Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Jan 18, 2007 | Updated Aug 27, 2013

Win32/Rustock

Detected by Microsoft Defender Antivirus

Aliases: Spam-Mailbot.c!Rootkit (McAfee) Backdoor.Rustock (Sunbelt Software) Backdoor.Rustock (Symantec)

Summary

Win32/Rustock is a multi-component family of rootkit-enabled backdoor trojans, which were historically developed to aid in the distribution of 'spam' e-mail. First discovered sometime in early 2006, Rustock has evolved to become a prevalent and pervasive threat. Recent variants appear to be associated with the incidence of rogue security programs.
To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Additional recovery instructions
This threat uses stealth, and you may need to boot to a trusted environment in order to remove it. The threat may also make changes to your computer that makes it difficult for you to download, install or update your virus protection, whether you have a complete antivirus such as Microsoft Security Essentials installed on your computer or not.

If you suspect your computer has been compromised, we recommend using the Windows Defender Offline to detect and remove this threat.

Using Windows Defender Offline

The way Windows Defender Offline works, is by allowing you to:

  • Download a copy of the tool from a computer that has access to the internet
  • Save a copy of the recovery tool to a removable drive, in order to create bootable media
  • Run the recovery tool on a compromised computer

You might want to use Windows Defender Offline when:

  • You need to scan your computer to check for rootkits and other malware
  • You are infected with malware that prevents you from downloading and installing an antivirus or the latest updates for your antivirus software
  • Your antivirus does not detect or remove advanced malware, such as a rootkit

Note: Windows Defender Offline is not a replacement for a full antivirus solution providing ongoing protection; it is meant to be used in situations where you cannot start or otherwise effectively scan your infected computer due to a virus or other malware actively running on the computer and impeding the effective action of antimalware software. For no-cost, real-time protection that helps guard your home or small business computers against viruses, spyware, and other malicious software, download Microsoft Security Essentials.

  1. Determine if you require the 32-bit or 64-bit download.

    See the Microsoft Help and Support article for instructions on how to determine whether a computer is running a 32-bit version or 64-bit architecture of the Windows operating system.
  2. Using a computer that can connect to the internet, download the version of the Windows Defender Offline that applies to the affected computer.

    If the affected computer is a:

    - 32-bit computer, then download the 32-bit version here.
    - 64-bit computer, then download the 64-bit version here.

    Note: In order for the recovery tool to be effective, make sure you download the version that matches the architecture of the affected computer. For example, if your 64-bit desktop is affected, you will need to download the 64-bit version of the Windows Defender Offline and save it to a removable drive.
  3. Save the downloaded file to a local drive on your computer.
  4. Launch the downloaded file, and create a bootable device by following the instructions on the wizard.

    Note: We recommend creating a bootable USB or CD; if you create a bootable USB, this can be updated for future use.
  5. From the affected computer, boot from the USB or CD you created in step 4.

    Note: You may need to set the boot order in the BIOS to do this. This will be device specific, so if you are unsure, refer to your system manual or manufacturer.
  6. Follow the prompts to run a full system scan.

    Depending on the outcome of the scan, your next steps will vary. Follow the prompts from Windows Defender Offline to manage any threat detections.

Steps you can take once your computer has been cleaned

  • Install security software, such as Microsoft Security Essentials, or other products that provide a complete, real-time antivirus solution.
  • Keep your antivirus up to date by making sure you have the latest definitions.
  • Use the Microsoft Safety Scanner if you suspect you are infected but are unable to confirm this with your existing antivirus solution.
Follow us