Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Jun 15, 2005 | Updated Sep 15, 2017

Backdoor:Win32/Samsteal.A

Detected by Microsoft Defender Antivirus

Aliases: BackDoor-CST (McAfee) Trojan.Maroot (Symantec)

Summary

Backdoor:Win32/Samsteal.A is a backdoor Trojan that targets certain versions of Microsoft Windows. This Trojan collects data from a computer and can release the data to other computers using a backdoor, e-mail, and other file exchange methods. It is dropped by Backdoor:Win32/Samsteal.A.dr.
To manually recover from infection by Backdoor:Win32/Samsteal.A, follow these steps:
  1. Disconnect from the Internet.
  2. Remove the Trojan services.
  3. Delete the Trojan registry entry.
  4. Delete the Trojan driver.
  5. Restart your computer.
  6. Delete the Trojan folder and its contents.
  7. Take steps to prevent re-infection.

Disconnect from the Internet

To help ensure that your computer is not actively infecting other computers, disconnect it from the Internet before proceeding. Print this Web page or save a copy on your computer; then unplug your network cable and disable your wireless connection. You can reconnect to the Internet after completing these steps.

Remove the Trojan services

To remove the Trojan services on Windows 9x
  1. On the Start menu, click Run.
  2. Type regedit and click OK.
  3. In the left pane, navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion\RunServices\VirtualMGR
  4. Right-click the key and click Delete.
  5. Click Yes to confirm the deletion.
  6. Close the Registry Editor.
To remove the Trojan services on Windows operating systems later than Windows 9x
  1. On the Start menu, click Settings, then click Control Panel.
  2. Double-click Administrative Tools.
  3. Double-click Services.
  4. Right-click the service called VirtualMGR.
  5. If the service is running, click Stop.
  6. Right-click the service again and click Properties.
  7. Under Startup Type, change the type to Disabled.
  8. Right-click the service called mac128.
  9. If the service is running, click Stop.
  10. Right-click the service again and click Properties.
  11. Under Startup Type, change the type to Disabled.

Delete the Trojan registry entry

This step is necessary on computers running Windows operating systems later than Windows 9x. 
To delete the Trojan registry entry
  1. On the Start menu, click Run.
  2. Type regedit and click OK.
  3. In the left pane, navigate to the key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VirtualMGR
  4. Right-click the key and click Delete.
  5. Click Yes to confirm the deletion.
  6. Close the Registry Editor.

Delete the Trojan driver

To delete the Trojan driver 
  1. Click Start, and click Run.
  2. In the Open field, type <system folder>\drivers, for example C:\Windows\system32\drivers
  3. Click OK.
  4. Click Name to sort files by name.
  5. If mac128.sys is in the list, delete it.
  6. On the Desktop, right-click the Recycle Bin and click Empty Recycle Bin.
  7. Click Yes.
If deleting the file fails, follow these steps to verify that the file is not running:
  1. Press CTRL+ALT+DEL once and click Task Manager.
  2. Click Processes and click Image Name to sort the running processes by name.
  3. Confirm that mac128 is not in the list.

Restart your computer

To restart your computer
  1. On the Start menu, click Shut Down.
  2. Select Restart from the drop-down list and click OK.

Delete the Trojan folder and its contents

To delete the Trojan folder and its contents
  1. Open Windows File Explorer.
  2. Navigate to the folder %windir%\VirtualMGR, for example, C:\Windows\VirtualMGR.
  3. Right-click the folder and click Delete.
  4. Click Yes to confirm the deletion of the folder and its contents.

Take steps to prevent re-infection

Do not reconnect your computer to the Internet until the computer is protected from re-infection. See the "Preventing Infection" section for more information.
Follow us