presumed rootkit query (before sticky etc)

I have followed the sticky. I wanted to ask your advice before you suggest anything else because of my observations... question first, explanation after.

1 - If I have a rootkit problem and try to resolve it by reverting to factory settings, nuking, and reinstalling OS, could the RK find a place to hide and re-emerge?

2 - If not, as in its existence in the wider ether it knows my ISP, login, and password etc, can it send packets back and re-infect that way?

I ask because I got a reconditioned Dell computer in to keep working on and to communicate with yourselves to hopefully rid the rootkit problem on my proper computer (I was being helped on this forum a few months ago but work pressure meant I couldn't do both. Lived with the RK for a while, then the computer builder carried out the first above process - successfully/unsuccessfully).

Leaving aside the old computer, the new computer had a large unexpected download the second I went online, followed by various unexpected happenings - eg "something is writing to the Start Menu", "something in the start Menu is pointing to a file that doesn't exist", and Norton update download difficulties and running in safe mode (Norton came supplied).

I contacted both ISP and computer company the next day (6 days ago). The ISP is dismissive, the computer company are unsure what they're dealing with but believe me that there's something wrong (more things now not working as they should). They've asked me to try a built-in route for settings restore, and that having failed now want to go down the CD and factory settings route.

Two files stand out on both computers, both are accessed on bootup. Sweeper.cfg at 0 KB and kspydoc.log. On my old computer this runs to 1000 pages - I printed a few out - where it's also the most fragmented file. Sweeper.cfg features in the log. On the new computer the file is much smaller.

My research suggests sweeper comes from Spy Sweeper - I did download this on my old computer when following your then sticky (December), but didn't last Saturday when following the (Saturday) sticky on the new computer. The only other download I've done on the new computer is Spyware Doctor which I have a paid for version of.

I realise I have given only an outline of the problem but because of my experience I am apprehensive of the factory settings route working - and equally being online for advice/tools while removing problem on same computer.

I am currently emailing from another computer/connection.

Many thanks in advance for your help and experience.

 

Hi tamar,

Please post all new logs. We'll see what is there and what needs to be done.

If the company that built your computer, did a "Clean" install of the OS then there should not be a RootKit on your computer. RootKits require user interaction to be installed. In other words you have to install a piece of software that contains a RootKit. RootKits in and of themselves are not malicious they are used to hide programs from the Windows API. What a RootKit is used to hide may or may not be malicious in nature.

 

Hi SPD

thanks for getting back. Haven't attached any logs - I am TOO SCARED to go online at home! Going online seemed to make things worse.

Regarding the Dell ("new" although reconditioned computer) I need to communicate again with the company on that problem early next week, but thanks for your advice in the meantime.

Regarding my "old" computer, can I describe what I saw done for the 'clean' install. Then if you can let me know if it was clean or not I can send logs - though will have to do the sticky procedure anew for the 'old' computer.

Had win98 with 3 partitions, and upgraded to XPpro at reinstall. He wiped just the c partition, deleted it and re-made it, converted it to NFTS from fat32. Then loaded XP, then deleted/remade/converted the D drive. Left the e drive as is with my files. Did updates etc, sticky procedure etc, lots of problems with software settings reverting especialy after doing av etc updates.

Each reinstall had to start with a driver update floppy. He downloaded it at his place but put it onto floppy on my machine.

Tried more reinstalls myself with no success.

Next he reverted the hard drive to factory settings via floppy (or maybe CD). But when he put his nuking disk in we could still see partitions. I was lost... he set the nuke disk to do a German one - 7 passes over entire drive that took 10 hours. but when it had finished it suggested it had cleaned only one partition. Then (I think) reloaded the OS (using a newly made driver update floppy, made on his) and windows and drivers updates from a CD. Re-partioned using partition magic. Defrag - the opening and closing pictures showed what I would describe as a pillar about a third along, nothing in it but files either side.

Well all this suggested something hadn't gone away. You did say something before if I didn't clean everything off things could get worse. Yes definitely!

I have to (try to) catch up with work this weekend, but will go online early next week and do the sticky. But first will download all that software on to CD elsewhere and reinstall afresh.

Thanks again for your help - and knowledge!

 

I don't think your problem is a RootKit. It looks like your problem is caused by multiple incomplete/improper installations of Windows XP. You are going to have to do a complete fresh installation of XP.

Start by downloading and copying to Floppy or CD any hardware drivers you are going to need for Hardware that Windows does support natively.

