BleepingComputer.com: riddled with threats RKill and MBAM saves me again

Jump to content

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.


If you have not received help after three days, please post a link to your topic HERE.
  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

riddled with threats RKill and MBAM saves me again pup.whitesmoke

#16 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 04 December 2010 - 08:50 PM

This is the pertinent section of the log which indicates a TDSS rootkit infected the Master Boot Record (MBR) and that it will be cured after reboot.

Quote

2010/12/04 16:17:45.0968 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/12/04 16:17:45.0968 ================================================================================
2010/12/04 16:17:45.0968 Scan finished
2010/12/04 16:17:45.0968 ================================================================================
2010/12/04 16:17:45.0984 Detected object count: 1
2010/12/04 16:18:21.0203 \HardDisk0 - will be cured after reboot
2010/12/04 16:18:21.0203 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure

This particular malware alters the MBR of the system drive to ensure persistent execution of malicious code. Essentially, it overwrites the MBR of the hard disk with its own code and stores a copy of the original MBR at another sector using rootkit techniques to hide itself. To learn more about these types of infections please refer to:

How is your computer running now?
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#17 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 04 December 2010 - 09:45 PM

Running normally again
It has been several hours and nothing has hatched.

Reading through the documentation of bootkit and tdss.td4 it seems that the file hidden in the mbr is potentially unfindable.
I don't know how far I has gone in its scheme.

If I am reading correctly it will move to avoid detection.
EDIT
I am thinking format.
Wondering if formatting will cleanse it... :angry:

----
btw this link from the above post is not working

* TDL3: Part I A detailed analysis of TDL rootkit 3rd generation = http://virusvn.com/download/video-tutorial/tdl3_analysis_paper.pdf

Either it is a bad link or one of the redirects

This post has been edited by Martel: 04 December 2010 - 10:15 PM

.
.
.
Posted Image

#18 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 04 December 2010 - 11:23 PM

The link is for a .pdf file that provides a detailed analysis of the TDL rootkit. It did not load for me either...it did in the past so it may just be an issue with the browser having a problem opening the file. However, I was able to download, save and open it with Foxit Reader.

Go ahead and follow the instructions I previously provided for Creating a new Restore Point in Post #8
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#19 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 04 December 2010 - 11:33 PM

I didn't notice you edited your last reply when posting mine.

Reformatting is always an option. Your decision as to what action to take should be made by reading and asking yourself the questions presented in these articles:

Quote

Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
• Reimaging the system
• Restoring the entire system using a full system backup from before the backdoor infection
• Reformatting and reinstalling the system
Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

Quote

The only way to clean a compromised system is to flatten and rebuild. That’s right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).


In some instances an infection may have caused so much damage to your system that it cannot be successfully cleaned, repaired or trusted especially if you are dealing with backdoor Trojans, Botnets, IRCBots or rootkits. These types of malware infections are very dangerous because they compromise system integrity. Rootkits are used by backdoor Trojans to conceal its presence (hide from view) in order to prevent detection of an attacker's software and make removal more difficult. Remote attackers use backdoors as a means of accessing and taking control of a computer that bypasses security mechanisms. This exploit allows them to steal sensitive information like passwords, personal and financial data which is then sent back to the hacker. Security vendors that claim to be able to remove rootkits and backdoor Trojans cannot guarantee that all traces of it will be removed as they may not find all the remnants. Wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore with a vendor-specific Recovery Disk or Recovery Partition removes everything and is the safest action but I cannot make that decision for you.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#20 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 05 December 2010 - 04:26 PM

It cant create a restore point.


Posted Image
.
.
.
Posted Image

#21 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 05 December 2010 - 06:24 PM

If System Restore is not working, check to make sure it is started and set to automatic.

Go to Posted Image > Run..., and in the Open box, type: services.msc
  • Click OK or press Enter to open the Microsoft Management Console.
  • Scroll down the list to locate the System Restore Service and double-click it.
  • Click the "Start" button, then set the startup type in the dropdown box to "Automatic".
  • Press Apply > Ok, then reboot and try using it again.

If its still not working, go to Posted Image > Run..., and in the Open box, type: services.msc
  • Locate the System Restore Service and double-click it.
  • Click the "Stop" button, then set the startup type in the dropdown box to "Disabled".
  • Press Apply > Ok, then reboot.
  • Open My Computer or Windows Explorer, go to Tools > Folder Options > View and check "Show hidden files and Folders", UNcheck "Hide Protected operating system Files (recommended)" and hit Apply > OK.
  • Check the "System Volume Information folder" on each drive and delete its contents (doing this removes all existing restore points).
  • Then reverse the steps where you disabled the service and restart it: Click "Start" and set set the startup type in the dropdown box to "Automatic".


There are various reasons for System Restore to lose functionality to include side affects of a malware infection which can disable that feature so you may need to do some troubleshooting if the above suggestions do not work.
Also see: You Cannot Create a Restore Point with a HighPoint Driver Installed
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#22 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 05 December 2010 - 07:18 PM

... It seems that system restore was already disabled in the System Volume Information folder.
... May have been done by rootkit.

EDIT
I am working on the system restore troubleshooting links.

It may take awhile to resolve.. if it is driver issues.

I will reply to here when I get it solved
BRB soon I hope


Posted Image

This post has been edited by Martel: 05 December 2010 - 07:44 PM

.
.
.
Posted Image

#23 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 05 December 2010 - 08:31 PM

Can't update sys restore because of
http://support.microsoft.com/kb/969228
message The Drive Letter Access add-on is not compatible with Internet Explorer 8
Posted Image

That leads me to here
maybe fake
Posted Image



EDIT

also no luck attempting to reinstall system restore
via run rundll32.exe advpack.dll,LaunchINFSection C:\Windows\Inf\sr.inf

from my XP program disk the sr.sys file is older than the currently installed sr.sys file

Perhaps I need a more current version
Posted Image

This post has been edited by Martel: 05 December 2010 - 11:07 PM

.
.
.
Posted Image

#24 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 06 December 2010 - 08:26 AM

Microsoft Support FixIt is a legitimate Microsoft page which allows using an automatic fix.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#25 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 06 December 2010 - 05:46 PM

Followed all steps located here http://support.microsoft.com/kb/302796


.

Posted Image
.


Even after stopping and disabling the service, when I reboot it is on again.

Posted Image


Posted Image
.
.
.
Posted Image

#26 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 06 December 2010 - 06:17 PM

You can try doing a Repair Install from the Windows Recovery Console. If you have a Microsoft Windows CD-ROM, you can get to the Recovery Console by booting from that CD and pressing any key when you told to 'Press any key to boot from CD[i/]'. When the '[i]Welcome to Setup' screen appears, choose the option, "To repair the Windows XP installation using recovery console", by pressing R.

Important Note: If this is an issue related to malware, you should know that some infections can result in a system so badly damaged that a Repair Install will NOT help!. Reinstalling Windows without first wiping the entire hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Starting over by wiping your drive, reformatting, and performing a clean install of the OS removes everything and is the safest action. I already gave you the reasons in Post #19.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#27 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 06 December 2010 - 08:39 PM

I will ponder that repair install via the Installation disk.

It looks like this is a resolved issue.
Short of creating a restore point and or flatten and rebuild.


The computer acts totally normal for many days now.
.
.
.
Posted Image

#28 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 06 December 2010 - 10:22 PM

If you need additional assistance with the repair install, you can start a new topic in the Operating Systems Subforums forum.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#29 User is offline   Martel 

  • Bleeping Junior Member
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Study Hall Junior
  • Posts: 1,233
  • Joined: 05-January 07
  • Gender:Male
  • Location:North Carolina U.S.A. Japanese spoken here

Posted 06 December 2010 - 10:42 PM

Thank You.

In truth you have unknowingly helped me many many times over the last couple of years.

I have learned alot.
.
.
.
Posted Image

#30 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,516
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 07 December 2010 - 09:35 AM

You're welcome.

:thumbup2: Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all security updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. When necessary, Microsoft releases security updates on the second Tuesday of each month and publishes Security update bulletins to announce and describe the update. If you're not sure how to install updates, please refer to Updating your computer. Microsoft also recommends Internet 6 and 7 users to upgrade their browsers due to security vulnerabilities which can be exploited by hackers.

Avoid gaming sites, porn sites, pirated software (warez), cracking tools, and keygens. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. In some instances an infection may cause so much damage to your system that recovery is not possible and the only option is to wipe your drive, reformat and reinstall the OS.

Avoid peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, Kontiki, BitTorrent, uTorrent, BitLord, BitLord, BearShare). They too are a security risk which can make your computer susceptible to malware infections. File sharing networks are thoroughly infected and infested with malware according to Senior Virus Analyst, Norman ASA. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs install themselves and spread infections, read How Malware Spreads - How did I get infected.

Keeping Autorun enabled on flash drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. One in every eight malware attacks occurs via a USB device. Many security experts recommend you disable Autorun as a method of prevention. Microsoft recommends doing the same.

Quote

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...This update is intended to stop AutoPlay functionality from working on USB drives, external hard drives, or network shares...
Microsoft Security Advisory (967940): Update for Windows Autorun

If using Windows 7, be aware that in order to help prevent malware from spreading, the Windows 7 engineering team made important changes and improvements to AutoPlay so that it will no longer support the AutoRun functionality for non-optical removable media.

Always update vulnerable software like Adobe Reader and Java Runtime Environment (JRE) with the latest security patches. Older versions of these programs have vulnerabilities that malicious sites can use to exploit and infect your system.

Change all passwords: Anytime you encounter a malware infection on your computer, especially if that computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords as a precaution in case an attacker was able to steal your information when the computer was infected. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

Security Resources from Microsoft:
Other Security Resources:
Browser Security Resources:
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

Share this topic:


  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users