Rootkit infestation on home PC network

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by fhgwdads, Jan 17, 2012.

  1. fhgwdads

    fhgwdads Private E-2

    Hi, I've just found out that rootkits are infesting no less than two of the PCs on the network in my home, as well as possibly others. The first PC to have been found was previously in rough shape - I couldn't access safe mode and was getting frequent blue screens. After running a slew of antivirus program s and GMER, I was finally able to get it into safe mode. It's now quarantined; I fear it's still infected.

    The other PC with the known infection is the one I'm currently typing this from. After the ordeal with the other PC, I decided to be safe and check this one - sure enough, GMER picked something up, but I'm not sure what. Immediately after the first GMER scan, this computer blue screened on me in the exact same manner the other known infected one had (kernel data inpage error). I immediately downloaded a new GMER exe (different file name and all) and GMER picked up even more this time. I've since run HijackThis once since, and this brings us to now.

    Any and all help is much appreciated.

    EDIT: Forgot to add PC information: both computers are running Windows 7, 32-bit; if it matters, the current PC is running Professional, and the previous one (in safe mode quarantine) is running Ultimate.
     

    Attached Files:

    Last edited: Jan 17, 2012
    fhgwdads, Jan 17, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything. Note if you cannot save things in C:\ then just save them to your Desktop. Make sure that you have disable UAC and rebooted first if you are running Windows Vista or Windows 7.

    Please follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.

    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.



    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:


    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Jan 17, 2012
    #2
  3. fhgwdads

    fhgwdads Private E-2

    Thanks. I went ahead and went through the preliminary steps and then ran the scans. I've attached logs from SUPERAntiSpyware (clean), MBAM (clean), and MGtools (which, at first, was unable to write the MGLogs.zip file until I went through the debugging steps) - neither Combofix or RootRepeal were able to run (RootRepeal gave error messages with logs, I've only attached one of the three created due to the file upload limits; Combofix installed but no blue window appeared after). I ran GMER before all of these earlier and have attached the log from it as well in case it can be of help.

    Thanks for all of the help so far.
     

    Attached Files:

    fhgwdads, Jan 17, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    So far I am not seeing anything.

    Please download RogueKiller.exe and save it to your desktop.

    • Now quit all running programs.
    • Double click RogueKiller.exe to run it.
    • When prompted, type 1 and hit Enter.
    • A RKreport.txt should appear on your desktop.
    • Note: If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe .
    • Please post the contents of the RKreport.txt in your next Reply.
     
    TimW, Jan 18, 2012
    #4
  5. fhgwdads

    fhgwdads Private E-2

    Strange... I could swear I had caught sight of something earlier. I ran Kaspersky VRT overnight and watched it catch a Trojan (or what appeared to be) before going to bed. There's no log, unfortunately, one of my housemates closed it without any of us realizing I had to save the log while in the program.
     

    Attached Files:

    fhgwdads, Jan 18, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you can, run it again and see if it reports anything.
     
    TimW, Jan 18, 2012
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds