win32:Rbot-ANG

[marieandgordon]

Can anyone tell me how to get rid of this trojan. it originally appeared C:\WINDOWS\system32\winlog.exe and then C:SystemVolumeInformation\_Restore{lots of numberes}.exe and now in C:\programFiles\winsupdater\winsupdater.exe file. i   moved it to chest yesterday but after a scan now it is again in the winsupdater.exe file
i use windows xp with avast and zone alarm
marie

[Lisandro]

Can you schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives.
Boot.

Besides this, disable System Restore and then enable it again to clean it.
Start > Control Panel > System > System restore > Disable
Click Apply
Enable it again
Click Ok

[FreewheelinFrank]

If a boot time scan fails, try this disinfector:

http://www.sophos.com/support/disinfection/rbotek.html

Do you have a good firewall? Download a good free one like Zone Alarm if you haven't. Install it after you have cleaned the infection.

And then go straight to the Microsoft Update site and download all the critical updates, or you will easily be infected again.

http://windowsupdate.microsoft.com/

[Spiritsongs]

  You may have other malware on your computer !? Do you
     use an antiSPYWARE program and if yes, what does its
    "Full" scan results show ? Should also consider using the
     good & FREE Ewido from www.ewido.net/en ; this program
     "specializes" in detecting and removing trojans, worms,
      dialers, etc . "Winsupdater" sounds like a spyware I have
     seen "dealt" with on various antispyware forums !?
     

[MrBabis]

AVAST can remove but  you need to update your windows.

Win32:Rbot-ANG [Trj]

[marieandgordon]

only just logged on again so have not yet done a boot time scan. we use adaware, spybot search and destroy, trend micro anti spywear -  intenet expolrer is up to date on updates and so is zone alarm, nothing has picked this up on a scan only avast .
i will do a boot time scan and let you know
marie

[Lisandro]

Nothing has picked this up on a scan only avast

Anyway, it does not seem a false positive but a real infection... 
After scanning with avast (archive option checked), try online spyware scanning at http://www.spywareguide.com/txt_onlinescan.html
and one of the online virus scanning at http://www.security-ops.tk/

You can submit the files to Jotti and let us know the results, i.e., if it is or not a false positive.

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect ('virus', will do) the suspect file and send it to virus (at) avast.com.
Give a brief outline of the problem, the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see About avast: right click avast icon) will also help.

[polonus]

Hello marieandgordon,

There is a whole array of Rbot viruses, worms all used to prey on innocent users by hackers or industrial hackers. They were build to put more functionality to these worms. Some can even look into the bedroom (so turn you webcam off  or patch your OS).
For removal instructions, I second FwF,  look here:
http://www.sophos.com/support/disinfection/rbotek.html

Get this worm from your machine soon, lots of success, and welcome to the web forum,

polonus

[marieandgordon]

right, i have run spybot, ad aware, ewido, trend micro  and avast anti virus, i have done a boot scan and done the disinfection thing on sophos, nothing showed up, does this mean it has gone or is it lurking somehere?
All my windows updates are up to date i checked and zone alarm is up to date
Marie

[MrBabis]

Did you try autoruns to se if some other programs that loads on startup?

[marieandgordon]

sorry what are autoruns? how do i do that, i know it is probably something very simple...

[DavidR]

Autoruns is a program to check what runs on start-up. You can check this in windows though, Start, Run, type msconfig and click enter. Then check the Startup Tab and see what is in there.

[Lisandro]

sorry what are autoruns? how do i do that, i know it is probably something very simple...

If I`m not wrong, check www.sysinternals.com 

[Spiritsongs]

   Marie :

      Since you have Ad-Aware, I would suggest you ask the
      Ad-Aware Experts on the forums at www.landzdown.com
      for help !? They know of "special instructions" to be used
      with Ad-Aware to get rid of serious spyware, etc .

[FreewheelinFrank]

Can you post a HijackThis! log please?

http://www.bleepingcomputer.com/forums/tutorial42.html