TechSpot

hacktool.rootkit - remon.sys

By addman8
May 11, 2006
  1. I am still really stuck with this bugger.

    I deleted it once by changing the extension, but it showed up again. Seems to be tied to my Norton somehow as the warning bubble in the system tray constantly pops up. I uninstalled all my Norton stuff and it still shows up.

    thoughts anyone??
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions.

    Then, go HERE and follow the instructions in the order they are given.

    Post a fresh HJT log, only after doing the above.

    Regards Howard :wave: :wave:
     
  3. addman8

    addman8 TS Rookie Topic Starter

    already done

    I have already gone through all those steps...

    There was no evidence of javapanel, taskcenter, xpjava, etc.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok no problem.

    I find evidence of the sdbot infection in your HJT log.

    Go HERE and follow the instructions.

    Then, post a fresh HJT log.

    Regards Howard :)
     
  5. addman8

    addman8 TS Rookie Topic Starter

    next step

    I got through those processes. Ewido found a bunch of stuff.

    I attached logfiles for Ewido and updated HJT.

    Thanks much,

    matt
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    TRISNA~1
    RXToolBar
    EmpirePoker
    PartyPoker

    Close control panel.

    Click start/run and type regsvr32 /u C:\Program Files\RXToolBar\sfcont.dll into the run box and press the enter key.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it.

    Double click on the following services(If there), and selcet stop if they are running. Set the startup type to disabled. Click apply/ok for each service.

    SysEnforce
    Socks-Cap (Sc32Inch)
    nvidGUIv (nvidGUIv2)
    ATIintergrated
    SemanticInsight

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    SemanticInsight.exe
    atigraphics.exe
    nvidGUIv.exe
    Sc32Inch.exe
    SYSENF~1.EXE
    PartyPoker.exe
    EmpirePoker.exe

    Close task manager.

    Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

    O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

    O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)

    O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll

    O23 - Service: ATIintergrated - Unknown owner - C:\WINDOWS\atigraphics.exe (file missing)

    O23 - Service: nvidGUIv (nvidGUIv2) - Unknown owner - C:\WINDOWS\nvidGUIv.exe (file missing)

    O23 - Service: Socks-Cap (Sc32Inch) - Unknown owner - C:\WINDOWS\Sc32Inch.exe (file missing)

    O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files(if there).

    C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
    C:\WINDOWS\Sc32Inch.exe
    C:\WINDOWS\nvidGUIv.exe
    C:\WINDOWS\atigraphics.exe
    C:\Program Files\RXToolBar\sfcont.dll
    C:\Program Files\PartyPoker\PartyPoker.exe
    C:\Program Files\EmpirePoker\EmpirePoker.exe
    C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe

    Reboot into normal mode and turn system restore back on.


    Regards Howard :)
     
  7. addman8

    addman8 TS Rookie Topic Starter

    :)

    I think I have smooth sailing...

    We'll see.

    Thanks so much for your help. I hope that I am not back for a while!!
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    It doesn`t matter. Even if you are, we`ll still be here to help.

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...