Next download the Hard Drive Manufacturers utilities for you Hard Drive. These are generally available in both Floppy and CD format.

Next download the Knoppix 'Live CD' image from www.knoppix.org. Create a bootable CD from the image file, do not just burn the file straight to the CD. It won't boot and work if you do that.

Try to boot your computer normally, and copy all files that you want to keep. If you have problems booting normal, put the Knoppix CD in the drive and reboot. Make sure your computer is configured to boot from CD. You can use Knoppix to backup the files you want to keep.

Once you have backup copies your files, log out of knoppix. put the HDD utilities CD in the drive and reboot. Remove all partitions from the drive. Create a new Windows XP partiton. Exit. Remove the CD.

Put your Windows XP Installation CD in teh drive, boot and install WIndows. If this is an Upgrade edition it will ask for your previous Windows CD to verify you own a previous copy of Windows. You will also be asked for the drivers disk if there are any drivers you need to load during the installation process.

Hope the above didn't confuse you.

 

Hi thanks... wil print out and download all the drivers etc from another computer and follow procedure, but will in a moment or six send a copy of the
HjT file from 3 feb made straight after following the sticky, and update from yesterday.

(yes, on first reading it sounded confusing, but if I am confused later will ask)

 

Attached – HJT log (copy) from 5 Feb after running sticky. Typed as is – used to be a proofreader so believe there are no typos (eg cap S and lowercase s in ‘System32’ are copied as shown).

Log yesterday showed no apparent change other than C:\WINDOWS\system32\wuauclt.exe isn’t there but C:\Program Files\Microsoft AntiSpyware\gcasServ.exe is (as well as \gcasDtServ.exe).

Your comment about bad installation rings truish – The only software I have reloaded is Office Word and excel (Office2003update on to Works) (plus a few listed below).

Nero was giving problems before when writing to CD – the CD would come across as lazy, not wanting to spin but starting a little every so often, and then after some minutes all would be OK. Or perhaps it’s always like that and I never noticed before. Also settings seemed to change themselves.

The man who did the factory settings just before this HJT also used a programme to remove Messenger from appearing in the taskbar, and added a programme called DefenseWall. I later saw in the events log that it was timing out so uninstalled it it not being ‘approved’ as far as I know by MajorGeeks! I don’t see it in the first HJT log though. I think he might have installed UPHClean too, I’m unsure what it is and what it’s doing so have left it for now (for asking about).

The %systemroot% entry might refer to a scandisk I was trying (following your earlier instructions) – every boot there’s an error message about not being able to scan, umm, something (sorry should have written it down) and Idon’t know how to undo it!

Regarding Rootkit – had read about the Sony CD one. Last April/May I did instal some of my music on to my computer which included 2 sony Music CDs – though would have thought both were too old for their rootkit business. Sometime after that I did notice a quirk on the av software interface which always proclaimed my defs were up to date even when updates were downloadable. Queried it with the company and I think we both shrugged our shoulders. The new computer I have put nothing into except 5 connections at the back.

Would appreciate any suggestions on deletions or other or whether to go ahead with instructions as you posted just before. Many thanks in advance.

Will be around for about another hour.

 

There's nothing unusal in that log. I really think your problem is with the OS not being installed properly.

 

OK, will try a new fresh install, thanks. I think I follow the instructions but just two questions...

Can you advise me what I should see once loading the HDD utilities CD? THis is the stage where I saw nothing last time (I think). I'm sure it will all be obvious when I do it, but I'll be unable to ask then.

How can I tell if I'm set up to boot from CD?

On the Knoppix site I can see only Linux downloads - I'm sure that's intentional but just checking.



Have looked a bit more into the sweeper.cfg and kspydoc file and read they're intentional Spyware Doctor files - that's a relief! The kspydoc file sounds really destructive!

Thanks again for your help.

 

The menu for the HDD utilities vary slightly from one drive manufacturer to another. Basically what you want to do is remove all partitions and then create a new NTFS windows partition for XP.

 

OK, thanks for that advice.

I have an IBM Deskstar 120GXP 41.2GB UDMA100 (on receipt). The HD doesn't feature in Device manager (as far as I can see). I found this page for the HD utilities, but am unable to download the exe to check which version - the javascript won't display (their error message).

http://www-3.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-44195

Also looked at http://www.hitachigst.com/hdd/support/download.htm - and felt daunted! Nothing I can see says 'utilities' though perhaps all of them are. Which should I be downloading please?

I am on my own computer now, stuff is downloading even when all windows are closed...

