Solved Trojan:Win32/Comroki!rts

[Hopalong X]

Downloaded and ran the Microsoft Safety Scanner and it found this.
Trojan:Win32/Comroki!rts
Safety Scanner removed so it says.

All I found with Google besides sales pitches to buy things is this at MS.
Encyclopedia entry: Trojan:Win32/Comroki - Learn more about malware - Microsoft Malware Protection Center

Basically no info.

Malwarebytes missed it on scan before the MS Safety Scanner and Avast let it in.
Ran Avast after Safety Scanner and nothing else found.
That makes me feel warm and fuzzy since neither caught it the first time.

Anything else I need to run for removal?

One of our security people around tonight?

 

[Golden]

Hey,

Run a scan with Malwarebytes FREE if you haven't already mate.

Some info from ThreatExpert : http://www.threatexpert.com/report.aspx?md5=5e9b4b466e5f3bba9824beeec4b10e79

Regards,
Golden

 

[Hopalong X]

Golden

I did that first and it missed it. I can rerun just to be safe.

I wanted to make sure that it was that easy to remove or is it one of the stubborn pain in the ... to remove ones.

 

[Golden]

Mmm OK....yep I missed the bit where you said that (doh). Have you tried the ESET on-line scan?

 

[Hopalong X]

No like I said the Microsoft Safety Scanner says it was removed.

I have the online ESET so I will update and run it to be sure.

I answered your VM.

If it made all those registry changes that Threatexpert reported I may have a mess.

 

[Golden]

Hop : if its cleaned out thats good, but we need to make sure its not a backdoor variant - I'm not sure how to tell that. We need Jacee or Corinne to give this the once over.

Let us know how you get on mate,
Golden

 

[Hopalong X]

ESET on line scanner shows clean.

 

[A Guy]

Trojan.Win32.Pasta [Ikarus] is also known as:

Trojan:Win32/Comroki [Microsoft]

Trojan.Win32.Pasta [Ikarus] is known to be created as:
%ProgramFiles%\ainmet\rainmeter.exe
%ProgramFiles%\complus applications\vwxzceh.exe
%ProgramFiles%\freevpn\freevpn.exe
%ProgramFiles%\internet explorer\svuwyxzd.exe
%ProgramFiles%\microsoft frontpage\oqsrt.exe
%ProgramFiles%\movie maker\utvxw.exe
%ProgramFiles%\movie maker\wybzc.exe
%ProgramFiles%\movie maker\yfhonsr.exe
%ProgramFiles%\msn gaming zone\ilkmonpo.exe
%ProgramFiles%\web publish\gihkmlnp.exe
%ProgramFiles%\windows nt\xhkjln.exe
%ProgramFiles%\winpcap\jltsv.exe
%ProgramFiles%\winpcap\oqprtqpr.exe
%ProgramFiles%\xerox\gikjn.exe
%System%\msnwshoot.exe
%System%\mstooltaskbar.exe
%Temp%\137626.exe
%Windir%\smss.exe

If you find any of these entries, upload them to Virus Total. A Guy

 

[Hopalong X]

Win Defender, ESET on line scanner, Avast and Mbam clean.

The only scanner that found something was MS Safety Scanner.

 

[Jacee]

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Right click the dds icon to run the tool as Administrator
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.

 

[Hopalong X]

I have seen you post this before. Only one question.

Script blocking. I have no idea if any script blocking is running or not.

Here are the files.

 

[Jacee]

I don't see anything in those reports. What did Microsoft Safety Scanner find, exactly? Do you have the name of the file and path?

 

[Hopalong X]

Trojan Win32/Comroki

Saturday evening.
I downloaded and ran the Microsoft Safety Scanner it showed it found one thing as it was scanning.
When done it popped up a window showing Trojan Win32/Comroki removed.
No log or path or option to save a log or anything.

Friday evening Mbam found nothing. My weekly scan.
Avast never showed a bad page or anything yesterday.
Actually only went to 3 web sites yesterday before downloading the Safety Scanner and running.

After Safety Scanner said it found and removed the trojan I then ran the ESET, Avast and Mbam again after Safety Scanner and found nothing.
Ran Win Defender this morning- forgot it was on here and running also. Nothing found.

So totally confused here.

False alarm or if I had it it is now gone?

 

[Borg 386]

Well, MSE sounded the alarm for that on mine also (Trojan Win32/Comroki). However, the file it said was infected was rkill.com. I d/l ed that copy of the file about a month ago from the legit website.

When I scanned the exact same file (rkill.com) I keep on my external HD with MSE, it came back negative.

It detected this shortly after I applied the update for MSE (To ver 2.1.1116.0). I wonder if that had anything to do with it?

Meanwhile, I've done an extensive check of the system and found nothing. I tried d/l ing rkill again to see if it would pick it up as infected, and although it was the same version, it didn't register anything when scanned.

 

[Jacee]

RKill is not malicious. VirusTotal shows that only a few AVs flag it as anything
I believe, Mike, that a F/P was flagged.

 

[Borg 386]

I was wondering if it was a false positive.

I assumed it probably was when I scanned the rkill file on the external HD and it found nothing, along with d/l ing the same version of rkill and nothing showing up.

However, I still did some through investigating, since paranoia is a good thing when it comes to viruses/malware.

@Jacee - MSE has never detected rkill as malicious on my machine...until that one time....curious...

 

[Hopalong X]

Me too on the paranoia.

I also have rkill downloaded.
Since the Safety Scanner gives you no info other than the name of what says it removed it could have been a reaction to anything.

Thanks for the help Jacee.

 

[Golden]

Whew! Nice one.