Counterspy found Gromozon infection

Discussion in 'malware problems & news' started by J-Mac, Feb 10, 2007.

Thread Status:
Not open for further replies.
  1. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Well, as I sit here currently scraping my machine to remove Gromozon - first infection of any kind in 8 years. Grrrrr.. - I am not overly impressed by Counterspy's reaction. My daily scan flagged it, but then clicking "Remove" indicated that all was OK. I immediately re-scanned while I looked up all I could on Gromozon and sure enough, it was still there. I have since discovered that it takes more than telling Counterspy to remove it to actually get it removed. Yet Counterspy errantly tells you that it is removed. And when I realized I had to do more, I went to the Counterspy site and it explained very briefly what Gromozon is, its only recommendation is "Remove". That would lead a user again to simply use Counterspy's "Remove" option - but that does not work with Gromozon.

    Shouldn't there be a little more warning, along with some instructions to at least steer folks to a site that CAN remove it?

    BTW, updated NOD32 2.7 did not see Gromozon with a full Blackspear setup.
     
  2. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  3. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    Re: Dangerous trojans on the loose

    Very disturbing that both Counterspy and NOD32 2.7 failed to deal with it! The link that Marianna gave to the Prevx removal tool, should take care of it for you, as i know it's worked for everyone i've recommended it to.


    StevieO
     
  4. webster

    webster Registered Member

    Joined:
    Feb 23, 2004
    Posts:
    285
    Location:
    Denmark
  5. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    Re: Dangerous trojans on the loose

    Hi TNT

    If you can give EH the head's up with J-Mac prob but curiously this appeared over at RKR forums todayo_O
    http://forum.sysinternals.com/forum_posts.asp?TID=9910&PN=1

    I will give OP further diagnostic advice but possible F/P if PrevX tool drawing a blank(i will suggest a safe mode run next+RKU report just to rule out etc).

    TIA

    Ade
     
  6. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Re: Dangerous trojans on the loose

    OK, before you posted this, I followed the CastleCops sequence:
    • Downloaded the Symantec and Prevx removal tools

    • Ran an F-Secure online scan - says I'm clean.

    • Downloaded the latest AVG Anti-Spyware scanner and ran it - also says I'm clean

    • Ran the Prevx Gromozon remover - it said that it was not found on my system

    • Ran Counterspy - says I have Gromozon

    Any thoughts? I'm feeling pretty clean, but yet.....

    Thanks.
     
  7. lucas1985

    lucas1985 Retired Moderator

    Joined:
    Nov 9, 2006
    Posts:
    4,047
    Location:
    France, May 1968
    Re: Dangerous trojans on the loose

    I would try with Rootkit Unhooker and SUPERAntiSpyware.
     
  8. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Re: Dangerous trojans on the loose

    I'll think about it Lucas.

    I guess I could just try everything out there...
     
  9. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  10. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Re: Dangerous trojans on the loose

    None of the files mentioned there are on my PC. However the files shown on the Counterspy page differ from those on other pages. (CastleCops, Symantec, etc.)

    Either it changed that fast, or it is a false positive. I'll have to keep on looking.

    Thanks.
     
  11. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    Re: Dangerous trojans on the loose

    Yep F-secure and AVG AS are *blind* to Gromozon rootkit component,if they can't see it then they can't action a removal:oops:

    Maybe if you like follow the instructions given to the OP here>>>
    http://forum.sysinternals.com/forum_...?TID=9910&PN=1

    If these 3 draw blanks with no Gromozon data returned then there is a very high likelyhood that it is a F/p detection by CS.

    HTH:)
     
  12. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Re: Dangerous trojans on the loose

    That link is returning q 404 server error.

    Would the Prevx1 tool also be blind? Plus, why would CastleCops recommend the other two if they can't see it? Weird.

    Thanks.
     
  13. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    Re: Dangerous trojans on the loose

    2nd go at the link:oops:
    http://forum.sysinternals.com/forum_posts.asp?TID=9910&PN=1

    Re :CC removal instructions,pass maybe it is to pick up any non cloaked stuff...

    Re PrevX tool it has not failed me on the few times i have used it but that was when it was first introduced since then i found other tools that could nuke either the infection or the rootkit component :)
     
  14. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Dangerous trojans on the loose

    Did you try to contact Sunbelt?
     
  15. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    Re: Dangerous trojans on the loose

    This info has just been presented over at RKR forums from a member that has been in contact with CS support.

    :thumb:
     
  16. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Dangerous trojans on the loose

    That explains it :D Guess, you are now "relieved" :D
     
  17. J-Mac

    J-Mac Registered Member

    Joined:
    Jun 21, 2006
    Posts:
    99
    Re: Dangerous trojans on the loose

    Yes!!

    Well, not actually - shoot, I'm paranoid now... but not too much! :D

    I'll give it one more run around all the scans and such tonight, and then - if nothing - call it a F/P.

    It does sound like it is an F/P, though. So my eight year infection-free run looks like it is still on. At least I got a pretty good workout on my threat reaction skills!

    Thanks all - great people here!
     
  18. Jerry S

    Jerry S Registered Member

    Joined:
    Jul 30, 2006
    Posts:
    10
    Location:
    Las Cruces NM USA
    +1 on relieved. I got the same FP fron counterspy yesterday. Tnx to fcukdat for the post and tnx to all the others for your info.
    Jerry
     
  19. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
Loading...
Thread Status:
Not open for further replies.