Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

I've found myself stuck with a keylogger that my firewall keeps reporting on startup/shutdown as attempting communication to a remote host. The virus itself is listed as Trojan.Spyeye.AA, which is a keylogger and backdoor trojan.

The documentation I've seen online suggests most antivirus programs and antimalware can find and remove this automatically. However none of the programs I've tried have found it. This includes Corporate Symantec Endpoint Protection, ClamAV, Windows Defender (installed for the purpose of seeing if it could find and remove), SpyDLL, Malwarebytes Anti-Malware, and Spybot S&D. However I know it's still there because every time I do a test connection and restart, the firewall records the attempted communication. It is at least partially getting through as it blocks six requests total, three outbound and three inbound, initiated from inbound.

The virus itself hides using rootkit tricks, so there's no taskmanager entries, no files to see, and all of that fun. But now it's spread to another machine.

EDIT: Turns out this was the result of a known problem with the gateway antivirus returning false positives from valid traffic. The system suddenly started reporting the ipads in-house had the same problem, and after contacting them it was confirmed as false positives.

share|improve this question

marked as duplicate by Dave M, studiohack Jun 17 '11 at 14:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

2 Answers 2

Have you tried installing MalwareBytes, update all the virus definitions, restart the machine and put into Safe mode (No Networking) and then run and deep scan.

I would repeat the above process at least 3 times, otherwise backup data and restore/re-install windows

share|improve this answer
    
I did run Malwarebytes and Symantec while in safe mode and they didn't find anything; however once the machine is out of an attempted system restore I will repeat those attempts again, especially with the tools mentioned above. –  MedTechDeveloper Jun 17 '11 at 14:58
add comment

I would also try combofix and Hitman Pro. Both have solved problems for me that others could not.

http://www.bleepingcomputer.com/download/anti-virus/combofix

http://download.cnet.com/1770-20_4-0.html?query=hitman+pro&platformSelect=Windows&tag=srch&searchtype=downloads&filterName=platform%3DWindows&filter=platform%3DWindows

share|improve this answer
    
Thanks, I will give those a shot and see what they find. –  MedTechDeveloper Jun 17 '11 at 14:58
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.