Can't remove Rootkit TnCore/Trace

Discussion in 'Malware Help (A Specialist Will Reply)' started by guyinblacktshirt, Apr 15, 2008.

  1. guyinblacktshirt

    guyinblacktshirt Private E-2

    after reading all relative threads i still cant remove Rootkit TnCore/Trace

    SuperAntispyware detects it:

    RootKit.TnCore/Trace
    C:\Windows\system32\drivers\core.cache.dsk

    I've gone through all the steps in the Vista cleaning guide (running Vista Home Premium)

    Below is my log from Hijack This
    Thank you in advance for any help

    Logfile of Trend Micro HijackThis v2.0.2
     
    Last edited by a moderator: Apr 15, 2008
    guyinblacktshirt, Apr 15, 2008
    #1
  2. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    We would like to run a custom diagnostic on your system (with MajorGeeks permission) to see if you have a new variant.

    If this is ok with MajorGeeks, please submit a support request here:
    http://www.superantispyware.com/support.html

    We can then run our diagnostic and update the forum with our findings to help everyone.

    Nick Skrepetos
    SUPERAntiSpyware.com
     
    SUPERAntiSpy, Apr 15, 2008
    #2
  3. guyinblacktshirt

    guyinblacktshirt Private E-2

    sorry for the wrong format in my previous post, please see attached for the correct log files.

    thanks again

    thanks SuperAntispyware team, I added the support request per your instructions

    since i can only upload three files, below are the contents of the superantispyware log file:

    Application Version : 4.0.1154

    Core Rules Database Version : 3438
    Trace Rules Database Version: 1430

    Scan type : Complete Scan
    Total Scan Time : 00:43:22

    Memory items scanned : 757
    Memory threats detected : 0
    Registry items scanned : 6407
    Registry threats detected : 0
    File items scanned : 23927
    File threats detected : 2

    RootKit.TnCore/Trace
    C:\Windows\system32\drivers\core.cache.dsk
     

    Attached Files:

    guyinblacktshirt, Apr 15, 2008
    #3
  4. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    You have 2 hidden service keys:
    HKLM\SYSTEM\CurrentControlSet\Services\vkquwexg
    HKLM\SYSTEM\CurrentControlSet\Services\usbhubb

    And a hidden driver:
    usbhubb.sys

    We updated our (SUPERAntiSpyware) definitions to remove these threats - the definitions will be public after 6pm PST (Pacific Standard Time) - so update your definitions at that time an perform a complete scan.

    Nick Skrepetos
    SUPERAntiSpyware.com
     
    SUPERAntiSpy, Apr 15, 2008
    #4
  5. guyinblacktshirt

    guyinblacktshirt Private E-2

    thanks for the ultrafast responses and solution. will wait until the definitions are out and let you know how this worked out!

    indeed the one file you mentioned, usbhubb.sys , was detected somehow in the latest AVG 8.0 suite, but it could never disinfect it/delete it.

    will update the thread after 6pm when i'll have the new definitions

    I assume I can now manually remove the keys and file in safe mode?
    Thanks so much
     
    guyinblacktshirt, Apr 15, 2008
    #5
  6. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Can you get a hold of that file and send it to us at samples AT superantispyware.com ?

    Nick Skrepetos
    SUPERAntiSpyware.com
     
    SUPERAntiSpy, Apr 15, 2008
    #6
  7. guyinblacktshirt

    guyinblacktshirt Private E-2

    absolutely! the least i can do :)
     
    guyinblacktshirt, Apr 15, 2008
    #7
  8. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    We have updated our definitions to remove the latest Rootkit (TNCore) - make sure you have definition versions Core : 3439 and Trace : 1431 and then perform a COMPLETE scan and the threats should be removed.

    If not, or there is a probem let me know!

    Nick Skrepetos
    SUPERAntiSpyware.com
     
    SUPERAntiSpy, Apr 15, 2008
    #8
  9. guyinblacktshirt

    guyinblacktshirt Private E-2

    I just started my Complete Scan with the latest definitions,

    1000x thanks to the team of superAntispyware

    will keep you posted
     
    guyinblacktshirt, Apr 15, 2008
    #9
  10. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Did the scan clean up your system?
     
    SUPERAntiSpy, Apr 16, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It's not new Nick! It has been around for quite sometime now. It always appears in a pair of files. In this user's case
    Code:
    C:\Windows\System32\drivers\
coreca~1.dsk  Feb  1 2008      167545  "core.cache.dsk"
usbhubb.sys   Feb  1 2008       86144  "usbhubb.sys"
    Normally what we do here is remove the driver with either ComboFix or Avenger and at the same time we also have them delete the files. Sometimes the .SYS file is 86144 bytes and sometimes it is 86014 bytes so there are slightly different versions around. The .SYS file name is random. You can see these file I pasted in above in the newfiles.txt log inside the MGlogs.zip file. Yes there is also sometimes another service that goes along with it. It will sometimes show up after removing the above two files and the driver from the registry.
     
    chaslang, Apr 16, 2008
    #11
  12. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    The internals of the files he had were different than the other versions of the "Core.sys" files we have analyzed. We have dozens of variants of this infection. In fact, today there were new versions in our FileResearchCenter.com and on a few "adult" harvesting sites - those are in our definitions now and were virtually undetected on VirusTotal and Jotti - so there are NEW variants of this threat appearing.....
     
    SUPERAntiSpy, Apr 16, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes they do change frequently. My main point was that the form that is mated with the .SYS file has been around for awhile now. Like most nasty malware, it keeps changing. ;)
     
    chaslang, Apr 16, 2008
    #13
  14. guyinblacktshirt

    guyinblacktshirt Private E-2

    Iindeed SuperAntispyware found the rootkit and USBHubB.sys related files but after reboot it didn't run to delete them. (the option to "start with windows" is checked. )

    I'm trying now running the program from a different admin account in case something is wrong with the previous user. will update you when its finished.

    Attached SuperAntispyware Log
     

    Attached Files:

    guyinblacktshirt, Apr 16, 2008
    #14
  15. guyinblacktshirt

    guyinblacktshirt Private E-2

    so how could I do that and remove the files manually?
     
    guyinblacktshirt, Apr 16, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well let's check to see if they were removed or not.

    Please run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below log:
    • C:\MGlogs.zip
     
    chaslang, Apr 16, 2008
    #16
  17. guyinblacktshirt

    guyinblacktshirt Private E-2

    thank-you sir,
    attaching requested logs.
     

    Attached Files:

    guyinblacktshirt, Apr 16, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Give the below a try.

    Uninstall the below old versions of software:
    Java(TM) 6 Update 3
    Java(TM) SE Runtime Environment 6

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Apr 16, 2008
    #18
  19. guyinblacktshirt

    guyinblacktshirt Private E-2

    thank you

    after dragging the CFscript.txt over ComboFix.exe , and after accepting ComboFix disclaimer i got the big blue screen (windows memory dump etc)

    it occured about halfway after the program "backing up registry to c:\windows\erdnt\Hiv-backup" finished
    at that stage combofix said that it was scanning for infected files.

    The blue screen said something like "a program/process crucial for the system operation has stopped working and windows shut down to prevent damage etc"

    it happened twice.

    any ideas?

    by the way, usbhubb.sys , still there.
    Thanks again.
     
    guyinblacktshirt, Apr 16, 2008
    #19
  20. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Are you sure you rebooted after scanning with SUPERAntiSpyware? We detected that file, and our kernel system would have made the file unsuable so it won't load and would have been deleted on reboot.
     
    SUPERAntiSpy, Apr 16, 2008
    #20
  21. guyinblacktshirt

    guyinblacktshirt Private E-2

    absolutely Nick, i actually did the complete scanning twice with the latest definitions from my two different admin accounts

    what i've noticed though is that i haven't seen superantispy doesnt load up before everything else at boot, (the way spybot does after a required reboot)
     
    guyinblacktshirt, Apr 16, 2008
    #21
  22. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Are you sure our kernel drivers aren't disabled? Have you done an uinstall and re-install?
     
    SUPERAntiSpy, Apr 16, 2008
    #22
  23. guyinblacktshirt

    guyinblacktshirt Private E-2

    didnt try uninstalling/reinstalling. will do that right now. thanks for the continuous help.
     
    guyinblacktshirt, Apr 16, 2008
    #23
  24. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Would you like to try our 4.1 pre-release version? If so PM me and I can send the link - it has better kernel drivers and such.

