TechSpot

Possible Poison Ivy nfection + maybe other rootkits etc

By sip
Apr 20, 2008
Topic Status:
Not open for further replies.
  1. Hi

    i ahve been the victim of a copy of mcaffe antivirus which has a poison ivy based trojan infecting it.


    i have surmised this from the appearance of either iexplore.exe or firefox.exe in the task manager list straight after mcaffe autoruns the installer. after some research it seems that this is a classic example of a hidden process for the poison ivy trojan or similar ones.

    i have run HJT and will paste the log file below.

    can you please advise what to do next? ie should i just format or continue and clean? also are there any ways of detecting this trojan as it doesnt seem to show up on anti spyware or any antivirus.

    HJT log attached
  2. kritius

    kritius TS Guru Posts: 2,087

    I have one question if you say that you are using an infected copy of an antivirus, why are you still using it?

    I would unistall it and get some other AV product,

    Once installed, Update it, run full system scan with it and allow it to fix up what it wants.
    Reboot if it fixed anything.

    You should get a firewall as well, either,

    follow all the steps HERE and then post back with the three requested logs as attachments
    • AVG antispyware
    • ComboFix
    • Hijackthis (step 15)

    Dont forget to make sure that AVG is set to quarantine the results, that HJT is the last step and to let us know the results of the antirootkit scan.
  3. sip

    sip TS Rookie Topic Starter

    the trojan was loaded from an autorun in the root of the cd whereas the normal antivirus seemed to load with no problems so it got left as is.

    and if i am going to need to format the HD then whats the point in sitting here through an uninstall and reinstalling another product just so i can wipe it.

    ok ill be back shortly with the logs
  4. sip

    sip TS Rookie Topic Starter

    hjt attached

    AVG antirootkit said nothing to report.

    combofix didnt seem to do anything at all. just had a bar that went across for a moment and then thats it.
  5. kritius

    kritius TS Guru Posts: 2,087

    : Download and Run DSS

    Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.
    • Close all applications and windows.
    • Double-click on dss.exe to run it, and follow the prompts.
    • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
    • Attach the main.txt and the extra.txt in your reply.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.