Thanks for your help again.

 

You want the Drive Fitness Test download.

 

Thanks, got the Hitachi one sorted... but now struggling with Knoppix download

 

This is the torrent DL for the Knoppix CD ISO, You need a torrent Client like Bit torrent.

http://torrent.unix-ag.uni-kl.de/torrents/KNOPPIX_V4.0.2CD-2005-09-23-EN.torrent

It may take a few minutes for the Download to start, and depending on how fast your connection is; hours to complete.

 

BitTorrent! Brilliant concept, love it! Unsure whether I can ask/persuade friends/relatives/library/business-centre owners the same, especially for hours-long downloads.

Have been researching broadband packages and am about to switch, though the speeds around here are still 'slow'. I will be back... it may be 10 days considering work and broadband arrival; and having to get the 'new' computer fixed for the download.

 

Hi SPD

Tomorrow will start downloading the programmes you advised a couple of weeks ago on an alternative computer (this one) - a replacement to the one I got in 4 weeks ago for same purpose.

On this alt-computer I just ran the sticky through to be sure it's squeaky clean. Can I check something with you first?

What it specifically is is in the adaware log, where it shows running processes. Two entries are shown as being in a drive

\??\:c\Windows\System32

is this right? File attached, also hjt (I know about the myway entries. Will leave them temporarily. A few things I don't know what they are but look legit)

Here is the minimal stuff that happened during the sticky.

Everything downloaded and installed fine (except see below), though I had a problem locating one of the progs (Spybot?) from your link and did it instead via their home site.

Spybot, when installing (blue advancing line/squares) occurs with a greyed out not blue topbar. Went to Spybot advanced mode > settings > ignore all products. Window was empty! Other windows in settings weren't. Rebooted and the list was there, rightclicked and deselected. When in safe mode advanced option was 'off'. Ran procedure again after advanced mode etc.

Ccleaner - (in safe) shows stuff as deleted but after a reboot is still there (some anyway).
MS malicious - clean
adaware - 3 MRUs (left for now, related to computer supplier)
- 10 cookies - deleted
spybot - 2 registry changes: windows security center - antivirusdisablenotify and firewalldisablenotify (deleted, but were legit because supplied mcafee is running alternate ones - was prompted for disabling them again on restart)
win defender - clean
bit defender - clean
panda - 8 cookies

Many thanks in advance for your help.

 

Both of theses processes are legit.

#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 184
ThreadCreationTime : 11-03-2006 20:29:04
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 208
ThreadCreationTime : 11-03-2006 20:29:05
BasePriority : High

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

Choose Kill Process

Open Windows Explorer, navigate to and delete the above file.

If you want to unistall MyWay which came with the Dell, you can uninstall using Add or Remove Programs in teh Control Panel.

Other than those 2 things your log is clean.

 

Thanks. Still seems odd to have a ??\ location, but if you say it's fine...

I'll 'kill' the line you suggested, and the myway later on.

Will be back once everything else is downloaded.

Cheers

 

Have done all that but within that same Temp folder is another folder

C:\DOCUME~1\ROBINT~1\LOCALS~1\Temp\clclean.0001.dir.0000\

with 7 files, all have the same modified date which was startup just now.

~de1785.tmp
~df394b.tmp
~efe2.tmp
ActivationGui.dll
ApiExShell.dll
Ky5s96SF.csa
PfdRun.pfd


Anything to worry about?

Thanks in advance

 

sorry not to have got all into one mail.

The clclean.0001 file recreated itself after reboot. I ran Ccleaner again which found 13 files in the clclean.0001.dir.0001 folder (analysis first) but didn't delete two ~df394b.tmp (682 KB) and ~efe2.tmp (0 KB), or the clclean.0001.

?

Thanks.

 

You'll want to delete thoses directories.

 

I tried again with HjT kill process first, and then manual deletion. The two temp files said they couldn't be deleted as being used by another process (or was it 'user' - tho I'm the only user).

Booted to safe, was able to delete them through 'my' user account, but they weren't there - or I couldn't find them - in the administrator account.

Rebooted to normal - the folder and 7 files are back.

What is it? How to completely get rid of it?

Thanks in advance.

 

Download Blacklight Beta from here:
http://www.f-secure.com/blacklight/try.shtml

• Hit I accept. It will take you to download page.
• Download blbeta.exe and save it to the Desktop.
• Once saved... double click blbeta.exe to install the program.
• Click accept agreement and Click scan
  This app too may fire off a warning from antivirus. Let the driver load.
  Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please post contents of log.

