Help with removal of hacktool.rootkit

By eyzia
Sep 10, 2005
Topic Status:
Not open for further replies.
  1. Hi

    My laptop is infected with hacktool.rootkit. It says there is a file "orans.sys" in my windows/system32 folder but i cannot see it even after i turn on "show all files and folders, including hidden systems".

    It also keeps directing me to this website:

    http://217.170.4.137/_vti_bin/index.html

    Here is my HJT scan log.

    I did an Ad Aware scan, Spybot scan, Crap Cleaner and Kaspersky scan (which reported i had 6 virus and 374 infected files). I also installed Windows Updates and Windows XP Service Pack 2.

    Please help.

    Attached Files:

  2. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    That website belongs to: WINDONET-NL in the Netherlands.

    For Rootkit (not visible in your log!) go here:
    http://www.trendmicro-middleeast.co...p?LYstr=VMAINDATA&vNav=1&VName=TROJ_ROOTKIT.N

    Boot in Safe Mode, see how here.
    Switch System restore OFF, see how here.
    In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here.

    Next, open Windows Task Manager by pressing CTRL+ALT+DELETE.
    Click the Processes tab, select the process (if there) and click End Process for:
    restore.exe

    Next, click Start/Run and type services.msc and click OK. Look for the service:
    restore.exe
    Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

    Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
    ...................................................................................................
    Fix ALL your O16 - DPF: entries
    O23 - Service: restore - Unknown owner - C:\WINDOWS\restore.exe
    ...................................................................................................
    Now click on the Fix Checked button in HJT. Exit HJT.

    When done, from between the above dotted lines, delete the highlighted bold files.
    When a \directory-name\ is bold, delete everything in it, including that directory itself.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Rightclick IE on the desktop, select Properties, click on Delete Cookies, and Delete Files.
    Delete ALL files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
    XP only: Delete ALL files from C:\WINDOWS\Prefetch.
    Boot normal. When all OK, switch System Restore back on.
  3. eyzia

    eyzia Newcomer, in training Topic Starter

    Hi! Thanks for the quick response. I followed your instructions, but I did not come across the line:
    O23 - Service: restore - Unknown owner - C:\WINDOWS\restore.exe,
    so i could not "fix" it.

    After that, I did another Ewidos scan, and deleted all the viruses found, and I did another Kaspersky scan after that. I attach the Kaspersky scan as an attachment.

    The problem now is that Kaspersky still found the C:\WINDOWS\restore.exe file! The file is still there! And also, it still found backdoors and trojans on my computer.

    What should I do?
  4. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    When done, from between the above dotted lines, delete the highlighted bold files.
    Didn't I tell you to delete restore.exe?

    The files that Kaspersky found are lurking, waiting to be activated. So let Kaspersky fix them!

    To fix Trojans, see How to remove Trojans and its ilk!
  5. habaan

    habaan Newcomer, in training

    hi, i have the same problem...here is the log from hjt..please help me....file which keeps causing the problem is remon.sys in system32 dir.

    Attached Files:

  6. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

  7. Vigilante

    Vigilante TechSpot Paladin Posts: 2,120

    That's odd, this thread was in my subscribed threads list, but it doesn't look like I said anything here! Weird. Unless I made a post that got deleted?
    What's up with that?
  8. Jekkoy

    Jekkoy Newcomer, in training


    Actually, i am experiencing the same problem with the same file, remon.sys.
    I searched for remon.sys over the registry and i found several tracks of it, so i deleted them. After i restarted the computer, it keeps on coming back. I also have this expl0re.exe running on my task manager.

    This viruses causes my system to crash :(
    Pls help.


    :(

    Attached Files:

  9. Vigilante

    Vigilante TechSpot Paladin Posts: 2,120

    Have you guys used sysinternals rootkitrevealer?? Download from http://www.sysinternals.com/utilities/rootkitrevealer.html

    Once you identify the bad files, boot to recovery console and delete them. The files may be hidden so you have to use the command attrib to take off system and hidden attributes.

    For example, say your virus is "c:\windows\system32\virus.exe"

    When you enter Recovery Console, you start at the prompt as such. Type what is in bold.

    C:\Windows> cd system32
    C:\Windows\System32> attrib -H virus.exe
    C:\Windows\System32> attrib -S virus.exe
    C:\Windows\System32> attrib -R virus.exe
    C:\Windows\System32> del virus.exe

    After you type the last line it will just skip one line (like a space). If any command doesn't work, or says file is missing or can't find, etc, move on the next file.

    Note that in Recovery Console, you can NOT edit anything outside the "Windows" folder. So you can't delete a file if it is in just "C:\virus.exe".

    Once your files are deleted, go back in to Safe Mode and double check that traces of it are gone from registry, and that rootkitrevealer turns up clean.
  10. habaan

    habaan Newcomer, in training

    problem solved!
    .....
    it was that sysmanager.exe in my log...after i fixed it with HJT remon.sys never came back...
    ..anyway thank you for brief help
  11. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    Oops, I missed that, sorry. :blush:
  12. Jekkoy

    Jekkoy Newcomer, in training



    What did you do with that file? I also have that one here.
  13. habaan

    habaan Newcomer, in training

    i deleted the sysmanager.exe process by HJT program....but best is post your log from HJT here.
     
