Author Topic: Win32KStream trojan not found by Avast  (Read 5201 times)

0 Members and 1 Guest are viewing this topic.

Offline Harleyrider

  • Newbie
  • *
  • Posts: 12
Win32KStream trojan not found by Avast
« on: December 05, 2009, 04:44:21 PM »
My Stopzilla has flagged about 145 instances of this trojan but cannot get rid of it. Neither does Avast find it! It is resident in all my restore points in windows. How can I get rid of this or at least repair/disinfect those files.

TIA

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85381
  • No support PMs thanks
Re: Win32KStream trojan not found by Avast
« Reply #1 on: December 05, 2009, 05:02:10 PM »
A little information wouldn't go amiss, like file name and location and when detected etc. ?

You could also check the offending/suspect file/s (some samples) at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page.

The StopZilla site hasn't got a very good rep according to this, http://www.mywot.com/en/scorecard/stopzilla.com.

These are good anti-spy/malware applications see what they reveal.
If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.5.2470 (build 21.5.6354.675) UI 1.0.646/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Harleyrider

  • Newbie
  • *
  • Posts: 12
Re: Win32KStream trojan not found by Avast
« Reply #2 on: December 05, 2009, 05:06:06 PM »
malware bytes is a joke as the scanner window disappears soon after you start the scan and trying to restart brings up an error message. It has never worked right for me

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37068
Re: Win32KStream trojan not found by Avast
« Reply #3 on: December 05, 2009, 05:43:35 PM »
malware bytes is a joke as the scanner window disappears soon after you start the scan and trying to restart brings up an error message. It has never worked right for me
this looks like you have an infection blocking MBAM

Offline Tgell

  • Sr. Member
  • ****
  • Posts: 234
  • Definitely not a BOT!
Re: Win32KStream trojan not found by Avast
« Reply #4 on: December 05, 2009, 05:53:23 PM »
As Pondus stated, not being able to run MBAM is a good indication of an infected system. You might want to try DrWeb CureIT. If that does not run, try their LiveCD.

http://www.freedrweb.com/cureit/

http://www.freedrweb.com/livecd/

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37068
Re: Win32KStream trojan not found by Avast
« Reply #5 on: December 05, 2009, 06:05:03 PM »
As Pondus stated, not being able to run MBAM is a good indication of an infected system. You might want to try DrWeb CureIT. If that does not run, try their LiveCD.

http://www.freedrweb.com/cureit/

http://www.freedrweb.com/livecd/
jepp and you can also try Norman Malware Cleaner http://www.norman.com/support/support_tools/58732/en

some info on Stopzilla http://www.malwarebytes.org/forums/index.php?showtopic=1416

Also MBAM just released V1.42
« Last Edit: December 05, 2009, 06:11:08 PM by Pondus »

Offline pinnacle

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 429
    • Security Information Zone
Re: Win32KStream trojan not found by Avast
« Reply #6 on: December 05, 2009, 06:11:47 PM »
this also may be of some help to you, it did me, Eset Online Scanner http://www.eset.com/onlinescan/

Offline spg SCOTT

  • Massive Poster
  • ****
  • Posts: 4124
  • There is no magic, only lost physics
    • spg SCOTT
Re: Win32KStream trojan not found by Avast
« Reply #7 on: December 05, 2009, 06:14:28 PM »
OH...maybe that is the reason that avast! isn't working properly...

http://forum.avast.com/index.php?topic=51835

He's off re-installing avast! atm, I think...  :-\
“There is a computer disease that anybody who works with computers knows about. It's a very serious disease and it interferes completely with the work. The trouble with computers is that you 'play' with them!”Richard Feynman

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85381
  • No support PMs thanks
Re: Win32KStream trojan not found by Avast
« Reply #8 on: December 05, 2009, 07:06:48 PM »
malware bytes is a joke as the scanner window disappears soon after you start the scan and trying to restart brings up an error message. It has never worked right for me

No joke, it is one of the better anti-malwares out there and disappearing/not running isn't normal and more likely to be some other influence as has been mentioned. This could possibly be a rootkit.

What are the error messages that you get when trying to restart it ?

You could also try running MBAM from safe mode and see if that makes any difference. I believe there is also a way to run MBAM using a random file name so that the executable isn't initially recognised, though I have never had to do this.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.5.2470 (build 21.5.6354.675) UI 1.0.646/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline cod head

  • Sr. Member
  • ****
  • Posts: 254
Re: Win32KStream trojan not found by Avast
« Reply #9 on: December 05, 2009, 07:59:00 PM »
I believe what you do is when you download malwarebytes,when you save the download or file you rename it as whatever you want instead of malwarebytes so the rouge software does not recognise it.I have read it somewere but fail to recall.Probably Bleeping Computer Forum or somewere like that.
Win 7 Home Premium 64 bit,Avast Free,Superantspyware Free,Malwarebytes Pro Winpatrol Pro,Spywareblaster Free.

Offline Harleyrider

  • Newbie
  • *
  • Posts: 12
Re: Win32KStream trojan not found by Avast
« Reply #10 on: December 05, 2009, 09:00:52 PM »
Thanks guys. I will be doing teh Safe mode thing is a minute!. I'll let you know how it goes!

Offline Harleyrider

  • Newbie
  • *
  • Posts: 12
Re: Win32KStream trojan not found by Avast
« Reply #11 on: December 06, 2009, 12:39:46 AM »
Well that did not work. I even tried Dr Web and does the same thing disappearing after starting the scan. The first scan turned up a Trojan but did not give me a way to get rid of it. I even downloaded the 30 day trial to no avail!

Offline Tgell

  • Sr. Member
  • ****
  • Posts: 234
  • Definitely not a BOT!
Re: Win32KStream trojan not found by Avast
« Reply #12 on: December 06, 2009, 02:02:01 AM »
DrCureIt Live cd is an iso file that you burn then you boot from that. Uses Linux so it bypasses the OS. Scans take awhile though. There is a help file for it here.

ftp://ftp.drweb.com/pub/drweb/livecd/LiveCD-en.pdf

Offline ronefx

  • Newbie
  • *
  • Posts: 1
Re: Win32KStream trojan not found by Avast
« Reply #13 on: December 07, 2009, 10:07:20 PM »
if you have the ability to slave the infected drive on another computer you can run a  malwarebytes scan on that way. or try using combofix(google it) or you can download it from:
 http://www.bleepingcomputer.com/combofix/how-to-use-combofix

« Last Edit: December 07, 2009, 10:11:21 PM by ronefx »

Offline JanAchik123

  • Jr. Member
  • **
  • Posts: 27
Re: Win32KStream trojan not found by Avast
« Reply #14 on: December 10, 2009, 09:23:09 PM »
Send a sample to them. Add a file to the chest and right click and email to Alwil.
Then choose potential malware, a description and your email address(optional).