1. TechSpot is dedicated to computer enthusiasts and power users. Ask a question and give support. Join the community here.
    TechSpot is dedicated to computer enthusiasts and power users.
    Ask a question and give support.
    Join the community here, it only takes a minute.
    Dismiss Notice

Rootkit.agent Removal Help

By Kikaroo ยท 4 replies
Jun 3, 2009
  1. Tonight I left my computer for a bit (30 to 45 minutes) and came back to find all my windows gone and Security System 2009 popping up all over. Background wallpaper was changed as well.

    Symantec had removed 8 various items automatically while I was away (2 "Packed.Generic.218", 2 "Trojan.Vundo", 2 "Infostealer", and 2 "Hacktool.Rootkit"). However, I went ahead and did some scans with Adaware and Symantic's full scan. Neither came up with anything, but the Security System thing kept popping up.

    So, I ran Malwarebytes. It found 11 things, some of which it deleted and others it removed upon reboot. However, upon a second scan, C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) popped up again. Tried a couple more times, same result.

    Then I found this site, so started from scratch. Symantec found nothing. Used the CCleaner twice. Disabled Symantec. Ran Malwareytes again (rootkit still showing as present) as well as SAS (found nothing). Java is the current version. Ran Hijackthis.

    Logs posted as requested.

    Now, how do I go about getting this bugger off here? Or am I stuck with a reinstall?
  2. touch

    touch TS Rookie Posts: 978

    Hello Kikaroo

    Please download Combofix from:
    And save to the desktop.

    Close all other browser windows.

    Double-click on the combofix icon found on your desktop.

    Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

    When finished, it will produce a logfile located at C:\combofix.txt.

    Attach the contents of that log in your next reply
  3. cyberkrasher

    cyberkrasher TS Rookie


    ( e r a s e d )
  4. mflynn

    mflynn TS Rookie Posts: 2,655

    Hi cyberkrasher

    First rename ComboFix to 1cfix and run it again and post new log!


    Do the TechSpot 8 steps: https://www.techspot.com/vb/topic58138.html

    Get us these logs!


    You need to start your own thread and get out of Kikaroo's!
  5. lainiel

    lainiel TS Rookie

    rootkit.agent str.sys won't go away in malwarebytes, my log file is attached

    View attachment 50179

    I am not sure how to start my own thread as I am new here but I am having a similar issue.
    rootkit.agent str.sys won't go away

    how this started:

    - my user downloaded some nice viruses from clicking a facebook link

    what I have done:

    - looked to do a system restore but there are no restore points in windows
    - ran hijackthis removed some other nasty viruses and spyware
    - ran malwarebytes 5+ times but str.sys doesn't go away.

    what keeps happening:

    - everytime I log onto windows xp pro, service pack 2, it gets through to loading settings then reboots

    I have followed the instructions I have found here and am hoping that someone can review my log file, like everyone else, I want to avoid a win xp pro rebuild. So, here it is, fellas. Any help is appreciated.


Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...