Rootrepeal Crashes Computer Immediately

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Percy00, Jul 10, 2010.

  1. Percy00

    Percy00 Private E-2

    I'm following the procedures at [thread=35407]READ & RUN ME FIRST. Malware Removal Guide[/thread], and I've gotten to the point where I'm following the steps in [thread=139313]Windows XP Cleaning Procedure[/thread].

    My problem is with the RootRepeal step. I'm following the instructions in [thread=191900]Running RootRepeal[/thread], and RootRepeal crashes my computer immediately every time with a blue screen. The instructions at http://rootrepeal.googlepages.com/ say to try varying the "Disk Access Level" setting, but I've tried all levels with the same result every time.

    The error indication from the blue screen that I thought might be useful was:

    DRIVER_IRQL_NOT_LESS_OR_EQUAL

    Near the bottom it mentioned "raid", and my main drive *is* a raid drive.

    If it helps, I've attached the logs of the other programs I've run so far: SuperAntiSpyware, MalwareBytes, and ComboFix.

    --Percy
     

    Attached Files:

  2. Percy00

    Percy00 Private E-2

    I discovered two other anti-rootkit programs: Sophos and Panda.

    Sophos found only a single file from Symantec: symlcrst.dll. I think it's harmless.

    Panda's in-depth search found nothing.

    Is this sufficient to establish that there are no root kits on my machine, or is RootRepeal the only way to be sure?

    In case it's helpful to know why I'm trying to clean my system, I'm not experiencing any problems with my machine, but my webhost was taken over by hackers last week and I'm trying to close all security holes. The hackers had access to all files on the webhost, including logs, which means they could look have discovered the IP address for my development machine. I need to make sure they haven't installed a root kit that might let them find out account names and passwords on my webhost. I don't think it would be safe to resume work on the webhost until I make sure about this.

    --Percy
     
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We still need to check your C:\MGLogs.zip.

    However:

    Problems like this are really more of a vulnerability issue and not truly malware. How people write their website code, how old/unupdated the software they write it with, and how secure the servers that host it are really the areas to look at. Issues here are commonly referred to as code injection ( see: http://en.wikipedia.org/wiki/Code_injection ) The things we do in this forum are not going to find problems in your code. None of these malware scanners will since they are not design for this purpose.

    You are going to need to have a very good webpage developer check the code for security issues and you need to verify that all software being used has been updated to include all security patches. In addition, you need to make sure that the server hosting the website also has been fully updated.

    Also since you stated it has been previously hacked, you should attempt to find out how it was hacked last time so you can verify that they security issues have been resolved.
     
  4. Percy00

    Percy00 Private E-2

    Hi Tim,

    The hackers entered the web host via code injection using my own CGI code, I'm a chastened and much more humble programmer now, but they then managed to stay one step ahead of me for the next week and eventually completely compromised the server - I had it reinitialized and reinstalled.

    I don't want to underestimate them again, so that's why I'm going what probably seems a bit overboard by checking the integrity of my development machine. The web hosting company I use says that they have seen password sniffers installed on development machines that connect to web hosts.

    I've sewed up all the security holes I could find in my software on the web host, and I continue to research the issue. Thanks for the reference to the Google article, I'll take a look.

    I've attached the MGLogs.zip file.

    Do I still need to somehow get RootReveal to run, or do you think Sophos and Panda are sufficient?

    --Percy
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing anything out of the ordinary in your logs. I will suggest that you clean out these folders:
    C:\Documents and Settings\Ted\Local Settings\Temp\
    C:\TEMP\

    I will further suggest that you uninstall Limewire and not use any P2P software on this machine.

    Your logs are clean, so If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:

     
  6. Percy00

    Percy00 Private E-2

    I looked up this old thread to help me recall some information and discovered I never said thank you for all the help. Back in 2010 the hackers returned in a 2nd wave and then a 3rd, so I must just have been very busy. So thank you!

    --Percy
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are welcome.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds