Internetworkers: http://www.ibiblio.org/internetworkers/

[David Matusiak <dave AT matusiak.org>]

Hi Judy,

I hope this link works:
http://www.symantec.com/security_response/writeup.jsp?docid=2002-011710-0057-99

That is a search of the A/V database at Symantec and their response to
hacktool.rootkit (no results found for 'oaannf.sys').  There is also a
tab on Removal where at the end they recommend you do all the steps in
Safe Mode.  Since you've already been round 4 times the A/V scan
circle, I would start in Safe Mode and perform the removal steps.

The Symantec page lists this as a Risk Level 1: Very Low Threat.  I
hope that is the case and that the removal steps finally work.
However malware is being packed together these days and the oaannf.sys
was the file it identified.  No mention of the other files it
cannot/did not recognize.

Personally, for most system infections that are bad (especially if
they involve the word 'rootkit') I tend to rebuild the system and
restore known safe data.  Good luck with your remediation efforts!
Also, try Malware Bytes (free) because it is awesome!

David M.


On Tue, Aug 31, 2010 at 1:40 PM, hallman <hallman AT email.unc.edu> wrote:
>
> I've been having problems with my computer and have run Symantec several
> times. The last 4 complete scans all show the same result -- file
> oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
> successfully -- the file is in WINDOWS\system32\drivers.
>
> If the file was repaired successfully, why does it show up again the next
> time I scan?
>
> I tried scanning with ThreatFire and it doesn't see any problems.
>
> What do you think? Is my machine still infected?
>
> My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
> Version 11.0.6005.562, definitions Monday, August 30 r2.
>
> Judy