Trojan lodged in tcp/ip stack

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by MeitHed, Jun 7, 2012.

  1. MeitHed

    MeitHed Specialist

    Hello.

    A friend asked me to have a look at his PC as he was no longer able to access the internets. Malwarebytes and super-antispyware were both semi effective in finding and cleaning some of the troublemakers, but still no net. I ran through the process, with combofix finding the tcp/ip stack thing. Rootrepeal finds only hyberfil.sys.

    Logs are attached.

    Thank you in advance for your time and effort.
     

    Attached Files:

  2. MeitHed

    MeitHed Specialist

    Here is the Root Repeal log
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You have some required Windows files that having been deleted/corrupted. Also the registry has been modified. Both of these are why you cannot access the internet.

    We need to run a couple additional scans before getting started.



    Goto the below link and follow the instructions for running TDSSKiller from Kaspersky
    • Be sure to attach your log from TDSSKiller
    Now please also download MBRCheck to your desktop.


    See the download links under this icon [​IMG]
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

    Now please download Farbar Service Scanner and run it on the computer with the issue.
    • Put a check mark in each option box on the left side.
    • Click "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please attach this log to your next reply.
     
  4. MeitHed

    MeitHed Specialist

    Thank you much Chaslang.

    Here are the reports from those programs.
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    1. Go to Start ==> Run (or Windows key+R)
      • Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
        (note that there is space after notepad)
      • The above file will open in the notepad.
      • Under TCP/IP Primary Install section find the following: Characteristics = 0xA0
      • Edit 0xA0 and replace it with 0x80 (replace A with 8)
      • Under File menu click Save and close the notepad.
    2. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
      • On the General tab, click Install a popup window opens.
      • Select Protocol from the list and then click Add.
      • A new window opens, click Have Disk....
      • In the browse... box type c:\windows\inf
      • Click OK.
      • Select Internet Protocol (TCP/IP), and then click OK.
      • On the Local Area Connection Properties screen select Internet Protocol (TCP/IP) and click Uninstall, and then click Yes.
      • Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
    3. Go to Start ==> Run (or Windows key+R)
      • Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
        (note that there is space after notepad)
      • A file opens in the notepad. Under TCP/IP Primary Install section find the following: Characteristics = 0x80
      • Edit 0x80 and replace it with 0xA0 (replace 8 with A)
      • Under File menu click Save and close the notepad.
    4. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
      • On the General tab, click Install
      • A popup window opens. Select Protocol.
      • A new popup window opens. Select Internet Protocol (TCP/IP), and then click OK.
      • Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
    5. After restart please run Farbar Service Scanner again and save the fss.txt log to attach below.
    6. Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


      Then attach the below logs:
      • the new fss.txt log from Farbar's Service Scanner
      • C:\MGlogs.zip
     
  6. MeitHed

    MeitHed Specialist

    Thank you. Logs are attached.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That looks much better. Are you still having any problems? If so, exactly what?
     
  8. MeitHed

    MeitHed Specialist

    Thanks, I am still unable to connect to the internet.

    It says I am connected, but I cannot reach any websites in either IE or Chrome.
     
  9. MeitHed

    MeitHed Specialist

    Also after a restart I am getting an error:

    RUNDLL
    Error in C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCJtime.doo
    Missing entry:RunDLLEntry
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Instread of putting www.google.com in your browser, try the IP address instead: 173.194.78.103

    Does that connect you?
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I assume you meant LXCJtime.dll ?

    This is a printer software driver issue. You may need to reinstall the software for the printer.
     
  12. MeitHed

    MeitHed Specialist

    Thank you again Chaslang.

    Typing in the IP Address did the trick, but I am unable to navigate beyond there.

    Yes, I meant DLL.. sorry.
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please run C:\MGtools\FixNet.bat

    This will run a few commands and then reboot your computer.

    After your computer reboots, see if there is any changed to your ability to connect via DNS names.
     
  14. MeitHed

    MeitHed Specialist

    No joy. I am still unable to connect via DNS names.

    I thank you for your continued assistance.
     
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Repair MSI (Windows Installer)
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished. If it does not then reboot yourself.

    Any change for the better?
     
  16. MeitHed

    MeitHed Specialist

    None.

    It seems that I neglected to mention that combofix found Rootkit.Zero Access. Combofix also made it clear that the recovery console is missing.

    I do not know if either of those will be useful, but though I should include the info.

    Thanks again,

    meiT
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    See the download links under this icon [​IMG]
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7 make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  18. MeitHed

    MeitHed Specialist

    Sorry for the delay in responding.

    I ran Avenger and MGTools per your instructions, still unable to access the internet via dns.

    Logs are attached.


    Thank you
     

    Attached Files:

  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Per your logs, everything is fine with your PC. Are you sure the problem is not in your router? Do you have another PC ? If so is it working okay thru the router?

    If you don't have another PC and only have this one PC, what happens if you bypass your router and reboot your PC before trying to connect?
     
  20. MeitHed

    MeitHed Specialist

    That is disheartening. I have several PC's connected through the router, all of which run fine.

    I am open to suggestions.

    Thanks again for your time.
     
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is the below DNS Server list correct:
    Code:
            DNS Servers . . . . . . . . . . . : 68.116.46.115
                                                24.205.192.61
                                                24.205.224.36
    What do your other PCs show?
     
  22. MeitHed

    MeitHed Specialist

    The DNS Servers all match what you posted.
     
  23. MeitHed

    MeitHed Specialist

    Ok. I did some more research and found KB951748 . This seems to have fixed the DNS issue.


    Thank you much Chaslang for your assistance.
     
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Glad to hear you have it working. That KB update probably repaired some driver or other DLL files that may have been corrupted. Possibly one of the below because we had tested other related files:

    Dnsapi.dll

    Msafd.dll

    Mswsock.dll
     
  25. MeitHed

    MeitHed Specialist

    I am not sure what exactly it fixed, but tried it as a long-shot and got lucky.

    Thanks again for your time and effort.. It is very much appreciated.
     
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  27. MeitHed

    MeitHed Specialist

    Done and Done.

    Thank you much again Chaslang.

    Kudos.
     
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds