Windows 7: Trojan:Win32/Comroki!rts

Downloaded and ran the Microsoft Safety Scanner and it found this.
Trojan:Win32/Comroki!rts
Safety Scanner removed so it says.

All I found with Google besides sales pitches to buy things is this at MS.
Encyclopedia entry: Trojan:Win32/Comroki - Learn more about malware - Microsoft Malware Protection Center

Basically no info.

Malwarebytes missed it on scan before the MS Safety Scanner and Avast let it in.
Ran Avast after Safety Scanner and nothing else found.
That makes me feel warm and fuzzy since neither caught it the first time.

Anything else I need to run for removal?

One of our security people around tonight?

Hey,

Run a scan with Malwarebytes FREE if you haven't already mate.

Some info from ThreatExpert : http://www.threatexpert.com/report.a...24beeec4b10e79

Regards,
Golden

Golden

I did that first and it missed it. I can rerun just to be safe.

I wanted to make sure that it was that easy to remove or is it one of the stubborn pain in the ... to remove ones.

Mmm OK....yep I missed the bit where you said that (doh). Have you tried the ESET on-line scan?

No like I said the Microsoft Safety Scanner says it was removed.

I have the online ESET so I will update and run it to be sure.

I answered your VM.

If it made all those registry changes that Threatexpert reported I may have a mess.

Hop : if its cleaned out thats good, but we need to make sure its not a backdoor variant - I'm not sure how to tell that. We need Jacee or Corinne to give this the once over.

Let us know how you get on mate,
Golden

ESET on line scanner shows clean.

Trojan.Win32.Pasta [Ikarus] is also known as:

Trojan:Win32/Comroki [Microsoft]

Trojan.Win32.Pasta [Ikarus] is known to be created as:
%ProgramFiles%\ainmet\rainmeter.exe
%ProgramFiles%\complus applications\vwxzceh.exe
%ProgramFiles%\freevpn\freevpn.exe
%ProgramFiles%\internet explorer\svuwyxzd.exe
%ProgramFiles%\microsoft frontpage\oqsrt.exe
%ProgramFiles%\movie maker\utvxw.exe
%ProgramFiles%\movie maker\wybzc.exe
%ProgramFiles%\movie maker\yfhonsr.exe
%ProgramFiles%\msn gaming zone\ilkmonpo.exe
%ProgramFiles%\web publish\gihkmlnp.exe
%ProgramFiles%\windows nt\xhkjln.exe
%ProgramFiles%\winpcap\jltsv.exe
%ProgramFiles%\winpcap\oqprtqpr.exe
%ProgramFiles%\xerox\gikjn.exe
%System%\msnwshoot.exe
%System%\mstooltaskbar.exe
%Temp%\137626.exe
%Windir%\smss.exe

If you find any of these entries, upload them to Virus Total. A Guy

Win Defender, ESET on line scanner, Avast and Mbam clean.

The only scanner that found something was MS Safety Scanner.

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Right click the dds icon to run the tool as Administrator
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.