoshop.cs5.extended.v12.0.multilingual.incl.keymaker-core\keygen.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully.

h:\Programs\cpuid hwmonitor pro v1.11\keygen.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.

h:\Programs\winrar 4.00 final - 32bit and 64bit\winrar.v3.93_keygen-fff\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

[lolkfezt]

*Wall of text*

Ja, han där WiiPod är en lurig typ. Snor andras koder och kallar det för hans eget ;/

[woody]

Fick du det från http://www.fuska.se/forum/index.php?showtopic=153310?

[Gäst KawaiiNekoFTW]

Ja, han där WiiPod är en lurig typ. Snor andras koder och kallar det för hans eget ;/

Snackar med han på skype och kör mer eller mindre minecraft med han varje dag, men tappade lite förtoende för han nu.

Fick du det från http://www.fuska.se/forum/index.php?showtopic=153310?

Nej, inte ens sätt tråden.

 

Hade bara sorterat mängder med bilder och chattat.

 

men anyway, varken avast eller malwarebytes hittar nåt i safe mode längre, tänker byta till AVG och låta det gå nån vecka.

 

Och sen såklart köra malwarebytes igen :P

[CeZ]

Om man bootar ifrån en skiva/usb-minne (vilket man gör när man installerar Windows) och formaterar hårddiskarna så "överlever" väl inte ett skit?

[Gäst KawaiiNekoFTW]

Om man bootar ifrån en skiva/usb-minne (vilket man gör när man installerar Windows) och formaterar hårddiskarna så "överlever" väl inte ett skit?

Formaterade inte alla, bara den som jag hade viruset på och skulle installera igen på.

 

Dom andra är share.

[JJespeRR]

Jag har kört utan virusskydd i snart 2 år. Och aldrig haft ett virus eller nånting.

 

Liksom jag hatar alla virusskydd, ger bara falska alarm. Bara man vet vad man gör?

[lolkfezt]

Jag har kört utan virusskydd i snart 2 år. Och aldrig haft ett virus eller nånting.

 

Liksom jag hatar alla virusskydd, ger bara falska alarm. Bara man vet vad man gör?

Hur vet du att du inte har virus när du inte har ett anti-virus?

Du har kanske 5000 tusen keyloggers som sparar allting du gör.

 

[JJespeRR]

Hur vet du att du inte har virus när du inte har ett anti-virus?

Du har kanske 5000 tusen keyloggers som sparar allting du gör.

Jag har väl testat och söka igenom nån gång? Och sen vet jag ju vad ja gör?

 

Och jag laddar inte ner en massa skit med keyloggers i :rolleyes:

Redigerat 29 Maj 2011 av petolv

[lolkfezt]

Jag har väl testat och söka igenom nån gång? Och sen vet jag ju vad ja gör?

Även om "du vet vad du gör" så är du aldrig 100% säker.