  14. NoCorndogs

    NoCorndogs Newcomer, in training

    Hi guys, Im having the same problem with System32\Remon.sys

    heres my HJT
    thanks for any help

    Attached Files:

  15. Jekkoy

    Jekkoy Newcomer, in training

  16. Jekkoy

    Jekkoy Newcomer, in training


    Thanks man, but my hjt log was actually on my first post ^^^ :)
  17. NoCorndogs

    NoCorndogs Newcomer, in training



    Thanks, im pretty sure I cleared the nail.exe one up, but I still need help with the remon.sys rootkit, everything i tried which im sure wasnt much, didnt do anything.

    if you guys could find it on my hjt that would be great.
  18. volodos

    volodos Newcomer, in training

    I have the same problem with remon.sys, I deleted it in DOS mode but when I entered windows it was running again. Here is my HJT log, can you please help ? I'm getting crazy !!!


    Logfile of HijackThis v1.99.1
    deleted
  19. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

  20. RealBlackStuff

    RealBlackStuff Newcomer, in training Posts: 8,165

    NoCorndogs

    First follow my post How to remove Aurora/Nailfix

    Boot in Safe Mode, see how here.
    Switch System restore OFF, see how here.
    In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here.

    Next, open Windows Task Manager by pressing CTRL+ALT+DELETE.
    Click the Processes tab, select the process (if there) and click End Process for:
    javapanel.exe
    nail.exe

    Next, click Start/Run and type services.msc and click OK. Look for the service:
    javapanel.exe
    Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

    Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
    ...................................................................................................
    This is a server from Best Buy, need to be 'fixed'.
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 168.94.74.68:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
    O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
    O23 - Service: ECA (cpanel) - Unknown owner - C:\WINDOWS\javapanel.exe
    ...................................................................................................
    Now click on the Fix Checked button in HJT. Exit HJT.

    When done, from between the above dotted lines, delete the highlighted bold files.
    When a \directory-name\ is bold, delete everything in it, including that directory itself.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Rightclick IE on the desktop, select Properties, click on Delete Cookies, and Delete Files.
    Delete ALL files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
    XP only: Delete ALL files from C:\WINDOWS\Prefetch.
    Boot normal. When all OK, switch System Restore back on.
  21. volodos

    volodos Newcomer, in training

    remon.sys

    I have the same problem with remon.sys, I deleted it in DOS mode but when I entered windows it was running again. Here is my HJT log, can you please help ? I'm getting crazy !!!
  22. patou

    patou Newcomer, in training

    same problem here

    i am also having problemswith remon.sys that is detected has a hacktool.rootkit
    and everytime it is detected it removes all the hidden shares on the machine.
    it also creates 2 lines in the registry AutoShareServer and AutoShareWks wich i delete everytime.
    i tried different software to remove the problem with no good result
    hjt does not detect anything significant.

    i tried in recup mode to change the attrib of remon.sys but i cannot find it anywhere.

    i have read most of the post here and i cannot find any of the files listed in the post. any help would be appreciated.

    Attached Files:

  23. Jekkoy

    Jekkoy Newcomer, in training

    as for the remon.sys, i think i've already get rid of it by deleting sysmanager.exe and remon.sys on the Registry and on C:\windows folder

    You should also stop it's system process. Open msconfig > Services and look for Windows System Manager. Uncheck that process, restart your pc in safe mode, and delete sysmanager.exe and remon.sys which is located at C:\windows\system32 (Make sure that all of the protected operating system files are shown. Tools > Folder Options > View )
  24. Jekkoy

    Jekkoy Newcomer, in training

    patou

    O23 - Service: TASKESV (TESV) - Unknown owner - C:\WINNT\taskcntr.exe

    -remove all the registry entries of taskcntr.exe
    -stop its process [ Open msconfig > services and uncheck, TASKEV
    -restart your computer in safe mode, :delete that file (located at C:\winnt)
    -you might wanna check out sysmanager.exe and remon.sys if there are some entries on the registy.


    check out if you got these files. i dont trust them>

    taskcntr.exe -
    sysmanager.exe - look closely on the task manager, you will see this running on and off.
    remon.sys
    iexpl0re.exe
  25. Jekkoy

    Jekkoy Newcomer, in training

    patou

    O23 - Service: TASKESV (TESV) - Unknown owner - C:\WINNT\taskcntr.exe

    -remove all the registry entries of taskcntr.exe
    -stop its process [ Open msconfig > services and uncheck, TASKEV
    -restart your computer in safe mode, :delete that file (located at C:\winnt)
    -you might wanna check out sysmanager.exe and remon.sys if there are some entries on the registy.


    check out if you got these files. i dont trust them>

    taskcntr.exe -
    sysmanager.exe - look closely on the task manager, you will see this running on and off.
    remon.sys
    iexpl0re.exe
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.