Rootkit in TCP/IP

Good evening,

A few days ago AVG detected something and started acting weirdly. It seems that the PC was infected with generic.27 and some rootkit.

After using several tools (AVG, TDSS, Malwarebytes, Kaspersky Rescue Disk, etc.) I think some things were fixed. At least I could surf again and the PC was running a bit faster. Then, adviced by IT department at work, I also ran Combofix. After a few times I kept getting the same message (that about the rootkit at the tcp/ip...).

Then I found this webpage, read some topics and the malware removal procedure and decided it would be wiser to seek your help rather than acting on my own...

I ran again MBAM (to no result), and ran SAS, Combofix (with the same result), Rootrepeal and MGTools.

It would be mostly appreciated if you could help me with this problem.

I will post the logs here. And I can also post former logs, I think I can find most of them.

Thanks a lot in advance,
Alberto.

 

I'm posting here the MGTools log.

Thanks again,
Alberto.

 

Hi and welcome to Major Geeks, Alberto!

http://img853.imageshack.us/img853/6741/addremovexp.gif From Add/Remove Programs (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 2
• Java(TM) 6 Update 29
• Java(TM) 6 Update 3
• Java(TM) 6 Update 5
• Java(TM) 6 Update 7

http://img823.imageshack.us/img823/2039/msnmsg.gif Please download Disable/Remove Windows Messenger to your desktop.

• Double-click MessengerDisable.exe to run it.
• Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
• Click Apply
• Click Exit

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
cpqnicmgmt
fireport
[COLOR="DarkRed"]FileLook::[/COLOR]
c:\windows\system32\drivers\afd.sys
[COLOR="DarkRed"]Folder::[/COLOR]
C:\WINDOWS\$NtUninstallKB18365$
c:\documents and settings\Ordenador\Configuración local\Datos de programa\023fba7d
C:\$avg
[COLOR="DarkRed"]NetSvc::[/COLOR]
cpqnicmgmt
[COLOR="DarkRed"]RegNull::[/COLOR]
[HKEY_USERS\S-1-5-21-746137067-1563985344-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"services"=dword:00000000
"startup"=dword:00000000
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

http://img195.imageshack.us/img195/9049/javaz.gif Now install the current version of Sun Java from: jre-7u3-windows-i586.exe

http://img254.imageshack.us/img254/945/baticonxp.gif Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

Let me know how the system is running after you have completed these steps.

 

After you finish the above instructions, you can run ComboFix once more (without any sort of script) to verify that the ZeroAccess / rootkit in tcp/ip message is gone.

 

Ok, perfect, I'll run all these steps this evening when I get home after work and let you know how it goes.

Thanks a lot for your help.

 

OK, I managed to uninstall the programs and run all the scans you told me, and here are the logs.

I also run ComboFix afterwards and the TCP/IP message seems to be gone now.

What are the next steps? Should I run some more scans to be sure everything is gone?

The PC is apparently working properly

Thanks a lot, again. This seems to be working great.

 

Your latest logs are clean.

You can run any scan you'd like after you complete these steps:

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

You're welcome. Be safe

 

Ok, I'll do that work and scan afterwards. Hopefully everything will be ok now.

Just a couple of questions more. I was using AVG and Ad-aware before this infection and uninstalled them in order to run ComboFix. Now I'm thinking of changing, and I was having a look at AVIRA and Panda Cloud. Any advice?

As for firewall, time ago I used to run ZoneAlarm but it caused me several problems and just switched to Windows Firewall. I'm sure there are better options. What about PC Tools Firewall Plus?

I'll have a look at your guidelines on protection anyway and work through them.

I may repeat myself a bit, but thanks a lot for your help, again.

 

You should be OK.

One thing that I see was ignored in our previous CFScript was that...

• c:\documents and settings\Ordenador\Configuración local\Datos de programa\023fba7d

... did not get deleted. I highlighted in red the reason why I think it had difficulty.

Out of those two, I would go with Avira.

I have not tested PC Tools Firewall. I would give Comodo Personal Firewall a try or just stick with Windows Firewall.

No problem

 

Do you think I should manually remove that folder? Any idea on what's it for?

c:\documents and settings\Ordenador\Configuración local\Datos de programa\023fba7d

I managed to see it, it was hidden as a system folder. I scanned it with mbam, SAS and Avira, and they don't find anything bad...

I followed all the last steps and everything seems to be ok. I also ran quick scans, no problem. I'll do complete scans this weekend.

I installed Avira and may try Panda Cloud on another PC to see how it goes. The same for the firewalls.

Thanks again

 

I tried to reply but there was some problem so I'll write again...

Do you think I should manually delete that folder? It's hidden as a system folder and I scanned it with mbam, SAS and Avira, but they found nothing bad in it.

As for the rest, I already followed all the last steps and performed a few quick scans. I'll run complete scans on the weekend.

I installed Avira and may try Panda Cloud on another PC to see how it goes. And the same for the firewall.

Thanks.

 

Yes, I think you should

You're welcome