Sneaky Rootkit?

krellkraver · Jul 20, 2009

Greetings Malware Dominators,

I've got a PC that may have a very sneaky rootkit infection, or (hopefully) just has some corrupted settings from some previous infection(s) that have already been mostly cleaned. I don't know enough to find where this corrupted setting might be.

The symptom I'm seeing is that the Malwarebytes Anti-Malware (MBAM) installer will not complete without errors in Windows XP Pro SP3 after a normal boot. After acknowledging the errors during the install routine (which are always the same, a screenshot is attached), the installer seems to finish. However, MBAM then will not run due to the same pop-up error message. It's a Visual C++ Runtime Library error that says, "This application has requested the Runtime to terminate in an unusual way. Please contact the application's support team for more information." Please see the attached screenshot.

I know that normally, some malware will disallow running the normal filename for MBAM, so the first thing I tried was renaming the file to something else, including using different file extension such as .com, .bat, .scr, and .pif. None of these renaming attempts worked. This is where I started to observe really strange behavior. After uninstalling my first MBAM install attempt, I found that I could install MBAM when booted to Safe Mode (after changing the registry to allow this and starting the installer service in Safe Mode). After the install I could also run MBAM in safe mode. I then rebooted to normal mode, and MBAM still would not run. I then tried Safe Mode with Networking so that I could download MBAM updates, but was surprised to see that MBAM would show the same Runtime error in Safe Mode with Networking. This suggests to me that the problem is something that Windows loads in Safe Mode with Networking that is NOT loaded in regular Safe Mode.

I've followed the full Major Geeks Windows XP Cleaning procedure. For the MBAM step, I updated the MBAM rules from a clean computer, and transferred the "rules.ref" to the suspect computer manually. I then booted to Safe Mode to run MBAM.

Attached are also the first three of the requested log files.

Thanks,

krellkraver

krellkraver · Jul 20, 2009

Here are the rest of the requested logs.

Thanks in advance,

krellkraver

TimW · Jul 23, 2009

Your logs are clean. I suggest that you pursue this in the software forum as you may need to do some testing thru msconfig to see driver or service is loading that is causing this issue.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

krellkraver · Jul 23, 2009

Hello TimW,

Thank you for reviewing my logs. The fact that MBAM will run in Safe Mode but not in Safe Mode With Networking made me very suspicious. It's reassuring that you could see no sign of infection. I'll pursue the software issue as you suggest.

Thanks again. The hard work you and the other malware experts do is invaluable and highly appreciated.

Regards,

krellkraver

krellkraver · Jul 23, 2009

I just found the solution to this issue in Malwarebytes' own forums here. Apparently this is a known bug.

Thanks,

krellkraver

TimW · Jul 26, 2009

Good to know and I will pass on the info.

And you are welcome.

Log in or Sign up

Sneaky Rootkit?

krellkraver Private E-2

Attached Files:

MBAM_error.gif

SASlog.txt

mbam-log-2009-07-20 (14-42-49).txt

ComboFix.txt

krellkraver Private E-2

Attached Files:

RRlog.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

krellkraver Private E-2

krellkraver Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member