Monday, August 28, 2006

Removing Mailbot.AZ (aka Rustok.A) Rootkit

Mailbot.AZ (also known as PE386 or Rustock.A) is a kernel mode rootkit backdoor virus. It contains only one file-its driver-and it is stored as a hidden Alternate Data Stream (ADS) of System32 folder in NTFS systems. ADS itself isn't scanned by most of the security software and moreover the Mailbot.AZ driver ADS is hidden using kernel mode rootkit techniques. This makes the detection more difficult. More information about the Mailbot.AZ can be obtained at F-Secure Rootkit Information Pages or Symantec Security Weblog.


The new AVG Anti-Rootkit Beta detects and removes the Mailbot.AZ rootkit. Lets see how we can do it. Download and install the AVG Anti-Rootkit Beta.


Run the AVG Anti-Rootkit Beta, and click "Perform in-depth search". Allow AVG to complete the scan. It will display the hidden Mailbot.AZ rootkit driver. This is shown in the below screenshot.



Select the rootkit driver by placing a checkmark against it and click "Remove selected items". Next, agree for the terms and conditions that is displayed by AVG and click "OK" to reboot the PC. An example is shown in the below screenshot.


AVG Anti-Rootkit Beta renames the Mailbot.AZ rootkit driver so that the driver will not be loaded at the next reboot. But, it doesn't remove the actual rootkit ADS and its Registry entries. These can be removed by using ADS Spy (or HijackThis) and RegEdit respectively.


Download ADS Spy, a freeware which can be used to detect and remove ADS in NTFS systems. Run ADS Spy, select the "Full scan (all NTFS drives)" and click "Scan the system for alternate data streams". Once the scan is complete, select the rootkit driver ADS from the scan result, and click "Remove selected streams". An example is shown in the below screenshot.

(Note that the driver is renamed to lzx32.sy_)


Next, go to Start Menu > Run, and type Regedit and press Enter key. Here, navigate to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pe386 (or HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msguard). Right-click on this key (i.e. on pe386 or msguard) and select "Delete". Exit from Registry Editor. This is shown in the below screenshot.

13 Comments:

Anonymous Ocdex said...

Patience and pressure , all seen here....Good work

5:37 PM  
Anonymous Anonymous said...

Hmmmm...
great job by a very hardworking and dedicated person......great job:)

8:26 AM  
Anonymous Anonymous said...

poms say..
HUh..
superb work has resulted from the product of efforts and dedication :)

8:29 AM  
Blogger pallaver said...

I restarted the computer but can't get AVG Anti-Rootkit Beta to work. Is it because it won't work in safe mode? I can't get to normal mode because I have a fatal system error. Hm.... unsure what to do now.

I can be e-mailed at my username at hotmail dot com. Thankx.

2:35 AM  
Blogger blanjo-antivirus said...

Nice Blog, Best Information and Best Article!!!
we Wait new posting from this blog.

Find another Best & complete links :

TIPS TO BUY LAPTOP
Before you buy Laptop/Notebook or If you want to buy Laptop/Notebook, we give you Tips To Buy Laptop/Notebook. This tips can help you , how to choise your dreams Laptop/Notebook. Here is tips to buy laptop , so Find best laptop before you buy laptop, we give you Info for choice best laptop and you can find what is a best from best seller laptop. more ...
Tips To Buy Laptop

LAPTOP & NOTEBOOK CENTER
All Information About Laptop/Notebook
Find Best Seller laptop and Top 10 Laptop ( Laptop toshiba, laptop acer, laptop ibm, laptop nec and much more ... ), include best Laptop photos, laptop Bag, Laptop Accessories, Laptop DVD, We give you many choice laptop, tips to buy laptop or tips to buy notebook and info best laptop & Notebook computer, We give too best laptop for gammers, laptop for businessman, laptop for student, business laptop computer ultraportable systems and tablet computers to budget laptops & much more ...
Best Laptop

ANTIVIRUS GROUP
Our Antivirus Group can Help you if your computer have problem with many Virus , Worm, trojan, trojan horse.So, find now antivirus for ...
Download Free Antivirus Software

MAKE MONEY ON INTERNET
If you Interrest Make Money on internet you can learn here and we give tutorial how to make money on internet. When you have no ideas more, to make an extra income, you can start with our internet make money / make money online, to earn money from internet and work at home.Here is many sites for tutorial and how to create website for make money online. Actualy many idea for make money on internet, Here we give you tips and trick making money online find our tutorial for make money on internet ...
Online Business

WEBSITE PROMOTER
With Website Promoter you can know how to promote your site, how to make rangk on internet search engine ...
Website Promoter

ANTIVIRUS CENTER
Our Antivirus Center : here you can free Download Software Antivirus for remove all virus , trojan, worm virus W/32. You can choise, what is a good software antivirus for your computer specification.
Best Antivirus For Pc/ PDA/ Smartphone/ Laptop n Notebook

FREE HTML TEMPLATE
you can find here, If you want to learn more about internet, website, homepage.Ex: Here you can learn how to build website with html template ,complete with tutorial how to make quickly website, so ...
Free Template For Website Builder

DATING ONLINE SERVICE
If you want looking girl, partner for live, dreams woman, man , boy you can find, looking and dating online here, this dating online service is best for find your dreams ...
Fun Dating Online

NEW ANTIVIRUS BRONTOK
If you have still problem with virus rontokbro / brontok, rontokbro.eq, decoil, w32/khillav/w32/killav you can find here new antivirus for remove all virus brontok, new virus brontokvirus brontok here.many software for remove brontok virus ( antivir,antivirus Norman, Mc affe antivirus,Pc cilin antivirus ). you can choice and click your anti virus for brontok virus.So, don't be afraid for brontok virus, we give you here antivirus for brontok. our antivirus new and updated
New Antivirus Brontok/AntiRontokbro

ANTIVIRUS DECOIL
If you have still problem with virus decoil, dkernel, dekernel you can find here new antivirus for remove all virus decoil on your computer.so, find software for remove virus decoil ...
Antivirus Decoil, Decoil Removal


By : Blanjo Antivirus Company
Best Partnert This Blog

11:30 AM  
Anonymous Anonymous said...

Great Work! Worked like a charm. My 1st rootkit-detection removed. :) Thx! -wallu-

11:35 PM  
Blogger coco said...

NIKE板鞋 NIKE运动鞋 NIKE跑鞋

nikedao
nikedao
nikedao.com
www.nikedao.com

NIKE
ADIDAS
PUMA

NIKE板鞋
NIKE运动鞋
NIKE跑鞋

ADIDAS板鞋
ADIDAS运动鞋
ADIDAS跑鞋

PUMA板鞋
PUMA运动鞋
PUMA跑鞋


NIKE 板鞋
NIKE 运动鞋
NIKE 跑鞋

ADIDAS 板鞋
ADIDAS 运动鞋
ADIDAS 跑鞋

PUMA 板鞋
PUMA 运动鞋
PUMA 跑鞋

板鞋
运动鞋
跑鞋

首页
商品分类
会员中心
购物车
客户留言
品牌
赠品
捆绑商品

产品目录
联系我们
关于我们
常见问题
安全交易
购买流程
如何付款



adidas Smith 情侣鞋
adidas adicolor 情侣鞋
adidas 35周年鞋
adidas 新款皇冠女鞋
adidas 城市系列

NIKE 复古板鞋
NIKE Dunk SB
Nike Air Force One
NIKE AF1 25周年
Nike Air MAX 2003系列跑鞋

11:38 AM  
Blogger dfous said...

Bon marche de Dofus Kamas.achat de dofus.le prix moins cher.nous vendons dofus,or de Wakfu. 24/7 appui-en-ligne et livraison rapide.Wakfu Kamas
china: chinaserving

6:29 PM  
Blogger Free Online Dating on YourDatingTube.com said...

Check this free online dating on YourDatingTube.com its totally free!

YourDatingTube.com is a new unique and innovative free dating site. We offer you the following services: free emails (send and receive), forums, blogs, polls, eCards, rate photos, videos, chat rooms, IM and more matchmaking tools for singles.

Visit us at Free online dating on YourDatingTube.com

2:30 AM  
Blogger lla said...

cell phones
mobile phone
cheap cell phones wholesale

12:24 PM  
Anonymous Free Antivirus Download said...

Mailbot.AZ is new kind of virus and it boost rapidly. free antivirus download

2:27 PM  
Blogger Brandon Hudson said...

Your post really cool and interesting. Thanks very much.

Lenovo - IdeaPad 15.6" Refurbished Laptop - 4GB Memory - 320GB Hard Drive - Black

Lenovo - IdeaPad 15.6" Laptop - 4GB Memory - 320GB Hard Drive - Black

5:24 PM  
Blogger devid mark said...

It's really appreciable message for everybody thanks for sharing this information.
totally free online dating, free dating online, free uk dating sites, free personals, online dating site free

1:44 PM  

Post a Comment

<< Home