They're Back...

daldrich · Jan 4, 2012

Just when I thought I had this licked, Rootkit Zero Access / Trojan gen 2 pops back up.

Thanks,
-d

Kestrel13! · Jan 4, 2012

Trojan gen 2 pops back up.
Click to expand...

What exactly is reporting this? You also need to give an exact file path to the threat(s) being found if possible. I had a quick glance through and am not seeing anything unusual.

Can you attach the logs from running both Malware Bytes and SUPerantispyware too please?

Also make sure to run this fresh and attach the log please.

Please also download MBRCheck to your desktop

Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)

It will show a Black screen with some information that will contain either the below line if no problem is found:

Done! Press ENTER to exit...

Or you will see more information like below if a problem is found:

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.

MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.

Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

daldrich · Jan 9, 2012

Combofix reported Rootkit Zero Access. Running it a second time, it reports a nameless 'rootkit detected'.

BTW, SEP autoprotect is now not running, reports that the protection definitions are too old for proactive threat detection. Update does not fix the problem.

Thanks,
-d

Kestrel13! · Jan 9, 2012

I did not want you to run scans more than once. Please only do as I request whilst we are working together to remove malware.

Now we need to use ComboFix by sUBs

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

Driver::
VODONACM
File::
c:\docume~1\Dan\LOCALS~1\Temp\VODONACM.exe
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

Please download a Zeroaccess Removal Tool by Symantec

Follow the instructions to download and run it.

After the computer has started, the tool will inform you of the state of infection.
Click to expand...

(Let me know!!)

Do not run anything else that I have not requested. Attach the Combofix log.

daldrich · Jan 10, 2012

The Symantec tool reports that the rootkit was not found.

Thanks,
-d

Kestrel13! · Jan 10, 2012

And what about Combofix? Is that still reporting any rootkit activity??

daldrich · Jan 14, 2012

Nope, still here.

Is there a howto on reading the combofix logs?

Thanks,
-d

Kestrel13! · Jan 15, 2012

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Vista and Windows 7 users Right-click OTL and choose Run as Administrator)

When the window appears, underneath Output at the top change it to Minimal Output.

Check the boxes beside LOP Check and Purity Check.

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.

TimW · Jan 15, 2012

You need to tell Kes exactly what is being reported and where. Full path to the file, as nothing is showing in the Combo logs.

thisisu · Jan 16, 2012

A RootRepeal log should have been provided.

Now run this procedure Running RootRepeal to get a RootRepeal log

thisisu · Jan 16, 2012

Also attach the following files:

C:\Qoobox\ComboFix-quarantined-files.txt

C:\Qoobox\ComboFix2.txt

daldrich · Jan 17, 2012

OTL hangs and doesn't complete. Will try again and get you the otl and extra logs.

The drives that RR said had root kits are USB disk drives. I can take them off line or put them on my G5 iMac for now.

-d

thisisu · Jan 17, 2012

You can also try OTL from Safe Mode if you are having trouble while in Normal.

Complete these steps afterwards:

http://img805.imageshack.us/img805/9659/rktigzy.gif Please download RogueKiller to your desktop.

Rename RogueKiller.exe to winlogon.exe
Double-click winlogon.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the number "1" and press ENTER.
When it is finished -- Notepad will open with the report and the log is saved to your desktop.
Attach RKreport[1].txt to your next message. (How to attach)
You can now type the number "0" and press ENTER to exit RogueKiller.

_________________

Disable your antivirus software before doing the below to avoid conflicts:

Click the http://www.techsupportforum.com/forums/sectools/tetonbob/StartBtn.gif button. > Run - copy and paste the bolded command below in the box then click OK.

%windir%\pev.exe -t:c -sa:CDATE -sd:NAME --custom:##t #c . #m #f# "%windir%\$NT*" >>"%userprofile%\desktop\find.txt"

Attach find.txt when complete. It should be on your desktop.

daldrich · Jan 21, 2012

OK, so OTL hangs in safemode as well. I was able to run roguekiller and the script (had to type it into a console, run -> paste didn't seem to work)

-d

thisisu · Jan 21, 2012

Ok we may have gotten the information we were looking for. We have to double-check though. Type in the following command:

dir /s C:\WINDOWS\$NtUninstallKB25490$ >>"%userprofile%\desktop\look.txt"

Attach look.txt on your desktop when finished.

daldrich · Jan 21, 2012

Here you go...

-d

thisisu · Jan 21, 2012

That's the right folder we were looking for. It's a folder that did not get completely deleted as it should have.

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:
Code:
[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]Folder::[/COLOR]
C:\WINDOWS\$NtUninstallKB25490$
Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

After you do the above, run ComboFix again (without a script this time) and let me know if it still reports ZeroAccess.

daldrich · Jan 21, 2012

Combofix complained about SEP still running even though I disabled it and real time protection.

I'll run combo fix again now.

Thanks,
-d

thisisu · Jan 22, 2012

daldrich said: ↑

Combofix complained about SEP still running even though I disabled it and real time protection.

I'll run combo fix again now.

Thanks,
-d
Click to expand...

Ok, update me whenever you get a chance to run ComboFix again.

daldrich · Jan 22, 2012

OK, Combofix didn't complain this time about a rootkit. Maybe this is it.

Thanks,
-d

thisisu · Jan 22, 2012

It's gone now

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis if it present

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work through the below link:

How to Protect yourself from malware!

Take care and be safe!

daldrich · Jan 23, 2012

Thank you again. I'll go through the steps below tonight.

FYI, SEP auto-protect detected combofix.exe on my desktop as Trojan.ADH.2 and deleted it.

-d

thisisu · Jan 23, 2012

daldrich said: ↑

Thank you again. I'll go through the steps below tonight.
Click to expand...

You're welcome. Ok.

daldrich said: ↑

FYI, SEP auto-protect detected combofix.exe on my desktop as Trojan.ADH.2 and deleted it.
Click to expand...

Disable SEP first, download a new copy of ComboFix.exe and uninstall it properly before turning on SEP again.

daldrich · Feb 2, 2012

Before I did the uninstall and cleanup, SEP reported today that Trojan.Gen.2 was showing up in the java cache:

...\Application Data\Sun\Java\Deployment\cache\6.0\11

SEP is catching and quarantining it, but makes me wonder if something is still going on. Could it be something in Firefox? Run combofix again?

-d

thisisu · Feb 2, 2012

daldrich said: ↑

Before I did the uninstall and cleanup, SEP reported today that Trojan.Gen.2 was showing up in the java cache:

...\Application Data\Sun\Java\Deployment\cache\6.0\11

SEP is catching and quarantining it, but makes me wonder if something is still going on. Could it be something in Firefox? Run combofix again?

-d
Click to expand...

I would let SEP quarantine it. It may have been a minor trace of malware not seen in other logs.

They're Back...

daldrich Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

daldrich Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

daldrich Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

daldrich Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

thisisu Malware Consultant

thisisu Malware Consultant

daldrich Private E-2

Attached Files:

thisisu Malware Consultant

daldrich Private E-2

Attached Files:

thisisu Malware Consultant

daldrich Private E-2

Attached Files:

thisisu Malware Consultant

daldrich Private E-2

Attached Files:

thisisu Malware Consultant

daldrich Private E-2

Attached Files:

thisisu Malware Consultant

daldrich Private E-2

thisisu Malware Consultant

daldrich Private E-2

thisisu Malware Consultant

Useful Searches