hacktool.rootkit - remon.sys

[addman8]

I am still really stuck with this bugger.

I deleted it once by changing the extension, but it showed up again. Seems to be tied to my Norton somehow as the warning bubble in the system tray constantly pops up. I uninstalled all my Norton stuff and it still shows up.

thoughts anyone??

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions.

Then, go HERE and follow the instructions in the order they are given.

Post a fresh HJT log, only after doing the above.

Regards Howard :wave: :wave:

 

[addman8]

already done

I have already gone through all those steps...

There was no evidence of javapanel, taskcenter, xpjava, etc.

 

[howard_hopkinso]

Ok no problem.

I find evidence of the sdbot infection in your HJT log.

Go HERE and follow the instructions.

Then, post a fresh HJT log.

Regards Howard

 

[addman8]

next step

I got through those processes. Ewido found a bunch of stuff.

I attached logfiles for Ewido and updated HJT.

Thanks much,

matt

 

[howard_hopkinso]

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

TRISNA~1
RXToolBar
EmpirePoker
PartyPoker

Close control panel.

Click start/run and type regsvr32 /u C:\Program Files\RXToolBar\sfcont.dll into the run box and press the enter key.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it.

Double click on the following services(If there), and selcet stop if they are running. Set the startup type to disabled. Click apply/ok for each service.

SysEnforce
Socks-Cap (Sc32Inch)
nvidGUIv (nvidGUIv2)
ATIintergrated
SemanticInsight

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

SemanticInsight.exe
atigraphics.exe
nvidGUIv.exe
Sc32Inch.exe
SYSENF~1.EXE
PartyPoker.exe
EmpirePoker.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)

O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll

O23 - Service: ATIintergrated - Unknown owner - C:\WINDOWS\atigraphics.exe (file missing)

O23 - Service: nvidGUIv (nvidGUIv2) - Unknown owner - C:\WINDOWS\nvidGUIv.exe (file missing)

O23 - Service: Socks-Cap (Sc32Inch) - Unknown owner - C:\WINDOWS\Sc32Inch.exe (file missing)

O23 - Service: SysEnforce - Unknown owner - C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files(if there).

C:\PROGRA~1\TRISNA~1\SSI\SYSENF~1.EXE
C:\WINDOWS\Sc32Inch.exe
C:\WINDOWS\nvidGUIv.exe
C:\WINDOWS\atigraphics.exe
C:\Program Files\RXToolBar\sfcont.dll
C:\Program Files\PartyPoker\PartyPoker.exe
C:\Program Files\EmpirePoker\EmpirePoker.exe
C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe

Reboot into normal mode and turn system restore back on.


Regards Howard

 

[addman8]

I think I have smooth sailing...

We'll see.

Thanks so much for your help. I hope that I am not back for a while!!

 

[howard_hopkinso]

I think I have smooth sailing...

We'll see.

Thanks so much for your help. I hope that I am not back for a while!!

It doesn`t matter. Even if you are, we`ll still be here to help.

Regards Howard