    -Nick
     
    SUPERAntiSpy, Apr 16, 2008
    #24
  25. guyinblacktshirt

    guyinblacktshirt Private E-2

    tried superantispyware pre-release 4.1, after removing 4.0 completely -- again it detects usbhubb.sys, but it won't remove it after a reboot.
    attached is the log
    how can I tell if the kernel drivers are active? maybe something is interfering?
     

    Attached Files:

    guyinblacktshirt, Apr 16, 2008
    #25
  26. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Forgive me if I missed it, but what other security applications are you running? Would you mind submitting another diagnostic?
     
    SUPERAntiSpy, Apr 16, 2008
    #26
  27. guyinblacktshirt

    guyinblacktshirt Private E-2

    please send me the link for the diagnostic
    i have several security apps installed

    update -- ok , results sent to diagnostic server
     
    Last edited: Apr 16, 2008
    guyinblacktshirt, Apr 16, 2008
    #27
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I want to wait until Nick has a chance to work out the details of getting SUPERAntispyware to remove this before jumping in again with a manual fix. Since ComboFix was obviously blocked by something, I have another method we often use. It may or may not work. Depends on whether this is really a new form with something else hiding in the background that is trying to block some of our tools.
     
    chaslang, Apr 17, 2008
    #28
  29. guyinblacktshirt

    guyinblacktshirt Private E-2

    ok sounds good I respect that -- i've completed the online diagnostic so lets wait
    chaslang, thanks again for your support.these forums rock.

     
    guyinblacktshirt, Apr 17, 2008
    #29
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Have you had anymore feedback from them yet?
     
    chaslang, Apr 18, 2008
    #30
  31. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    I will touch base with our senior analyzer in the morning. Today was a hectic day with some exiciting new stuff from our development team :)
     
    SUPERAntiSpy, Apr 18, 2008
    #31
  32. guyinblacktshirt

    guyinblacktshirt Private E-2

    I took the liberty to try to remove this usbhubb.sys file manually.
    booted from the latest ubuntu live-cd, deleted the file, booted into vista,
    waiting for super-antispyware to finish a new complete scan with latest definitions
     
    guyinblacktshirt, Apr 18, 2008
    #32
  33. guyinblacktshirt

    guyinblacktshirt Private E-2

    hmm after re-boot file is still there. somehow gets re-created. Lernea hydra.
     
    guyinblacktshirt, Apr 18, 2008
    #33
  34. SUPERAntiSpy

    SUPERAntiSpy Private E-2

    Did you update SUPERAntiSpyware definitions and re-scan? Are you doing this from the Admin account? Also, are you running 32-bit or 64-bit Vista?
     
    SUPERAntiSpy, Apr 18, 2008
    #34
  35. guyinblacktshirt

    guyinblacktshirt Private E-2

    Hi nick
    im now scanning with the latest definitions (using 4.1 pre)
    waiting for the scan to finish..
    running from admin account with uac off
    32bit vista on a toshiba satellite laptop
    by the way i managed to email the file (usbhubb.sys) to samples at superantispyware com

     
    guyinblacktshirt, Apr 18, 2008
    #35
  36. guyinblacktshirt

    guyinblacktshirt Private E-2

    Looks like the naughty files are now gone. after booting into ubuntu and deleting both:
    C:\Windows\System32\drivers\core.cache.dsk and
    C:\Windows\System32\drivers\usbhubb.sys

    I ran superantispyware v4.1 pre with latest definitions,
    it found 12 registry entries pertaining to usbhubb.sys, and it rebooted the system so it could clean them out too

    I dont have popups yet so it looks like the laptop is finally clean again.

    any post-cleaning thoughts?
    oh and again, many many thanks to everyone who helped, Nick, chaslang you guys rock.
     
    guyinblacktshirt, Apr 18, 2008
    #36
  37. guyinblacktshirt

    guyinblacktshirt Private E-2

    happy to report that after another reboot all malware is now gone according to superantispy+latest definitions.
     
    guyinblacktshirt, Apr 19, 2008
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Excellent news! What I would have proposed was using Avenger to unload the driver and delete the two files. Between using ComboFix or Avenger to do this we have always had success in removing this malware infection.
     
    chaslang, Apr 19, 2008
    #38

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds