Troj/Rustok-N help with removing please

i got a problem when i click scan for GMer.exe. when it was scaning something pop up saying this:

WARNING!!!!
GMEr has found system modification,which might have been caused by ROOTKIT activity. Dou you want to fully scan your system ?

Yes, we need to find the rootkit and remove it.

okay.doing full scan

If the log turns out to be huge, upload it here:
sendspace.com

when i click copy it say it was copied to a clip board.

Copy all of it to a notepad file and save it somewhere, like your desktop.
Then if it's small, post it here. If not, upload it at sendspace.com

for the sendspace thing.it needs the recipient e-mail.....

No it doesn't, it says (optional)
Leave the optionals blank.

nope.....it's to big

oh okay,sorry didn't see it

so all i do it upload it and how you gonna get it??

When you upload it, it gives you a URL to use.

address not found.can't find the server. can't upload cause of this

Okay, look through the log yourself, probably down the bottom of the log somewhere, there might be a line that says this:

"<--- ROOTKIT !!!!"

If there is, please let me know.

ok i fix out the problem.it was my firewall.

im uploading the text of the scan now

http://www.sendspace.com/file/k10k2w this is the download link

and by the way is the ROOTKIT in red in the GMer scan??

Hello.
Yes, there is infact TWO rootkits we need to kill.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE. <== the first link maybe blocked, so use the second link

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box blank.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

isn't 6 rootkit we need to kill??

I just had a brief look at the log and noticed two rootkits, if there's more, the avenger will take them down also.

and so i check the box for "scan for rootkits" and check the box "disable any rootkits found" ??

Scan for rootkits should already be ticked.
Then tick the "Disable any rootkits found"

Then press the execute button.

it say:
first step completed --- The Avenger has been successfully set up to run on next boot . reboot now?

yes no

Yes.

okay it's done....this what it says:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "msqpdxserv.sys" found!
ImagePath: \systemroot\system32\drivers\msqpdxntidbwuc.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

Hello.
We need to delete the rootkit now.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
msqpdxserv.sys

Files to delete:
C:\WINDOWS\system32\drivers\msqpdxntidbwuc.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply.

what text contained in the code box?? and what clip board??

Clipboard is that copy/paste is called in tech terms.
The code box above with the Drivers to delete/files to delete.

so do i also copy and paste the driver to delete and file to delete thing to the avenger box??

another question is do i just copy and paste the files name and drivers name above to delete in the avenger box??

Copy all of what is in the box.

okay,it's done. here is the log:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "msqpdxserv.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\msqpdxntidbwuc.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

what i do next?

The rootkit is now dead.
Please run another MBAM scan to be sure.

so the trojan is removed??

if so,how you know?

and do i perform a full screen or quick scan for mbam?

This is how:

Driver "msqpdxserv.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\msqpdxntidbwuc.sys" deleted successfully.

The driver was deleted.
The file was deleted.

and do i do a quick scan or full scan??

Quick scan.
If it's clean and no problems remain, we'll pass this off as clean.

and Thank you so much that i even thought that i can't even remove this trojan..

and thanks for your time helping me removing it and i kept going to places searching how to remove and looking.....well thanks alot

Hello.
I'd say were done here.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

by the way,got any good anti virus software besides the list you gave up above??

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition
-Anti-virus program for Windows.
-The home edition is freeware for noncommercial user.
3) AVG Anti-Virus Free Edition
- Free edition of the AVG anti-virus program for Windows.
- Available for single computer use for home and non commercial use.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

and do you got any good software that let's you know when your entering a bad website that can give you virus or trojan

Well if you took my advice on using Firefox, Firefox will tell you if the site you are visiting is a known attack site.

ok i'll try that thank you. and do you want to be friends?

Feel free to stick around if that's what you mean.

is there a anti virus software call java something??

Anti-virus and anti-spyware are different things.

Webroot spysweeper is (I think) owned by someone called Java.
There is also JavaRa (old) Java remover.

okay,done with scaning and restore point. my computer is not running so slow like before now. ok i'll been seeing you next time if i have problems :victory:

and for the scan, it's clean

do i also delete or remove the downloads you told me to download for the trojan?

Yes, please delete the tools we used.