Exploit:java/cve-2009-3867.eo

[xp pro]

hello, the above "exploit was found ,quarrentined and removed, i noticed info on possible rootkits on google,do i need and how to look for rootkits,thanks sam

[MrCharlie]

Two good programs to run:

Download TDSSKiller to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Start Scan.

Don't Change This Settings:

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

You may be asked you to reboot the computer to complete the process. Click on Reboot Now

To view the report:

Click the Report button and copy/paste the contents of it into your next reply.

Note:It will also create a log in the C:\ directory.

----------------------------------------------------

Download and unzip Rootrepeal from the link below:

http://rootrepeal.googlepages.com/

Run rootrepeal.exe by double clicking on it

Click on Report tab on the bottom right of the software then press Scan

Put at check in all box's except the 2 SSDT option's then press OK

Place a check in drive to be scanned (it is usually C)

Click OK, the scan will start and when done it will produce a log

Please save the logfile generated and copy and paste the contents of that log into your next reply.

MrC

[xp pro]

Two good programs to run:

Download TDSSKiller to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Start Scan.

Don't Change This Settings:

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

You may be asked you to reboot the computer to complete the process. Click on Reboot Now

To view the report:

Click the Report button and copy/paste the contents of it into your next reply.

Note:It will also create a log in the C:\ directory.

----------------------------------------------------

Download and unzip Rootrepeal from the link below:

http://rootrepeal.googlepages.com/

Run rootrepeal.exe by double clicking on it

Click on Report tab on the bottom right of the software then press Scan

Put at check in all box's except the 2 SSDT option's then press OK

Place a check in drive to be scanned (it is usually C)

Click OK, the scan will start and when done it will produce a log

Please save the logfile generated and copy and paste the contents of that log into your next reply.

MrC

mr c below is roorepeal log,the first scan (not root repeal scanned 175 files found no infections-nothing to copy to send)

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/10/04 10:35

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xEFBAA000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8A90000 Size: 8192 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xEF47F000 Size: 49152 File Visible: No Signed: -

Status: -

==EOF==

[MrCharlie]

You don't have to quote my reply, just use the add reply button on the bottom of the post.

That looks OK, are you having any problems? MrC

[Maurice Naggar]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.