NYB-F rootkit found- ran thru ReadMe, still there

RogerN · Dec 28, 2014

Hello -

I have an XP I need to revive and retrieve a lot of templates from - Avast reported the NYB-F rootkit, and HitMan indicated two threats.

I went through the Readme, did the steps for XPs. I get the same malware message from Avast on startup (NYB-F rootkit found), and now a warning from HitManPro about two threats.

After reading the stickies, I know I need to dump or upgrade this OS, but I need those files.

Any assistance is appreciated. logs attached.

gracias -

RogerN

Kestrel13! · Dec 28, 2014

Uninstall these! You've more than one antivirus installed...

Ad-Aware Antivirus

AdAwareUpdater

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[HJ.FileAsso] HKEY_USERS\.DEFAULT\Software\Classes\.exe\shell\open\command | (default) : "C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe" /START "%1" %* -> Found

[HJ.FileAsso] HKEY_USERS\S-1-5-18\Software\Classes\.exe\shell\open\command | (default) : "C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe" /START "%1" %* -> Found

[HJ.FileAsso] HKEY_USERS\.DEFAULT\Software\Classes\.exe | (default) : secfile -> Found

[HJ.FileAsso] HKEY_USERS\S-1-5-18\Software\Classes\.exe | (default) : secfile -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run TDSSKiller and have it remove what it finds fault with.

18:46:23.0015 0x0a6c \Device\Harddisk0\DR0 ( HEUR:Rootkit.Boot.BackBoot.gen ) - skipped by user
18:46:23.0015 0x0a6c \Device\Harddisk0\DR0 ( HEUR:Rootkit.Boot.BackBoot.gen ) - User select action: Skip
Click to expand...

Re run Hitman and have it remove all it finds.

Now re run RogueKiller (just a scan) and attach that log too please.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!

RogerN · Dec 28, 2014

Removed those AV apps, rebooted, and RK prompted me for an update, which I did, now the registry doesn't show those four registry entries..... I think I did something wrong... Should I rerun a report?

- Thanks

Kestrel13! · Dec 29, 2014

Yes, if they don't show then just attach a new log from a scan, and attach everything else I asked for please.

RogerN · Dec 31, 2014

ok, I didn't get a RKreort[2].txt file, but I generated the RK report, RKreport_SCN_12302014_023816.log. hope that works.

Hitman found the NYB.A, but I only had the option to 'Ignore'. So, I hit Next, without any action. dang!

I am attaching the four logs. thank you Kestrel13!

Kestrel13! · Dec 31, 2014

We will need to boot to the Recovery Console to remove this infection.

Now boot to the Recovery Console and run the fixmbr to clear a Master Boot Record infection that you have.

You can read the below to help you do this:

http://support.microsoft.com/kb/307654

After running the fixmbr command and boot back to normal mode, continue with the below.

Re run a scan with Hitman and attach log. I want to see if that cleared it or not.

RogerN · Jan 1, 2015

HI Kestrel -

The Recovery Console already in my startup failed; it recommended contacting technical support, with an error code 0xA; 0; 0; 0;

After fumbling about, I found an XP install disk. It probably wasn't the original, as this is a Compaq Presario....

launching with this XP disk, I am at the Recovery Console; i launched fixmbr- it says:

** CAUTION **

This computer appears to have a non-standard or invalid master boot record.

FIXMBR may damage your partition tables if you proceed.

This could cause all the partitions on the current hard disk to become inaccessible.

If you are not having problems accessing your drive, do not continue.

Are you sure you want to write a new MBR?

I'm not sure, so I say 'no'.

I dig up my Compac Recovery CD, thinking it would have the Recovery Console, but no, it wants to reinstall the OS. My apps would require re installation, but the data will survive. I was hoping not to have to do that.

Is FixMBR safe in this circumstance, or do I go with Compaq's Recovery, or is there a better way?

Kestrel13! · Jan 1, 2015

I am consulting with colleagues, hang in there. And Happy New Year!

Kestrel13! · Jan 1, 2015

Do this in the mean time:

Please download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it.

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply.

RogerN · Jan 2, 2015

Hi Kestrel - I've attached the scan. The timestamp is wrong, cause I haven't reset the pc clock, but it just finished.

For what it's worth, I have a Bart PE boot cd, Paragon Rescue 8.5 boot, and Hiren's boot cd 14.1. maybe one of those would help... maybe not..

thanks so much!

Kestrel13! · Jan 2, 2015

Reopen aswMBR and click [FixMBR].
Note: You may have to [Scan] first in order for this button to appear.

Then rescan with both aswMBR and Hitman Pro and attach logs.

RogerN · Jan 4, 2015

Hi Kestrel -

That took me a bit, the aswMBR warning made me nervous, so I got a cheap external drive, and made a backup. A Tb for $68! crazy.

I ran the scans, and two logs attached. Hitman sez "Filezilla" is suspicious; I can delete that in a heartbeat.... I removed it from the backup.

Thanks, and have a great day!

RogerN · Jan 5, 2015

whoops, no attachments.

trying again.

Kestrel13! · Jan 5, 2015

That's an EXCELLENT price!! Well done! OK, no more problems being found now, ready for final steps?

RogerN · Jan 5, 2015

No more issues? yah, super!! I am definitely ready.

Kestrel13! · Jan 6, 2015

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

NYB-F rootkit found- ran thru ReadMe, still there

RogerN Private E-2

Attached Files:

RKreport_SCN_12172014_155813.log

malware Bytes log.txt

TDSSKiller.3.0.0.42_17.12.2014_18.39.11_log.txt

HitmanPro_20141218_0316.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Attached Files:

RKreport_SCN_12282014_185554.log

HitmanPro_20141230_0229.log

RKreport_SCN_12302014_023816.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Attached Files:

aswMBR.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

RogerN Private E-2

Attached Files:

aswMBR.txt

HitmanPro_20150104_0938.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

NYB-F rootkit found- ran thru ReadMe, still there

RogerN Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

RogerN Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RogerN Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches