Nasty Rootkit Help needed..

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Motoko, Aug 20, 2011.

  1. Motoko

    Motoko Private E-2

    Hello, and welcome to my nightmare :)

    First off, I am on a second hand shared laptop (between four) and I don't know or know how to find out where this virus came
    from originally. I first noticed something was wrong a few days ago when the windows7 firewall stopped running unprompted
    (got a pop up warning).

    so I tried starting it up manually in services and got the following error message:

    ----------------------------------------------------------------------------------------------------------------------------

    Windows could not start the Windows7firewallService service on Local Computer.

    Error 5: Access is denied.

    ----------------------------------------------------------------------------------------------------------------------------

    There are no other user accounts just a main admin account with user accounts disabled and no system restore enabled.
    I soon realized ALL the security had been disabled and I didn't have permission to re-start the services even as admin.
    I knew something was not good, checked task manager and noticed a nefarious looking .exe running, named;

    431318892:2476231398.exe with the description; 2476231398.exe

    I tried to end process/end process tree/open file location etc, nothing from the right click menu had any effect,
    the only thing that could be changed was the priority.

    I knew this might be pretty bad so disconnected from the internet and rebooted into safe mode, there I checked if the long
    number.exe was running in task manager, it wasn't so I thought that was a good thing and ran a few cleaning programs in
    safe mode. System scanned clean but I knew this must be wrong. I scanned with Avast which is up to date, scanned with various
    other malware/virus scanner programs which found nothing.

    I tried to boot back into windows normally, I got blue screen saying:

    A problem has been detected and windows has been shut down to prevent damage to your computer.

    Then I knew it wasn't going to be as easy as running a few malware programs. So I decided to bite the bullet and connect to
    the internet and research a method of identifying this *long number.exe which was still running in normal windows.
    Google revealed not a single result from a search for the number, so I started searching for methods of finding unidentifiable viruses.
    To cut a long story short; after trying various programs I end up on this website pleading with you for some help hehe.

    I have had no experience with viruses, never encountered one before so I can't say I know what I'm looking for as I don't have a good knowledge of this system.
    I unfortunately am the most tech savvy one in the house tho, and am trying to fix the problem without resorting to a reformat.
    There is no backup of this hard-drive, not even a restore point.

    (Which might be good at least the virus can't re infect via restore, as it has always been disabled).

    So, I went through all the steps set out in :READ & RUN ME FIRST Thread: all the scans seemed to go relatively well
    apart from the anomalies stated.

    Combofix scan revealed the laptop was infected with Rootkit.ZeroAccess
    (This is also referred to as Max ++ as far as I have read).
    Finally Something found it, but now I'm worried!!

    However, during the scan there was a warning "ComboFix has detected rootkit activity and needs to reboot machine".
    The laptop rebooted and CF carried on running producing the log which is attached.

    After a restart I scanned with Combofix for a second time and it went through the scan with no mention of a rootkit this time and no restarts, I don't know if this is good or bad.

    During scan with MGtools I got a pop-up window with the following message:


    ----------------------------------------------------------------------------------------------------------------------------


    Improve Hijack this by reporting this error *(I don't know what Hijack This has to do with MG, I didn't have it running)*

    click yes to submit (I clicked no)

    Error details: Unexpected error at procedure'ModRegistry_IniGetString(SFile=system.ini,sSection=bootsValue-shell

    Error #5 - Invalid procedure call or argument

    windows version: Windows NT6.00 1905 MSE Version 7.0.6001.18000

    Hijackthis version 2.0.4

    ----------------------------------------------------------------------------------------------------------------------------


    However it still produced a log so not sure if this information is even relevant.

    So I am pretty much in the same position I was to begin with apart from now I am aware that there is a nasty rootkit somewhere on the machine. Also somewhere along the line the mysterious .exe vanished from task manager never to be seen again.

    I know this thing isn't gone, my permissions still seem messed up and I don't dare do anything until I know it's not key-logging everything typed or doing something worse. I don't trust that it is gone, From what I have read so far this is a quite clever and adaptive virus so I think I need help with this now.

    I truly truly appreciate the time you take to help people with this stuff, I mean that genuinely. If there were more like you the world would be a better place.. and that place would definitely have no viruses. :)

    I still don't have permission to enable windows7 Firewall, and I have no idea if the rootkit is still on the system. I have a feeling it has rewritten some of the registry and one other thing which is strange: out of the blue
    "Lightscribe control panel" has started loading an icon into the system tray on start up. I have never used or even seen this before and I didn't tell it to run at start-up. Don't know if this has any relevance to anything but maybe worth a mention in case the rootkit hooked itself into something to do with this program. Just thought it might be a clue.

    I will attach the logs in this and the next post.

    Thank you so much to anyone that is willing to help me with this.

    Much love.
     

    Attached Files:

    Motoko, Aug 20, 2011
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We still need the log from running MGTools -- C:\MGLogs.zip.

    Also, use windows explorer to find and delete:
    c:\windows\system32\DB56.tmp
    c:\windows\system32\85F5.tmp
    c:\windows\system32\690F.tmp
    c:\windows\system32\537C.tmp

    Go to the below link and follow the instructions for running TDSSKiller from Kaspersky

    Be sure to attach your log from TDSSKiller

    Please also download MBRCheck to your desktop.

    See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )
     
    TimW, Aug 20, 2011
    #2
  3. Motoko

    Motoko Private E-2

    Thanks so much for the response, I did have the MG tools log ready but didn't want to bump thread by posting until I got a response.

    Much appreciated.

    I will download and run the programs you have suggested and post back as soon as it is done.

    :)
     

    Attached Files:

    Motoko, Aug 20, 2011
    #3
  4. Motoko

    Motoko Private E-2

    OK, I have now deleted the temp files and run the programs suggested.
    The logs are attached.

    Is it dangerous for me to be online? I am not sure of this rootkits modus operandi, anything I should avoid doing?

    Thank you .
     

    Attached Files:

    Motoko, Aug 20, 2011
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Tell me what issues you are still having. We may need to send you to the software forum, as I am not seeing any malware in your logs.
     
    TimW, Aug 20, 2011
    #5
  6. Motoko

    Motoko Private E-2

    What about the rootkit.zero access infection that was found by Combofix? I am almost certain there is something wrong with the system.
    When I go to services if I try to start windows7 firewall I get this error:

    http://imageshack.us/photo/my-images/707/errorsxy.jpg/

    I am not certain which other services I do not have access to (even as admin):
    But this was the first thing I noticed, disabled firewall. Reading about the virus it seems the steps I have taken would not be adequate to remove this rootkit. All my software missed it, the only thing that revealed its presence was Combofix. I have read backwards engineering might be the only way to get this off the system. How can I be sure it has gone and is not just hiding from the software I am using?

    Is there anything else I can try?

    Also stupidly I used my USB drive on my potentially infected pc, could the rootkit have spread to the usb drive? If so would a format be enough to get rid of it?

    I feel nervous using this laptop now, as I am really unsure of what might be lurking on my system undetectable. I don't really understand what combofix did, as it found the rootkit.zeroaccess during the first stages of the scan, then a few seconds later said it had detected rootkit activity and must restart the computer, so I'm not sure what happened there. Does it have the power to get rid of such a thing? I understand that the virus overwrites valid drivers and is injected into other processes address space by the kernel mode driver.

    I am now in the position I dreaded, nothing showing up in scan logs but somehow knowing something is still not right.

    If you have any advice it would be much appreciated, as I am pretty paranoid now in case there is a keylogger on here, or that a hacker can get into the system or any number of hideous scenarios.

    Thanks so much for your time and help.
    M
     
    Motoko, Aug 20, 2011
    #6
  7. Motoko

    Motoko Private E-2

    Motoko, Aug 20, 2011
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
c:\windows\system32\DB56.tmp
c:\windows\system32\85F5.tmp
c:\windows\system32\690F.tmp
c:\windows\system32\537C.tmp
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below log:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Aug 21, 2011
    #8
  9. Motoko

    Motoko Private E-2

    Hello, the laptop seems to be acting the same as before I ran the scans with said programs. Still can't start the firewall service get access is denied error 5. Even with right click and run as admin (in services).

    I got the same hijack this error as stated in my previous post when running MG tools, but I again selected "no" and MG tools seemed to go ahead and run anyway.

    Attached are the logs.

    Hope they reveal something one way or another.

    Thank you for your continuing help.
    M
     

    Attached Files:

    Motoko, Aug 21, 2011
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean. You may wish to post in the software forum for assistance with your windows firewall issue. It is possible that the initial infection corrupted it.

    I know you are still concerned about your system status, but as far as I can tell, you are malware free. If you are still in doubt, the only true method to be totally sure it is clean is to reformat and do a clean install. Something I feel you do not need to do.

    Please put ComboFix directly on your desktop, not here:
    Running from: c:\portable apps\Security\AV\ComboFix.exe

    The final fix will not work for Combo unless it is on your desktop as instructed.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0

    Help Support MajorGeeks
    Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     
    TimW, Aug 21, 2011
    #10
  11. Motoko

    Motoko Private E-2

    Another thing I have just discovered is when I try to run various programs I get a pop up error stating;

    "You are not allowed to write to the registry!!
    Continue anyway?" I haven't tried clicking continue anyway.

    Is this a real windows message? Just the two exclamation marks seemed a bit dodgy looking.

    However, I then tried right click and run as administrator and it opened the programs with no error message. So that's my workaround for now until advised otherwise.

    Also looking at the program files folders some of them have;

    C:\"path name"\Virtual\MODIFIED\@PROGRAMFILES@

    I might be wrong but I can't recall seeing such file names before? But as I said I am not familiar with this system so this might be a normal path and it is just the word MODIFIED that got my attention.

    Just thought it was worth a mention.

    Thanks friend.
     
    Motoko, Aug 21, 2011
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, these sound like system errors. Do please post in the software forum for these issues and I will try to keep an eye on your thread. ;)
     
    TimW, Aug 21, 2011
    #12
  13. Motoko

    Motoko Private E-2

    Excellent, thank you so much for all your help. I would buy you a pint if i could. :)

    I will check out the software forum if the problems persist and I can't figure out how to get around them myself. I haven't even tried reinstalling anything that isn't working yet. So this might solve the problem.

    Again I appreciate very much you taking time to help me out with this.

    Much love.
    M
     
    Motoko, Aug 21, 2011
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing!! ;)
     
    TimW, Aug 22, 2011
    #14
  15. Motoko

    Motoko Private E-2

    Hello again, I really hope you see this, I have just noticed that there are three user-names under the security tab when there is only and only ever has been one account on this laptop. When I go to user account control it says there is only one user and guest account is disabled. However when i checked the properties and checked the security tab I saw that there were three accounts listed:

    http://imageshack.us/photo/my-images/4/unled1ae.gif/

    Please could you give me some advice as to what these are and if they are normal?

    Thankyou.
     
    Motoko, Aug 23, 2011
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Those are perfectly normal. ;)
     
    TimW, Aug 24, 2011
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds