Jump to content

RootKit.Agent infection


Solystra
 Share

Recommended Posts

Okay, I inherited an Acer Aspire T180 with Windows Vista OS from my now deceased mother.....The problem is: Computer shuts down after only a moment or two in Normal mode and Safe Mode with Networking. I can stay in safe mode as long as I need to but that's the only time. Ran Malwarebytes and 16 infected files were found. Upon restart, 15 were removed. Malwarebytes continues to find but cannot seem to delete RootKit.Agent. File is located here : c:\windows\system32\drivers\lypkwia.sys

I keep getting a pop up that says "Host Process for Windows Services stopped working and was closed. A problem caused the application to stop working correctly, Windows will notify you if a soulution is available."

When in normal mode, I keep getting a pop up that says: "Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now."

Now, the problem is compounded by the fact that I cannot access the internet from the infected computer and I have no recovery discs. In fact, all attempts to recover from a restore point have failed because apparently, no restore point was ever made.

Is there any way to fix this or should I just bite the bullet and buy a new Win7 disc and reformat entirely?

Attatched is the latest Malwarebytes log. mbam-log-2011-02-19 (23-50-42).txt

Thanks in advance

Link to post
Share on other sites

Hello ,

And :welcome: My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the Quick Scan button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please Download Rootkit Unhooker Save it to your desktop.

  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note - if you get the following warning, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Click on Cancel, then Accept.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • RKU log

Thanks and again sorry for the delay.

Link to post
Share on other sites

I would like to first like to say I appreciate your help in advance. Secondly, I would like to restate that I cannot access the internet from the infected computer since it crashes within a minute of being windows starting. This occurs in both Normal mode as well as Safe Mode with Networking. I cannot download directly to my desktop because of this.

So my question becomes: Can I download these things onto a flash drive or cd and transfer them to the infected computer? Will they work that way?

Link to post
Share on other sites

Yes, they will work that way, but to protect the computer you use to download, I recommend you to use Flash Disinfector.

Please download Flash_Disinfector.exe by sUBs and save it to your desktop.

  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
  • Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

Link to post
Share on other sites

  • 4 weeks later...
Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.