Possible Zero access rootkit?

Welcome to Major Geeks!

Yes ComboFix removed the major parts of your Zero Access infection. You have some problems with services not running.

Code:

   Base Filtering Service is NOT running  
        C:\Windows\system32\bfe.dll exists  
.
   Windows Firewall Service is NOT running  
        C:\Windows\system32\FirewallAPI.dll exists  
.
   Windows Firewall Authorization Driver Service is NOT running  
        C:\Windows\system32\driver\mpsdrv.sys is missing  

Let's continue. You will have to reboot your PC several times during the below. Please do not skip any of these as it will affect the process negatively if you do.


Now please also download MBRCheck to your desktop.



See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now download SubInACL.msi from Microsoft.

• Now double click on SubInACL.msi to run the installer. Accept any prompts you get about installing this.
• Now download the below file and save it to your Desktop:
  • resetperm-x64.cmd
• Now right click onresetperm.cmd and select Run As Administrator to run this script. Be patient as this may take awhile to run. Also it is imperative that you Run As Administrator. This is not the same thing as your user account having administrator priviledges.

Once it finishes, reboot your PC.



Now press the Windows key and the R key at the same time to bring up the Run box. Type in regedit and hit OK.

• Then in the Registry Editor click File, Import.
• Navigate your way to the C:\MGtools folder and locate the fixW7BFE.reg key and select it.
• Then click the Open button and allow this to be added into your registry

Tell me what happend exactly. Like do you get any error messages or do you get a success message?



If you received a success message then repeat the above import but with below to files from the MGtools folder.

• fixW7FW.reg
• FixW7FWdrv.reg

Now no matter what happens with importing the above registry patches, just continue with the below.


Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.



After reboot, Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• the log from MBRcheck
• the C:\combofix.txt log
• C:\MGlogs.zip

 

Yes there are. First we had to make sure all the malware was removed. Now I see another potential issue. Note that MBRcheck does show an Unknown MBR which may or may not mean your MBR is infected. Do you have your Vista Boot DVD? We may have to fix your Master Boot Record.


Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

• Now open Repair_Windows.exe
• Go to Start Repairs tab.
• Choose "Custom Mode" and press "Start".
• Create a System Restore point if prompted.
• In the Custom Mode window, select the following repair options:
  • Reset Registry Permissions
  • Register System Files
  • Repair WMI
  • Remove Policies Set By Infections
  • Repair Winsock & DNS Cache
  • Repair Proxy Settings
  • Repair Windows Updates
• Now click the Start button.
• Be patient while the tool repairs the selected items.
• If asked to reboot the computer for the changes to take affect, make sure other tasks in the program are not still running before accepting to restart.

Please download MiniRegTool.zip and unzip it.

• Run the tool.
• Copy and paste the following into the edit box:
  
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFE
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSSVC
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSDRV\0000
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpsdrv
  

• Check List Permissions radio button.
• Press Go button and attach the result (Result.txt) that pops up. A copy of Result.txt will be saved in the same directory the tool is run.

Now click Start and type regedit into the Search box. You should see regedit.exe and its icon appear up above. Right click on this and select Run As Administrator to run the Window Registry Editor with Admin permissions.

• Then in the Registry Editor click File, Import.
• Navigate your way to the C:\MGtools folder and locate the fixW7BFE.reg key and select it.
• Then click the Open button and allow this to be added into your registry

Tell me what happend exactly. Like do you get any error messages or do you get a success message?

If you received a success message then repeat the above import but with below to files from the MGtools folder.

• fixW7FW.reg
• FixW7FWdrv.reg

Now reboot your PC, then download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• Results.txt log
• C:\MGlogs.zip

 

The last fix, got your services for your firewall fixed.

Okay then let's try the below easier method first. If it is not able to rewrite he MBR, you will have to find your Vista DVD.

Let's see if we can get your PC to boot up into the System Recovery Options. Normally this comes preinstalled as part of Vista and Win 7 PCs. Sometimes, it is possible to repair an MBR from this.

Enter System Recovery Options.


To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
​

• Select Command Prompt
• At the command prompt, type in the below commands and hit enter. The last command will cause your PC to reboot. Allow it to boot normally.

bootrec /fixmbr
exit
​

After reboot, rerun MBRcheck as you did earlier and then attach a new log from it.

 

Okay that looks good now.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome. Surf safely!