Mebroot Trojan Win32/Mebroot.CZ

Hi,

I ran into a ton of problems 4 days ago (but expect the infection was 6 days ago). I've done a lot of research (here and elsewhere) and done a ton of scans with various products. I believe the trojan is: Win32/Mebroot.CZ (as identified by ESET online scanner). I'll give you the symptoms, then tell you what I've done so far. I'm hoping that you'll be able to tell me if I was successful in removing Mebroot or not. But, I expect there's still some lingering effects (MGTools found some things.)

So, you're help would be greatly appreciated! Do I still have it? Are there things I missed in cleaning it?

Symptoms:

The very first sign I got, not sure if related, was a McAfee "Potentially Unwanted Program Detected" error: Name: Generic PUP.z!n. Location: c:\documents and settings\Downloaded Program Updates\MozillaCacheView.exe.

Then, later:

1. System hangs permanently when trying to go to Standby - saying "Preparing to Standby" until I do hard reboot.

2. System would take forever to boot up and then the drive was constantly churning away doing something else for 15 minutes.

3. Noticed "HelpAssistant" account with HelpAssistant folder under "Document & Settings". This folder contains a copy of other user's files, plus other things. Note: I couldn't find the "HelpAssistant" user under the normal "Users" feature in control panel, but I did find it using "net user" command line request.

4. Google started delaying doing searches. It didn't matter what I searched for in Google, it would ALWAYS say "Waiting for rev-advert.com..." on the Firefox status bar. This would occur for 5-8 seconds before finally displaying the search results.

5. Later got McAfee "Potentially Unwanted Program Detected" error: Name: Generic PUP.z. Location: c:\i386\GTDownDE_87.ocx.

WHAT I'VE DONE ALREADY:

1. Ran ESET Online Scanner which found 3 files as variants of "Win32/Mebroot.CZ" (I can send that logfile). Files were 499.tmp, 49A.tmp, 49D.tmp. It cleaned by deleting - quarantine.
2. Ran ESET's EMebRemover.exe which found nothing. Said: "MBR Rootkit (Win32/Mebroot) was not found on your system."
3. Ran Symantec's FixMebRoot.exe which found nothing. Said: "Trojan.Mebroot has not been found active on your computer."
4. Ran F-Secures "Blacklight" program which found nothing.
5. Ran McAfee's Rootkit Detective which found nothing.
6. Ran Malwarebytes Anti-Malware which found 19 infected objects. One was the Trojan.Dropper. (I can send that logfile. Infected: vuxdfe.dll. All objects quarantined and deleted.
7. Downloaded XP Windows Recovery Console (my Dell disk wouldn't work) as an ISO image. Successfully ran "fixmbr".
8. Turned off "Remote Assistance". My Computer --> Properties --> Remote --> uncheck.
9. RAN "net user HelpAssistent /delete" to get rid of HelpAssistant user. Also, deleted unknown user "SUPPORT_388945a0". Ran systemscan.exe to check users.

Checking my root member, throughout this process I ran "mbr.exe" looking to see if it was fixed correctly but I'm still seeing something suspicious. Is this "malicious code" O.K.?

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x06FC3DBF
malicious code @ sector 0x06FC3DC2 !
PE file found in sector at 0x06FC3DD8 !​

=========================
So, I've run all the cleanup and scanning programs. The files are attached.

I did have problems with these steps:

1. Downloading ComboFix.exe error: When I try to download ComboFix.exe to my desktop I get error "C:\Documents and Settings\Steve\Desktop\ComboFix.exe could not be saved because you cannot change the contents of that folder." Simultaneously received McAfee Trojan Removed notice: "McAfee has automatically blocked and removed a Trojan.

About this Trojan
Detected: Artemis!1EF40581675C (Trojan), Artemis!1EF40581675C (Trojan)
Location: C:\Documents and Settings\Steve\Local Settings\Application Data\Mozilla\Firefox\Profiles\a68y42cd.default\Cache\1EF26877d01"​

2. When trying to change MSconfig for Normal Startup mode. I got error: "An access denied error was returned while attempting to change a service. You may need to log on using an Administrator account to make the specified changes." But, I am the administrator account on this machine. After I reboot, however, it looks like MSconfig is in normal mode.

======================

Sorry to be so long-winded. But, I wanted to give you all the details. Does it look like memboot is still around? I did see MGTools found "HelpAssistant" user in the registry (UserInfo.txt). Am I missing something by not being able to run ComboFix.exe?

Thank you SO much for your help.

Steve

 

Thanks for the help! I ran the programs, but hit a few snags.

1. After I ran Avenger and rebooted, I got the error "Windows cannot find 'c:\cleanup.exe'." I just clicked "OK" and moved on. Is that O.K.? Where was I supposed to get cleanup.exe from? It does appear to have deleted the Temp folder files $$$dq3e, $67we.$, xsw2.

2. I ran CCleaner and it cleaned up some things in: C:\Documents and Settings\Steve\Local Settings\Temp\, but it was not entirely emptied. So I manually deleted the remaining items.

I'm curious what you think about the MBR.exe output from my original post. Does the "malicious code @ sector 0x06FC3DC2 !" line mean I'm still infected? It's still showing up.

I expect there's a bunch of cleanup to do now?

Thanks a bunch for all of your help! This thing's been killing me.

Steve

 

I'm still not able to download ComboFix. I get the same error as I mentioned in my first post. When I click to download ComboFix.exe to my desktop I get error "C:\Documents and Settings\Steve\Desktop\ComboFix.exe could not be saved because you cannot change the contents of that folder." And, simultaneously I get McAfee Trojan Removed notice:

"McAfee has automatically blocked and removed a Trojan.
About this Trojan
Detected: Artemis!1EF40581675C (Trojan), Artemis!1EF40581675C (Trojan)
Location: C:\Documents and Settings\Steve\Local Settings\Application Data\Mozilla\Firefox\Profiles\a68y42cd.default\Cache\1EF26877d01"​

When I click download again, I get:

File not found: Firefox can't find the file at http://download.bleepingcomputer.com/sUBs/ComboFix.exe.​

Is there some trick to downloading ComboFix?

Thanks, Steve

 

O.K. - Turning off McAfee worked and I downloaded and ran ComboFix. My log is attached. I look forward to your reply. I really need to make sure this machine is clean and appreciate all your help.

And, I'll happily rerun any of the other scans to make sure this thing is gone (SAS, Malware, Root Repeal, MG, Avenger, Prevx, etc.).

Thank you, Steve

 

O.K. I did all the cleanup steps. I hope it's gone. I have a couple questions:

1. I'm curious what you think about the MBR.exe output from my original post. Does the "malicious code @ sector 0x06FC3DC2 !" line mean I'm still infected?

2. Is there any indication (logs, etc) where I got this mebroot trojan? What site?

Thanks a ton for all your help!

Steve

 

TimW,

Thanks for all your help with this. Before I start using this computer again for sensitive stuff, I still have one nagging question. I'm curious about the MBR.exe output that says "malicious code @ sector 0x06FC3DC2 !" I hate to keep bringing this specific question up - looking back I've asked about it several times. But, it still concerns me. I just ran it again and got the output below. Does this mean I'm still infected? Or, is it O.K.?

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x06FC3DBF
malicious code @ sector 0x06FC3DC2 !
PE file found in sector at 0x06FC3DD8 !​

Thanks a ton!
Steve

 

Ran ComboFix.exe and attached log.

Thanks a bunch for looking at this!

Steve