Rootkit UAC - removed

As some of you folks out there in MG land may know, I like to occasionally post little tid-bits about viruses/malware that I've dealt with. Yesterday I removed the UAC rootkit for bazillionth time, but this time I took some screen shots of the file lists. So- this dude brings me his PC saying that he had a virus and "took it out" but now the ethernet driver is messed up and MB driver CD isn't working and it's all my fault because I sold and installed the motherboard (over 18 months ago). Being the nice guy that I am, I said "if it's a hardware problem, I'll warranty it even though the motherboard is no longer covered by the factory warranty". So I boot to WindowsXP, go straight to the Device Manager, and yes, the network driver is loaded correctly, but the PC is not going on line, will not run IPCONFIG, and other strangeness. I immediately think "malware" and rebooted to a PECD. I browsed straight to the System32 folder, and sure enough, we have the UAC rootkit (a very close relative of the TDSS rootkit). I deleted all the UAC files from the System32 folder; this rootkit usually drops a file or two in the System32\Drivers folder, so I went there and deleted the single file found. I then ran a search of drive C: for anything with a UAC in it (screen shot #2 below) and deleted the offending files. Once I found the first UAC file, identifying the others was easy because of the time and date. If any other files had a UAC, but a different date, chances are it's safe. To sum it up- after removing the files in a 'safe' preinstallation environment, I booted to the XP desktop again, and internet connectivity had been immediately restored by the simple fact that the UAC files had been deleted. I then ran deep scans with MBAM and SUPERantispyware and a couple others, and all is well.
:cool

[dlb]

(in the first screen shot below, the 3rd file listed was in the System32\Drivers folder)

 

It's usually hard to block something with an antivirus when the person is persistent in installing it, warez/torrents. Rootkits are even harder for an antivirus to block as they are many times never even "seen" installing. Especially the newer ones.

 

after 2 hours of pissfarting around with malwarebytes and scanspyware finding and "removing" this stupid thing only to have it reappear i finally seem to be rid of it. thanks heaps!