Malware/ TDSS Rootkit scare

big22 · Jan 6, 2010

okay so i was browsin the net with a non up to date java with firefox (doh!)
http://www.malwarebytes.org/forums/index.php?showtopic=35537
according to my primary AV - nod32 2.7 - It said the following :Win32/Kryptik.BQD trojan and it came from the same location as the one posted in the above link. I clicked terminate but somestuff i guess got through and I was getting false security pop ups every 1 minute or so.

So i did a quick scan with SAS - it removed 5 things (some stuff out memory/1 reg entry). Then after a restart I followed up with malwarebytes - and it found 2 things that were kinda freaky:

Malwarebytes' Anti-Malware 1.43
Database version: 3499
Windows 6.0.6000
Internet Explorer 8.0.6001.18865

1/5/2010 11:41:51 PM
mbam-log-2010-01-05 (23-41-51).txt

Scan type: Quick Scan
Objects scanned: 96837
Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\User\AppData\Local\Temp\H8SRT3ff2.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\User\AppData\Local\Temp\H8SRT629e.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

following the removal of these I restarted scanned again and everything came up clear in those apps. So far so good, no pop ups or nothing. However, Im still quite concerned as it distinguished rootkits tdss and it may be hiding inside the system am I right?
Is there any other things I can do to confirm the malwares are gone? And that my information will be safe =) Is there a way to scan for rootkits?

As you can see im kind of lost from here on - If someone can sort of guide me in the right direction it would be highly appreciated.

big22 · Jan 6, 2010

bump

chaslang · Jan 6, 2010

big22 said: ↑

bump
Click to expand...

All this did was cost you 16.25 hrs of more delay. Please read the required sticky threads.

Don't Bump! It Only Hurts You!!!

And also what you should be doing before posting.

READ & RUN ME FIRST. Malware Removal Guide

big22 · Jan 10, 2010

Sorry about that chaslang. My mistake for not reading the stickies. Here are my logs:

I had an error running rootrepeal: this is what it says

21:23:11:
21:23:11: DeviceIoControl Error! Error Code = 0x1e7
21:23:11: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)
Click to expand...

chaslang · Jan 11, 2010

Why haven't you update Vista? You are running original barebones Vista and it already has 2 Service Pack updates out. This is a major security risk.

And if the above was not enough of a problem, you are using an illegal cracked copy of a security program:
NOD32 antivirus system
NOD32 FiX

You need to uninstall this and go legal if your security and PCs operation are important to you. Also read this:Warning about Porn, Keygens, Cracks, and other Illegal Software

I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

Uninstall the below old versions of software:
Java(TM) 6 Update 7

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Drivers to delete:
H8SRTd.sys

Files to delete:
C:\Users\User\AppData\Local\Temp\H8SRT3ff2.tmp
C:\Users\User\AppData\Local\Temp\H8SRT629e.tmp
C:\ProgramData\sysReserve.ini
Folders to delete:
C:\32788R22FWJFW

Registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\avenger.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

big22 · Jan 12, 2010

Hi chaslang,
Thank you for your response.
wow, I never even realized my Vista was so out of date. I haven't validated my copy of windows and therefore never got the updates however I just downloaded the validater and will do those updates overnight tonight. I also cleaned up some of my desktop however I still have a folder which I will be moving to a different location soon- just have not had the time to go through all of the documents yet. But I have definitely noticed an improvement in my start up sequence with less stuff on the desktop and it overall just feels a lot faster. And the NOD32, I am removing it and purchasing the legitimate version tonight.

Here are my logs as requested from avenger and mgtools. After I ran avenger, I checked for the files manually that were on the script on avenger - the files were not present and avenger successfully deleted them. Just a note, when I used avenger during the reboot I believe once the computer failed to boot and restarted itself and brought me to the windows screen asking if I want to start windows in safe mode etc. ( I selected start windows normally.) Once back into Vista, one of those microsoft solution sending boxes showed up (since one of the boots failed) and asked me to send for solution - (I declined.) I have also attached the log of what that microsoft prompt had said just in case.

Once again, Thanks a lot. Everything seems to be running fine. Just waiting on your final say on how things look to you.

chaslang · Jan 14, 2010

You're welcome. Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Malware/ TDSS Rootkit scare

big22 Private E-2

big22 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

big22 Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

SASlog.log

mbam-log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

big22 Private E-2

Attached Files:

MGlogs.zip

avenger.txt

Windows Error.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member