Help an ancient geek! Browser redirect virus still here

Hi

I have been infected by a series of malware/virus recently, on a Windows 2003 computer.
Retrospectively, I think I know why: I had to disable the firewall and there were some trojans (at least one) waiting.
I've seen, after investigation, that some exceptions had been created in the firewall, for svcnost.exe in particular.

At first, the usual AV system (Symantec Corp v10) detected trojans (smitfraud.c) in some user temp folder.

I have then scanned the infected computer (which always was protected with up-to-date Symantec Corporate AV v10) with various malware/spyware/Virus scanner, removal tools. They found some threats and quarantined them:
smitfraud
Suspicious.Stealers
Packec.Win32.Upack
Trojan.Win32.Autorun.dm
Trojan.Win32.GenericBT
Win32.Exploit.MS05-016
Spyware.Passwords
and especially
Rootkit.agent (atapidrv.sys)

When I ran these tools a second time, they did not find any remaining threat.

But I still suffered from a folder redirection issue, with all the browsers.

I suspected I had a rootkit, that could hide itself. I was right, it appeared as a hidden driver.
As I used to be somewhat a geek myself (I programmed some simple Windows kernel drivers in the past, I even implemented a sample rootkit by hooking ZwCreateFile function call to log this function operations), I detected it "easily": I booted the infected computer off a UBCD4Win environment, mounted the "c:\windows\system32\config\system" registry hive, dumped its entry in a .reg file. I was about to boot off the regular HDD and do the same thing and compare the 2 files, but I did not have to (yet I did) since there was a very suspect entry named DJBGFDS (or something like that) which loaded a tmp file located in a user temp folder.
I deleted both the registry entry and the file, while under UBCD4WIN environment.

I ran TDSSKiller on the computer while it was running, after I removed the threats. It found nothing.
I ran GMER, it found no threat (no hidden stuff).
Sophos ANtiRootKit, RootKit revealer... none of them found anything.

I uninstalled Firefox 3.6 and Opera 11 (which were suffering from the redirection symptom).

I rebooted the computer.

I stopped or killed almost all the running processes on the machine and tried Internet Explorer 8: I am still redirected!

From UBCD4WIN, I re-flashed the BIOS, including boot blocks, restaored the MBRs on the disks. Still being redirected.


Any help would be appreciated.
I know that I can't run ComboFix from Win 2003, but I do know how to deleted any file or any registry entry...

Thanks in advance

- MisterV

The tools that were used:
From the infected environment:
Windows 2003 sp2 x86 (Enterprise, French)
Windows Firewall
Windows updates (automatic updates, daily)
Symantec Corp. AV v10 (online scanning enabled, automatic updates)
Panda AV online Scanner
TDSSKiller
MalwareBytes
Ad-Aware
GMER
CatchMe
RootKitRevealer (SysInternals)
Sophos AntiRootkit
Process Explorer (I verified all the supposed MS files/processes, they were confirmed, as well as most of the other ones)
AutoRuns (I also verified most of what is launched there)

from UBCD4Win/WinPE environment
Spybot SD
SUPERAntiSpyware
ViPRE PC Rescue
McAfee Stinger
Avast

 

I zipped the log files and attached them.

Note that some of the tools can't run on Windows 2003 (which is the OS that operate the intefcted computer) and also that the tools are sometimes displaying/writing messages in French (since it is the locale in use).

Note as well that no infection or threat have been reported, as far as I can tell. RootReveal saw some Kernel API hooks, but this may be related to the protection system (antivirus etc) that, even if disabled, will still have the hooks in place.

One last thing:
MGTools.exe does not work if run from a drive that is not C:.
This is a common problem with batch files and I can fix it if you want, just give me some technical details about MGTools implementation, especially regarding the order of operations and the tools used to create the \MGTools folder (which gets created on the root of the drive that MGTools is run from).

Thanks in advance

 

The logs I attached previously contain the correct MGLogs file, run from the C: drive.
I think I can still "fix" MGlogs for it to be able to run from any drive, but I don't know if this is really required

 

These logs are all what MGLogs seems to be creating when run on my Win2003 OS.
Many of the tools that MGLogs call won't run on Win2003.
Then, I'll try to figure it myself I guess...

The "only" symptom that seems to be left is the browsers redirection stuff.

Where can I find some details about how browser redirection can work ? I understand that it can be done with some rootkit (what can't they do?).
But is there a chance that this could be also accomplished by some other technique?
Since it seems that I don't have an undetectable RootKit. I even suspected a VBootKit variant and restored the VBRs on my active partitions, but it did not change (though I don't know how fixboot works... Does it restore the VBR from NTFS' copy or recreate it?)

Corrupting Winsock layer would work, but I would expect antiviruses and other mechanisms to make it hard to be left undetected.

Well, in short, any detail about techniques used for Browser redirection could help me figuring out where to search.

Thanks in advance

- MisterV

 

TDSSKiller reports no infection.
Tdsskiller log was attached to my previous post. No change since then

Regarding MGLogs tool on Windows 2003, do you confirm they all should work? Combofix won't for sure.

 

I did like you asked.
ShowNew does not seem to work on Win2003.

I created outputs (stdout and stderr) for the tools using the redirection:
"> [File.out.txt] 2>&1"
The stderr/stdout files are in MGLogs.zip

Nothing more than previously.

I thank you for your time, but don't bother trying to fix my system using these logs. I am pretty sure you will not find anything useful.
I understood all what they log said. Nothing to correct... I told you I was an ancient geek, actually that's false, I was more the nerd kind. To solve the current problem I was envisaging using IDA, WinDBG and IRPtracker to see what causes the issue, from inside.
I even began.
I could also have used some hardware probe, loaded Checked versions of the system files one by one, etc...
But I don't have enough time.

I will perform an "upgrade re-install" of Windows 2003 R2 on the top of the problematic computer and I'll tell you if this solves anything (I think it should, because I am pretty sure that what happened is that my system is compromised the "old way": a system file has been infected by a virus, and this virus is not detected by any of the tools I tried. Maybe a manually crafted virus. I had a backdoor opened for sure, and "someone" could have been doing about anything on my system). But reinstalling Windows (and make sure the files are safe, the boot sectors, MBR/VBR ar OK) should be enough to solve the issue. I removed almost all non MS files. I'll monitor carefully this computer's activity anyway.

If the re-install seems to work, I'll do a RootRepeal again and see if the kernel APIs hooking table has changed...

Anyway thanks for the support and the time you spend fixing user's issues.

- MisterV

 

ver says:

Microsoft Windows [version 5.2.3790]

It's MS Windows 2003 enterprise sp2 "R2"