 

Blacklight beta didn't show anything, here's the log.

 

One of these scans is going to show what is causing those files to regenerate.

Follow the directions for Running WinPfind by OldTimer.

 

Hi - I may have found out already - or rather WinDefend has, according to the Event Viewer - system logs.

I have saved a file - it's VERY big, so will edit down to the relevant parts and then post for you to see before I download your suggestion.

I am still within the 7 first days of this Dell machine. Unlike last time where stuff just flooded in, this time as much has been going out as coming in.

Back in a mo

 

Here is the Event Viewer log edited, from around the time that I started downloading the sticky list.

 

The Windows Defender log isn't very easy to read.

When you get a cahnce post the WinPFind log.

 

here's the winPfind - ran for 2-3 mins.

Thanks.

If necessary I can pull out the more relevant parts in the log. I was unable to download winpfind in firefox - the log shows firefox has been modified.

I'll be off to bed in about 10 mins, will carry on tomorrow, thanks again for all your help.

 

sorry forgot the main bit!

 

should probably add - have been having trouble with Sonic Update manager after boot, ciruclating error messages - needing something to be installed: UM.MSI . Later unable to find Installshield - it's not in Control Panel, but was when the computer arrived. Messages began after I uninstalled some unwanted programmes eg aol/tiscali isp things, cine player etc (part of sonic but didn't know at time). Didn't uninstall Sonic Update.

Later tried to uninstall Spyware Doctor - system hung, uninstallable through both +/- progs or official SD uninstaller. sweeper.cfg is mentioned in the event log posted.

Looking back in notes, there was something odd with Mcafee Spamkiller download, something writing to start menu - dell service agent picked it up and 'sorted ' it.

I have noticed that as many packets more or less go out as in, yet other than one emailing circular (please let it be clean!) I'm not really sending much.

Don't know if it helps.

Cheers.

 

Hi SPD

I have raised the issue/s with Dell. Maybe you should direct your time to others while I'm waiting for their response... unless you feel there's something I should tell them following the WinPFind.

Meanwhile have bought a Knoppix Cd so tomorrow can start sorting my original computer.

Thanks again for all your help.

 

There isn't anything in the WinPFind log to be concerned about. Let me know what Dell comes up with.

 

They haven't come up with anything yet... except a fix for the Somic Update Manager.

They said this computer hadn't been used by anyone before me, yet two of those entries in WinPFind are dates 13 January, another 14 Feb. Others 23 Feb which ties in with dates seen in Add/Remove Programs when I got it on 8 March. They haven't said yet whether that was them during their setup/install but there were already 15 or so windows hotfixes there for same date, one still has that date. another load have no date.

I can use the last-used-23-feb programs but the date stays on 23 feb (eg DellMediaExperience - I looked at it rather than used it!). Others are listed but don't exist (under my computer), eg Sonic Update Manager - folder there but only a 1KB entry.

I looked just now in Start>Search>files and folders. Under Look In's menu is

Local Hard Drive (C)
My Documents
Shared Documents
Local Disk (C)
DVD/CDRW Drive (D)


Windows Explorer>my Computer doesn't show a local hard drive C. Or have they partitioned the drive with a local disk drive C and hidden the rest?

It's very weird. Or am just paranoid?

The clclean0001 folders have started reproducing instead of recreating. They are now named clclean.0001.dir.0000 and the last numbers are increasing sequentially, eg 0001, 0002 etc. Same files inside.

The Knoppix hasn't arrived yet.

Thanks for any explanation you can give...

 

Also...

have edited the event viewer log to just win defender entries, and also an extracts one which shows particular entries regarding system restore and some drivers etc. Some are repeated often, some occur just after remote access 'allowed'.

I don't know if they are relevant, but the system restore entry was in the log with an incorrect-time entry

 

SPD - the Knoppix CD is here (for the original computer). Am having difficulty (what's new?) setting the computer to boot from CD - will ask some advice on this in the hardware forum and once the Knoppix is booting the system will come back here for your expert help.

Regarding the Dell and clclean.0001 - they still haven't come back on it. WinDefend logs show it's a Cleaner from Macrovision, though I couldn't find it mentioned on their website. But did see they make Installshield, which I have been/am still maybe having problems with on the computer.

Thanks for everything so far.

 

I have no idea what clclean.001 is, and can find no inforamtion on it. It certainly looks like an archive of some type.

