Root kit infection

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by PowerSonic, Mar 10, 2012.

  1. PowerSonic

    PowerSonic Private E-2

    We have a windows 7 32 bit machine which has been infected with a root kit virus. The first clue to the infection was that McAfee Anti Spyware had been disabled even though it is locked down and needs a password to be disabled. We could not re-enable it. Then, looking into services we had hundreds of new services with the description 'New service would allow parents to control their children's online activity', although most were not started. The other noticeable thing is that during shutdown it would hang and have to be powered off. Scanning with the tools requested by majorgeeks before opening this thread revealed a number of root kits which some seemed to have been removed. We can now start McAfee spyware module and the computer now shuts down without hanging. We are still noticing though firefox and IE automatically shutting down within 30 seconds of opening and we are still seeing those hundreds of services when viewing services. Attached are logs requested. When trying to run combofix we had the error "Windows cannot find "NIRKMD". Make sure you typed the name correctly, and then try again." pop up a number of times although it seemed to run successfully and removed infections. Root Repeal we could not get to run. Our McAffe was completely disabled.
    Thanks in advance for your help!
     

    Attached Files:

    PowerSonic, Mar 10, 2012
    #1
  2. PowerSonic

    PowerSonic Private E-2

    The last couple log files ar attached to this post.
    Thanks again,
    Bob
     
    PowerSonic, Mar 10, 2012
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You actually forgot to attach it. Please attach the MGlogs.zip file from MGtools.

    Also run the below scan.

    Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

    For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Option1: Enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    Option2: Enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
    chaslang, Mar 11, 2012
    #3
  4. PowerSonic

    PowerSonic Private E-2

    Here is the FRST.txt and the MGlogs.zip we forgot previously.
    Thanks for your help
     

    Attached Files:

    PowerSonic, Mar 13, 2012
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Download this >> View attachment fixlist.txt


    Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST.exe on your flash drive.
    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • Fixlog.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Mar 14, 2012
    #5
  6. PowerSonic

    PowerSonic Private E-2

    I have uploaded the Fixlog.txt & the MGlogs.zip. The computer seems to be working fine. McAfee is enabled & I connected to the network long enough to update the dats successfully. However, we still have hundreds of services with the description 'New service would allow parents to control their children's online activity'. None of these services show as 'started' but they never did before all the scanning anyway. So, if this computer is now clean how do I remove these services? Thanks in advance
     

    Attached Files:

    PowerSonic, Mar 14, 2012
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Where are you looking to see these? Are you looking in Services.msc?

    Yes I do see many questionable items in your logs for services and also NetSvcs ( see your ComboFix log under the section having the title HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ) , but there is no real easy way for me to tell which are valid and which are non-valid since most of these added items actually use names that are from valid services. The best we may be able to do is remove ones that have no files associated with them but even this is somewhat risky because there are valid services that do not have files associated with them too.

    You could probably run the AutoRuns program by SysInternals to help you identify all of these services having the description you describe above ( highlighted in purple ) and then delete them.

    Running the following may also be of use >> http://www.pandasecurity.com/usa/homeusers/support/card?id=1672&idIdioma=2
     
    Last edited: Mar 15, 2012
    chaslang, Mar 15, 2012
    #7
  8. PowerSonic

    PowerSonic Private E-2

    Yes, that is where I saw the new services in services.msc. That & McAfee disabled is what alerted us to the infection. Before posting to this forum I ran Kapersky's TDSSKiller.exe. It identified about 160 suspicious services but when I chose to delete them the computer would not boot & I had to do a system restore to get it working again.

    I will try the SysInternals AutoRuns program & the PandaSecurity but it is starting to sound like a reload of the OS. I will get back to you. Thanks
     
    PowerSonic, Mar 16, 2012
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Let me know how it goes. If you get to the point where you are considering a reinstall, before you do that we can try as a last resort to perform some steps with our cleaning tools to remove many of these bad drivers and services. We may or may not succeed in removing them without making the PC unbootable, but if you were at the point of a reinstall anyway, it would not matter and may serve to better help understand these types of infections which are happening frequently now in the last week or so.
     
    chaslang, Mar 16, 2012
    #9
  10. PowerSonic

    PowerSonic Private E-2

    I ran the Panda yorkyt.exe which found the services & said it had cleaned the infection but the services are still there. I have tried uploading the log but I am not having any luck.
    Then I used AutoRuns to identify the suspicious services & delete them but the services are still there.
    So unless you have some other tools we can try we are at the point of re-installing the OS.

    Thanks for all your help!
     
    PowerSonic, Mar 20, 2012
    #10
  11. PowerSonic

    PowerSonic Private E-2

    I ran the Panda yorkyt.exe which found the services & said it had cleaned the infection but the services are still there. I have uploaded the log.
    Then I used AutoRuns to identify the suspicious services & delete them but the services are still there.
    So unless you have some other tools we can try we are at the point of re-installing the OS.

    Thanks for all your help!
     

    Attached Files:

    PowerSonic, Mar 20, 2012
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    We can attempt to delete them using tools like ComboFix, Avenger, or OTL. Would you like to attempt doing this? If yes, I suggest first backing up important data just to be safe if something goes wrong.
     
    chaslang, Mar 21, 2012
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds