Re: Backdoor:WinNT/Rustock.AN keep moving?



From: "cacheboy75" <cacheboy75@xxxxxxxxxxxxxxxxxxxxxxxxx>

| Is there a way to completely remove Backdoor:WinNT/Rustock.AN?

| I used Windows Defender and everytime it says to reboot to complete removal
| and after reboot it will show a success but a scan later will reveal that
| Backdoor:WinNT/Rustock.AN is still there.

| Thanks.

Rustock is a NASTY RootKit.

I strongly suggest assisted removal.



Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Then post the contents of the HJT log in your post with a full explanation of your problem
and what you have done to date in one of the below expert forums...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) Logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


.



Relevant Pages

  • Re: Any idea which bug this is?
    ... | Is there a particular malware responsible for the above, ... Download and execute HiJack This! ... Then post the contents of the HJT log in your post in one of the below expert forums... ... Forums where you can get expert advice for HiJack This! ...
    (alt.comp.anti-virus)
  • Re: poison ivy trojan
    ... | Also in the task scheduler, I suspect that may have a lot to do with what's ... Download and execute HiJack This! ... Then post the contents of the HJT log in your post in one of the below expert forums... ... Forums where you can get expert advice for HiJack This! ...
    (microsoft.public.windows.vista.general)
  • Re: Virus? malware?
    ... Please stay far away from the fake MS MVP, software plagiarizer and software pirate who ... Download and execute HiJack This! ... Then post the contents of the HJT log in your post with a full explanation of your problem ... Forums where you can get expert advice for HiJack This! ...
    (alt.comp.anti-virus)
  • Re: Virus Problems
    ... blocking me from going to any sites that help with security issues. ... Download and execute HiJack This! ... Then post the contents of the HJT log in your post with a full explanation of your problem ... Forums where you can get expert advice for HiJack This! ...
    (microsoft.public.windowsxp.security_admin)
  • Re: WMIPRVSE trying to TFTP a lot! Why?
    ... | We use McAfee with rules to block any TFTP use, ... Download and execute HiJack This! ... Then post the contents of the HJT log in your post with a full explanation of your problem ... Forums where you can get expert advice for HiJack This! ...
    (microsoft.public.windowsxp.general)