Spyware Warrior

[BobWoofer]

Hi,

I'm trying to help a friend who evidiently has an Apropos rootkit infection.

I have already run the standard Spybot - Search & Destroy and Ad-aware utilities and cleaned up the system. I used HiJackThis and removed suspect items. Norton Antivirus is active and up to date. I also installed Zone Alarm. I still saw lots of very strange programs trying to access the net and if I disabled ZA the pop-ups were back.

I then ran RootkitRevealer and found the General.dll (not exact name, since I'm not on that PC right now) and other 'hidden' stuff all in one main concealed directory. Searching the net I found this indicated an Apropos infection.

I tried a tool I found on the Symantec web site and ran it but it didn't even detect Apropos. I have since realized that even thought Symantec's instructions did not mention it, I should have restarted in Safe mode first.

I've see other posts on this site about Apropos. The fixes required posted (and reposting) lots of HiJackThis logs and logs from a number of other tools. The problem is I'm going away next Tuesday and my friend could NEVER do all this on her own.

Would running Symantec's tool in Safe mode kill at least the 'active' part of Apropos without all the other steps. (Or using the 'other Apropos killer, AproposFix, that I found.) I could then instruct her to keep ZoneAlarm blocking any 'weird' progams and at least 'contain' the problem while I'm away.

I will be on her system tomorrow and can post the HiJack this and Rootkit Revealer logs (and I'll recheck the other posts, and run the other programs that the advisors indicated and post those logs too) but its unlikely I'll be able to follow up more than one more day before I travel. I feel that considering the number of back and forth posts I've seen as replies for other people. This won't be enough.

As part of the steps I've seen in the other threads, I've noted that when one of you advisors analyse the logs, you have specific file names and directories the user has to enter when they run the tools. Perhaps, if you can tell me where in the logs you 'find' the appropriate file names and paths, I can find them for myself. This would eliminate at least one 'round' of posts.

I know this sounds like an invitation to trouble, but I am relatively compent with system analysis and in regards to 'fixing' things (even though this rootkit stuff had me going in circles for quite a bit). I'd just like to 'speed things up' if possible.

By the way, the RootkitReveal showed only a very limited number of 'hidden' files all in one directory, and I think I got rid of all the 'minor' problems with the other utilities and the Hijack this log is pretty much 'normal', so I 'hope' what remains is a relatively 'minor' infection.

--------------
If I can't 'solve' this before my trip, I 'think' I can just have her continue to deny access to any 'new' programs via Zone Alarm and then go through a complete analysis when I get back.
--------------

By the way, thanks for the great work on the responses on this site. You guys are really helping a lot of people with some very difficult problems.

Hope you can help me with this,
Bob

PS
This will sound unsophisticated, but once I 'find' the hidden directory - If I simply deleted the directory, would that 'cripple' the Apropos infection. [Yes, the registry entries would still be there, but without any of the executable and dll files and no access to the internet becasue of ZoneAlarm, could it still 'regenerate' itself?]

[Kimberly]

Hello BobWoofer,

Only the apropos fix or a manual removal are the possibilities to remove it. You will have to work in Safe Mode, nothing will show up in Normal Mode. Everything is random, so I can't tell you what to delete or do before I see a log. The regkey is random, the folder is random and the folder is random.

First thing to try : the Apropos fix. If the log is empty, as in the sample below, a manual removal is required.