Upload clclean to http://virusscan.jotti.org/ for analysis.

 

Thanks for the suggestion. Ran clclean.0001 and all associated folder files through there - all came back "OK". Only one ~efe2/tmp wouldn't scan because it is a 0KB file.

It seems to have affected the malicious tool remover update yesterday. Downloaded OK but wouldn't install first time, did second time. Later, after the computer was left on for a few hours but disabled-from-wireless-connection, I found Internet explorer's address bar had disappeared, which wasn't to do with toolbar settings in 'view'. Found instructions to remedy on MS website - delete a particular registry key, which worked. Later the malicious tool update downloaded again, again trouble on first install but second 'OK'.

You might say use Firefox - I was until I saw Windefender pick up on it - but perhaps that's just MS competitiveness getting in the way. I blocked Firefox from accessing the web in Mcafee, but it keeps unblocking itself.

Still haven't heard from Dell but have been out most of the day.

Any other suggestions to try are welcome - and thanks for being there and knowing so much! And knowing when to say when you don't know what it is (unlike Dell!).

 

Hi SPD... the following relates to my original computer problem, not the Dell and clclean.0001 discussed more recently in this thread - would it be better to start a new thread for this (multiple bad OS installations)?

I had some wonderful advice from halo on the hardware forum

http://forums.majorgeeks.com/showpost.php?p=755414&postcount=1

I ran the Hitachi drive fitness test, and it did find some bad sectors. Set it to erase the disc and reformat. All seemed to go well, but it took a VERY long time on the last sector. But eventually showed everything as OK - and I ran it again to be sure, and then again as a quick test.

This was running an ATA test full test, not a ATA+SCSI. If I also need to run that I don't know under which of the four options - the first was adaptec, which I tried first but lots of failed somethings etc came up so I escaped and ran the ATA as above.

Rebooted with Windows XP SP2 pro upd. On boot or was it just as Windows began its thing, a message came 'no array found', followed by 'array created' and then Windows continued. It asked for a previous version - put in win98 sp2 (upd CD) but it didn't recognise it. I took it out and tried again, still didn't. But looking back on the screen it had moved on and was (it said) showing existing partitions and to choose one for windows (or something). In the box below was a message about no CD found in drive.

I rebooted and tried with the win 95 (full) CD. Same message.

Rebooted to Knoppix, rebooted to Hitachi CD, re-ran cleanup. Showed the disc to be OK. Rebooted to Win XP - NOTHING! No CDRW activity at all! Rebooted to Knoppix - and think I'll leave it running in case the CD drive won't open.

Some things I noted during Hitachi CD.

It gave the device drives as
00 Atapi primary master Zip iomega
01 Atapi Sec master CD ROm LTN 526
02 Atapi Sec slave CDRW Lite-On LTR5232
03 ATA PCI IDE master IDE...

but didn't list the floppy drive. I can see the floppy light come on during a boot. And can see all the other drive lights on in order as above.

As you'll see in the previous thread I had trouble moving the CDRW to the top of the list, or moving any around anywhere, but I thought it was OK as it was booting still from CD.

Originally floppy was first boot device - it was changed when the system builder tried wiping the HD. He said he'd wired it directly to the HD, and had to unplug the zip to do that (or similar). He did unwire them again afterwards, but possibly didn't change the boot order back (but I think he would have).

I hope, she said glumly, I haven't made things worse than they were...

What shall I do?

(regarding Dell computer/clclean.0001 - they phoned today but missed me. If it's archiving, the archived files are all same size. What is happening is a ton of stuff heading out of the computer, far more than usual and far more than coming in.)

 

It would probably be best to start a new thread for this problem.

The Hitachi DFT is only looking for and reporting IDE devices.

Your drives should be setup as follows:

HHD as Primary Master
Iomega Zip Primary Slave
CD Rom LTN 526 Secondary Master
CDRW Lite-On LTR5232 Secondary Slave

 

hitachi and multiple bad OS installations

New thread from
http://forums.majorgeeks.com/showpost.php?p=756907&postcount=38

How can I change them? Is a physical thing to be done inside the case?

Thanks again

 

oh, it didn't work as a new thread! I'll try it again

 

Re: hitachi and multiple bad OS installations

Yes, it's a physical thing that has to be done. Jumper settings on the drives have to be changed and the order of the drives on the cable may need to be changed.

 

http://forums.majorgeeks.com/showthread.php?t=87917

I put this on a new thread as you suggested, and will reply to this there too.

Thanks