Security Stronghold security made easy

How to Remove Rustok Trojan

Trojans is one of the most wide-spread threat in the internet. They can spread in lot of ways (torrents, e-mail attachments, video codecs etc.). Rustok Trojan as well as any other trojan can harm your PC in different ways. Originally, trojans stole just your e-mail contacts and some personal data. Nowadays, they can steal any type of private information, being serious threat. In this tutorial we will show how to deal with Rustok Trojan detect and remove it from your PC.

Choose option :

* Rustok Trojan description and technical details.

* Manual removal of Rustok Trojanl.

* Download tool that will solve your problem automatically.

* Professional support that will help you remove Rustok Trojan from our Security Support Team.

Rustok Trojan is weep your computer when user unknowingly install the creation when they install something else. However, while this software is almost always unwelcome, it can be used in some samples for tracing in conjunction with an investigation and in accordance with organizational policy. Rustok Trojan gets on a PC through deceit of the user or through exploiting of software vulnerabilities, so, you ought to to remove Rustok Trojan as soon as possible. Customary, Rustok Trojan wormy computer does not pass the infection to other computers. But this doesn't force Rustok Trojan less ill-intentioned than viruses and its necessity to remove Rustok Trojan less emergent. IE program also helps to make attachments for Rustok Trojan in the form of BHOs making pressing dure necessity in Rustok Trojan removal tool. Rustok Trojan is hardly alone on wormy machine that defines necessity to remove Rustok Trojan and other types of malicious programs.


Threat indicator: HIGH

Trojan's detail table

Trojan alias:

Executable file:

Threat class:

Affected OS:

Rustok Trojan

*

Trojan

Win32 (Windows 9x, Windows XP, Windows Vista, Windows Seven)



Rustok Trojan infiltration

As we already said there numerous ways trojan can get to your PC from the internet. Rustok Trojan copies its file(s) to your hard disk. File name typical to Rustok Trojan is * . Then it runs itself and creates new startup key in registry with name Rustok Trojan and value * . If you will look into running processes list you will see some extra process with name like * or any random name that uses decent amount of your CPU.

If you would like to remove Rustok Trojan use WiperSoft Antispyware Malware Remediation Tool (see below)

Automatic Trojan Removal

So what is Rustok Trojan Removal Tool? Basically, it is the tool that will remove every file and registry key that was created by Rustok Trojan. It was created after analyzing all versions and types of this threat on test PCs and every file and key was added to the database. Removal Tool is updated regularly to make sure it can remove latest versions of Rustok Trojan:

Download WiperSoft Antispyware to remove Rustok Trojan

* WiperSoft Antispyware was developed to remove threats like Rustok Trojan in automatic mode. Remover has active module to protect PC from hijackers, trojans, ransomware and other viruses. Trial version of Wipersoft provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Wipersoft.

How to remove Rustok Trojan manually?

During all time since adding Rustok Trojan to our database we track it changes and add them in the list below, removing files mentioned from your hard drive and deleting them from starup list and also unregistering all corresponding DLLs will result cleaning your computer drom the trojan. But also, missing DLL's that can be removed or corrupted by Rustok Trojan should be restored from your Windows CD .

So, here is the simple process to remove Rustok Trojan:

1. Delete following processes form startup and files from your hard drive:

  • winsp2.exe

2. Delete the following folders that are assosiated with Rustok Trojan:

no information

3. Finally, remove this registry keys:

no information

Warning: Sometimes, trojan can use system file names or randomly generated names for its executable. We recommend you to use WiperSoft Antispyware Malware Remediation Tool for safe problem solution.

If you are already our customer or you have additional questions ask our support team for help in removing Rustok Trojan!

Let our support team solve your problem with Rustok Trojan and remove Rustok Trojan right now!

support person

Submit support ticket below and describe your problem with Rustok Trojan. Support team will offer you solution in several minutes and give a step-by-step instruction on how to remove Rustok Trojan. Trouble-free tech support with over 10 years experience removing malware.


Submit support ticket


Write a few words of how you got Rustok Trojan with all circunstances in the form below. Our support team open support ticket for you in an hour and we will start solving your problem with Rustok Trojan. Attach suspicious files that you see that possibly a part of Rustok Trojan.

Click to ask professional of Rustok Trojan solution

Describe your problem here and we'll contact you in several minutes:

We'll reply you in 10 minutes or less
* Your Name:
* Your E-mail:
* Problem summary:
* Detailed description:
Attach suspicious file:
Here you can attach file you suspect to be virus or source of problem. If you want to attach several files, put them into one archive and attach it instead.

Click on this button to submit request.

Solution guaranteed!

 

It is important:

  1. We hate spam as much as you do. We will not share your email with any third party or publish it anywhere. Your email is used only to contact you and give you Rustok Trojan removal solution.
  2. All fields of this form are obligatory.

Here are the descriptions of problems connected with Rustok Trojan and * we received earlier:

Problem Summary: Trojan/Rustock-N

Trojan/Rustock-N

Problem was successfully solved. Ticket was closed.

Problem Summary: xw

sww

Problem was successfully solved. Ticket was closed.

Problem Summary: The rustok trojan needs to go

Get it off

Problem was successfully solved. Ticket was closed.

Problem Summary: cant view movies, videos, etc....

My computer was recently infected with virus and ever since im no longer able to view movies or videos online the movie pages wont even 100% load up anymore. Any help you can offer would be greatly appreiciated because im extremely frustrated and out of ideas tried everything. ThankYou!







Problem was successfully solved. Ticket was closed.

Problem Summary: cant view movies, videos, etc....

My computer was recently infected with virus and ever since im no longer able to view movies or videos online the movie pages wont even 100% load up anymore. Any help you can offer would be greatly appreiciated because im extremely frustrated and out of ideas tried everything. ThankYou!







Problem was successfully solved. Ticket was closed.

Problem Summary: I have this what I thin is a virus here it is

SmitFraudFix v2.423

Scan done at 2:19:50.23, Fri 10/07/2009
Run from C:\Documents and Settings\DCCStudent\Application Data\IDM\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Novell\XTAgent.exe
c:\Program Files\Fingerprint Sensor\AtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\AccelerometerSt.Exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dpmw32.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\!Stuff!\Internet Download Manager\IDMan.exe
C:\Documents and Settings\DCCStudent\Application Data\IDM\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\setup2.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\DCCStudent


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DCCSTU~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\DCCStudent\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DCCSTU~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"="ziswin.exe"




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

Description: Marvell Yukon 88E8072 PCI-E Gigabit Ethernet Controller - Packet Scheduler Miniport
DNS Server Search Order: 85.255.112.187
DNS Server Search Order: 85.255.112.208

Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

Description: Intel(R) Wireless WiFi Link 5100 - Packet Scheduler Miniport
DNS Server Search Order: 85.255.112.187
DNS Server Search Order: 85.255.112.208

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1F43DD60-78AA-446C-AC24-B11DB4D7A148}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1F43DD60-78AA-446C-AC24-B11DB4D7A148}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1F43DD60-78AA-446C-AC24-B11DB4D7A148}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9D9573A3-EC4B-41AE-BD50-9D61859C4639}: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.187,85.255.112.208
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=198.142.0.51 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.187,85.255.112.208


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Problem was successfully solved. Ticket was closed.

Problem Summary: websites say infected with rustock-n, Cannot update mcafee, redirects search engine links, pop-ups, system freezes, cannot visit antivirus websites

Mcafee won't update saying I must reinstall the suite. Websites say im infected with rustock-n and it recomends a fake antivirus program, google and yahoo links redirect me to sites like coolberg and yellowbook. I cannot visit or antivirus websites. I cannot download antivirus software. I also get annoying popups. I also get this vista window style popup on ie (im on xp) saying i must give windows permision to download important updates(i know it is fake). I also deleted a file "setup2.exe" which i am sure is connected to the file b/c deleting it stopped fake antivirus boxes from popping up. I need help!

Problem was successfully solved. Ticket was closed.

Problem Summary: Rustok-N

I need instructions on how to manually remove this trogan. It has caused my antivirus and antispyware to not function. And I can't get any free ones online to update. Nothing does, not even my current version I use. Please help. I have gone from 23 spyware to 978 in one hour from this trogan!!!

Problem was successfully solved. Ticket was closed.

Problem Summary: I have a trojan rustok n and winbluesoft infection

I have defender pro 2009 as an anti-virus and i have malwarebytes. I went to a web site and it said i was infected with trojan rustok n. i ran a scan with defender pro and it didnt catch it. i tried to run malwarebytes and i wont start up. how can i get rid of this trojan. im a computer novice.

Problem was successfully solved. Ticket was closed.

Problem Summary: help with 'Troj/Rustok-N'

Your computer (IP: 70.118.122.251) generates an attacking DOS requests at our servers. This attack was provoked by the spyware/virus named 'Troj/Rustok-N'

HELP! I read a symantec post about how this can be complicated... somthing about starting in safe mode...???

Problem was successfully solved. Ticket was closed.

Show more

 

Next threat: RXToolbar »

« Back to catalog

Home | Partners | Shop | Support | Terms of use | Contact Us | Privacy Policy | Sitemap

Copyright © 2024 Security Stronghold. All Rights Reserved. All content on this website is protected and belongs to Security Stronghold LLC.