Possible Rustock Infection (scan logs inside)

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Neilus, Mar 14, 2010.

  1. Neilus

    Neilus Private E-2

    So about a month ago now my ISP contacted me saying that my computer had been infected with a Rustock trojan, rootkit thing and that my computer was kicking out spam at an alarming rate. Having installed Wireshark I noticed that this was, indeed, the case.

    A fully updated version of ESET's NOD32 scanner appears to have stopped absolutely nothing and no scans I've attempted with other scanners have turned up with anything.

    I've noticed that my computer only kicks out spam in drips and drops unless I am running a bittorrent client (i've tried several) in which case it starts transmitting like crazy (even with no actual torrents running in the client).

    Hopefully this helps. You guys are pretty much my last resort... :)
     

    Attached Files:

    Neilus, Mar 14, 2010
    #1
  2. Neilus

    Neilus Private E-2

    More logs.
     

    Attached Files:

    Neilus, Mar 14, 2010
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Nothing is showing in your logs, so you need to find and delete any infected emails yourself.

    Malware detected in email databases has to be cleaned up by you. You have a few choices:

    1. delete the whole file which is not an option you normally want to use
    2. load the email folder that contains the infection and delete ALL unnecessary emails (hoping to remove the problem email) and then use the Mailbox Cleanup option to delete all old emails. Then compact the Outlook database to permanently remove data. See http://support.microsoft.com/kb/196990 If you do not cleanup and compact the databases, the deleted emails may still be leaving hidden information in the database that you just cannot see but a scanner may still pickup on it.
    3. create a new folder and move only emails you really need into the new folder and then delete the infected folder.
     
    TimW, Mar 14, 2010
    #3
  4. Neilus

    Neilus Private E-2

    So here's some more info. I don't use Outlook or any other email client with any of my computers. I always use Firefox and Hotmail for all my email, so to my knowledge no emails are stored locally.

    The infection has spread to a secondary laptop aswell (Wireshark has picked up spam on that machine too). I've noticed that on both my desktop HDD and my external HDD there's a hidden folder called "System Volume Information" in the root directory (probably supposed to be there, i'm not sure) which cannot be edited, deleted or opened. Upon attempting to do so, I get an error message that reads C:\System Volume Information is not accesible. Access is denied. The laptop appears to have no such folder.

    However, after attempting to do a Low Level Format on my External HDD (using this http://hddguru.com/content/en/software/2006.04.12-HDD-Low-Level-Format-Tool/) I got a notification in my taskbar telling me there were errors in the System Volume Information directory on the drive (supposedly after it had just had a zero-fill format).

    Would any further scans or Wireshark logs help? I'm hoping that a solution exists that doesn't involve me simply wiping all my HDDs and starting over.
     
    Neilus, Mar 15, 2010
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your system volume information folders are your restore points. The only way to remove them is to toggle system restore.

    After you toggle your system restore, run your scans and tell me exactly what is reported ( a log if it creates one).
     
    TimW, Mar 15, 2010
    #5
  6. Neilus

    Neilus Private E-2

    System Restore has been turned off (annoying how Combofix turns it on everytime it runs) but I still don't have access to my System Volume Information folder.

    Having turned System Restore off, i ran all the scanners in the Malware Removal Guide. Here are the logs.


    Would it be at all helpful if I scanned the laptop and posted logs from that aswell?
     

    Attached Files:

    Neilus, Mar 16, 2010
    #6
  7. Neilus

    Neilus Private E-2

    More logs.
     

    Attached Files:

    Neilus, Mar 16, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    There is no malware showing in your logs. You can use windows explorer to find and delete:
    C:\WINDOWS\system32\-1.

    You can not access the system restore folders.

    What malware issues are you having?
     
    TimW, Mar 16, 2010
    #8
  9. Neilus

    Neilus Private E-2

    The computer itself appears to be running fine, however my isp (TPG Australia) is under the distinct impression that it's sending out spam emails on a daily basis. They say that it's a Rustock Trojan but seeing as they're extremely unhelpful and nobody's actually been able to identify the problem I'm taking their word on it.

    I was told to run Wireshark (not by my isp) to see what was going on with my network traffic and after getting it to show only traffic going through port 25 and ICMP (filter string looks like this: tcp.port eq 25 or icmp) I see just over half a dozen packets being sent a day. However, if I attempt to use any bittorrent client (utorrent, Vuze etc.) the floodgates open and I get several pages of results in only a few minutes.


    C:\WINDOWS\system32\-1 has been deleted and System Restore is off but still no luck. Wireshark is still going nuts.

    Would Wireshark logs (hopefully) explaining this network traffic help in diagnosing the problem?
     
    Neilus, Mar 17, 2010
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Opening Utorrent will result in a flood whether you are infected or not. I don't know it the Wireshark log will help or not, but I will look at it.

    Did you ever remove all your suspect emails? Did you create a new folder for emails and delete the old one?
     
    TimW, Mar 17, 2010
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds