Trojan.Kotver!bat infection

zambini
New Helpee

Posts: 7

Trojan.Kotver!bat infection Mar 13, 2017 19:02:38 GMT -8

Quote

Post by zambini on Mar 13, 2017 19:02:38 GMT -8

Hello

Norton has advised me that I have been infected with the Trojan.Kotver!bat again. Would really appreciate your help in removing this problem from my computer.

Attached are the wikisend.com addresses for the FRST.txt and addition.txt files.

wikisend.com/download/334600/FRST.txt

wikisend.com/download/491848/Addition.txt

Thank you in advance for any help you can give me.

Zambini

dbrisen
Malware Removalists

Posts: 3,688

Trojan.Kotver!bat infection Mar 13, 2017 22:47:58 GMT -8

Quote

Post by dbrisen on Mar 13, 2017 22:47:58 GMT -8

I'm not seeing any infection signs in your logs. Let's check with this scanner to be sure.

Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt .

[/ul]

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

zambini
New Helpee

Posts: 7

Trojan.Kotver!bat infection Mar 14, 2017 10:32:27 GMT -8

Quote

Post by zambini on Mar 14, 2017 10:32:27 GMT -8

I have done as you directed. The address for the system-log.txt is as follows

wikisend.com/download/967076/system-log.txt.

The mbar-log.txt would not upload to wikisend so here is what the file said:

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
main: v2017.03.14.07
rootkit: v2017.03.11.01

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Steve :: STEVE-PC [administrator]

3/14/2017 1:45:54 PM
mbar-log-2017-03-14 (13-45-54).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 407038
Time elapsed: 28 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

I hope that was what you needed. If not let me know.

Thank you for your help and I apologize if this was a waste of your time due to Norton's error.

Will be waiting to hear if the computer has a clean bill of health.

zambini

dbrisen
Malware Removalists

Posts: 3,688

Trojan.Kotver!bat infection Mar 15, 2017 7:04:27 GMT -8

Quote

Post by dbrisen on Mar 15, 2017 7:04:27 GMT -8

I've seen this in other user's systems lately; I believe that Norton does remove the infection but "gets stuck" in telling itself that the problem is fixed. Your logs show no sign of infection, so that is a good sign.

Please see if the steps in this Symantec KB article here fixes the issue.

Last Edit: Mar 15, 2017 7:05:28 GMT -8 by dbrisen

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

zambini New Helpee Posts: 7	Trojan.Kotver!bat infection Mar 15, 2017 8:36:48 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by zambini on Mar 15, 2017 8:36:48 GMT -8 I have followed the directions in the link that you provided and I think that Norton is now satisfied. I have received no further notifications of problems. zambini

Trojan.Kotver!bat infection

Post by zambini on Mar 13, 2017 19:02:38 GMT -8

Post by dbrisen on Mar 13, 2017 22:47:58 GMT -8

Post by zambini on Mar 14, 2017 10:32:27 GMT -8

Post by dbrisen on Mar 15, 2017 7:04:27 GMT -8

Post by zambini on Mar 15, 2017 8:36:48 GMT -8