Rootkit attached driver hidden *unable to delete

Discussion in 'Malware Help (A Specialist Will Reply)' started by datacat, Nov 24, 2009.

  1. datacat

    datacat Private E-2

    Hi,

    I recently became infected with some form of rootkit which attaches to hidden drivers. The name of driver changes at each deletion or reboot. I have tried everything in my power to remove it, gmer, mgtools, ccleaner, combofix, avenger, unhackme, you name it....

    I like to call myself an advanced user but I don't have much experience with rootkit removal. I have spent already 2 hours this morning trying to remove it with no luck. Keeps coming back...

    I run a really tight system, only a few necessary startup items, background processes, etc. I keep things bare and simple so this should be easy to solve for someone who knows what to look for.

    I would really appreicate any technical help with this.

    I won't post any logs until I am given instructions as I'm not sure what you guys need from me.


    Thanks in advance.

    Shaun
     
    Last edited: Nov 24, 2009
    datacat, Nov 24, 2009
    #1
  2. datacat

    datacat Private E-2

    I followed every step in the WinXP Cleaning Procedure guide. I have attached the logs;

    Even though things appear clean (I'm not expert) AVG and other scan tools are still reporting this rootkit hidden driver.

    The ComboFix log is 766kb so it will not allow me to attach :\


    Thanks in advance.
     

    Attached Files:

    datacat, Nov 24, 2009
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    This normally means that you have used ComboFix previously and have not cleaned up afterwards and thus have left over large snapshot info being attached. Had you used ComboFix before? Was it under direction of a forum like this? You should never ever run this on your own and should only run it when instructed and not just as a checkup. I see you also ran Avenger on Nov 24th. This is also something you should not be doing on your own so again I have to wonder if you are working at another forum.

    We need the ComboFix log to properly continue. So split it up into smaller pieces and attach them. Or try putting it into a ZIP file and attaching it.

    Also give us a log from AVG so we can see exactly what it is finding.

    You need to uninstall Ewido. It was discontinued a very long time ago and is not longer supported. And in fact it was acquired by AVG and is already embedded in the AVG8.5 program you have installed.
     
    Last edited: Nov 25, 2009
    chaslang, Nov 25, 2009
    #3
  4. datacat

    datacat Private E-2

    I did infact run ComboFix twice. Thanks for the heads up on that. I have not posted on ANY other forum relating to this problem.

    I have been building, servicing, and administering systems including unix platforms since I was only 15. I understand the do's and donts. I don't consider myself an expert by any means. I have never dealt with rootkits on windows platforms so it's all new to me.

    I did uninstall Ewido after using it. I was a little frantic when the rootkit was detected by AVG. I also had the "catchme.sys" acting on my system, which I believe I successfully removed.

    I will attach the current ComboFix log and partial log of AVG detecting rootkit. I have read it is most likely a false positive that it is related to Daemon Tools or Alcohol 120% although I do not use Daemon Tools, I do have Alcohol installed. But again I am no expert when it comes to these vulnerabilities.

    Thank you.
     
    datacat, Nov 25, 2009
    #4
  5. datacat

    datacat Private E-2

    Updated ComboFix log and quick rootkit output by AVG. The name of driver changes each time it's deleted. After extensive research I am lead to believe this is part of Alcohol 120 but I'm not 120% sure! Thank you for the technical help.

    I am baffled. I ran AVG a second time to generate an output and the "rootkit" is not being detected. ComboFix disables Alcohol virtual drive and since the reboot AVG is not detecting anything. Can you confirm?

    Shaun
     

    Attached Files:

    datacat, Nov 25, 2009
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes it is. I believe it and possible Daemon Tools do things like this which have wasted many many hours for thousands of people hunting down problems that don't exist.
     
    chaslang, Nov 25, 2009
    #6
  7. datacat

    datacat Private E-2

    I understand your point. It frustrates me as well. I will be putting Alcohol to rest and using only Nero from now on.

    I appreciate your help. Cheers
     
    datacat, Nov 26, 2009
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Just one addtional comment on catchme.sys. It is not malware. So AVG was incorrect. GMER which is also used by ComboFix use it as part of the rootkit detection software. If you look in your ComboFix log, you will see the below line:

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. After doing the above, you should work thru the below link:
     
    chaslang, Nov 28, 2009
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds