BleepingComputer.com: RootKit is password protecting my files

Avast is showing password protected files it can't scan, computer acts normal GMER detected changes made by ROOTKITS. Ran TDSKILLER it found nothing, SuperAntiSpyware finds nothing, Malwarebytes finds nothing. Please instruct on how to proceed, thank you BleepingComputer Staff!

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

• Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.
  
  
  
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  
  
  
• Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks

Hello MOIe

I'm still here, bad news I uninstalled avast and reinstalled it if I need to post new logs just let me know. Then I've added a few programs, as I'm trying to flash a new dvd drive for my xbox 360. I'm now watching this post as I thought I was already do, checked immediate reply so I'll try to get back with logs or info ASAP, should always be the same day anyway. I'll leave everything pulled up for the next couple hours if you happen to post during then I will get you what ever info you need.


Thanks
Particalzman

Let's see if we can track down the rootkit

Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log when you reply.


And

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
  
• Click the Scan button to start the scan
  
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Thank you, and here are the scan results you asked for.

Thank you, and here are the scan results you asked for.

Those logs are fine.

Can you run Combofix next

Please download ComboFix from one of these locations:

• Bleepingcomputer
  
• ForoSpyware

* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe

• Disable your AntiVirus and AntiSpyware applications including Firewalls, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Comfix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

So I closed the combofix.log text before I saved it and it didn't save I'm running it again. It found a removed some things that are in a quarantine folder on my C:\ drive. I'm sorry if this makes everything that much harder, if there is away to find the text file it showed after the reboot and combofix posting this log. I can't find it found some .txt files but none where what was output at the reboot. I will post the new combofix logs, well wait I will cancel the scan because it might overwrite the existing file if it did save it somewhere, it's updating now so I will cancel it, and wait your instruction.


Thank You

Particalzman

Ok, there it is right there, I'm sorry we just had some wicked storms go through, fist sized hail, tornado warnings, it's been fun, thank god the power stayed on though.

I can't see anything further in Combofix's logs so please run an ESET scan next

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

If no log is generated that means nothing was found. Please let me know if this happens.

Here is the scan results, found 8 infections. Why is it that these Trojans slip past malwarebytes, avast, and superspyware. No long complicated answer needed, just wondering.

I had a question also about the files quarantined by combofix, and the folders that it made on my C:\? I'm sure we aren't done yet and you where going to tell me, but if I don't ask I won't remember that they are there.

The simple answer is that where they are being found is not necessarily where antiviruses look. That's why ESET is useful because it looks in places like Java cache and system restore.

Combofix info, and all that is being released is found here. I may not be able to answer some of the questions you have but give it a go.

Are you still getting the Avast warning?

Thank you for the information and the link to the combofix info. I uninstalled Avast again this morning to run ESETScan again, it has found 3 more infections so far. I uninstalled Avast because it will not let me close it, or kill the process to run ESETScan, it was telling me that antivirus software was running and blah blah blah. Figured I would just uninstall it and run ESET again, this time checking my kids computer that is networked to this one. Thanks again for your time, & help it is much appreciated. My system was beeping once when it reached the sign in/password screen in windows xp. I knew something was wrong when this started, then while trying to flash my xbox 360 DVD drive so I can replace it, I changed my bios drive controller setting. Then it wouldn't let me put it back to the factory setting the OS was installed using. It would just boot bios and then flash the blue windows didn't load screen. After combofix and ESETScan I was able to change my bios and it booted right into windows.

Thanks mOIe maybe we will cross paths again on here.

Quote

Maybe.

You're welcome, Particalzman. Avast is usually really user-friendly so your experience is a surprise.

We just need to clean up before you go.

You're clean. Good stuff!

Let's do some clearing up

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  (For Vista/Windows 7 please click Start -> All Programs -> Accessories -> Run)
  
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between "Combofix" and "/")
  
• Please follow the prompts to uninstall Combofix.
  
• You will then receive a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

This will uninstall Combofix and anything associated with it.


We Need to Clean Up our Mess
Download and Run OTC

We will now remove the tools we used during this fix using OTC.

• Download OTC by OldTimer and save it to your desktop.
  
• Double click icon to start the program. If you are using Vista, please right-click and choose run as administrator
  
• Then Click the big button.
  
• You will get a prompt saying "Being Cleanup Process". Please select Yes.
  
• Restart your computer when prompted.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
------------------------------------------------------------------------------------------------------------------------

Here's some advice on how you can keep your PC clean


Use and update your AntiVirus Software

You must have a good antivirus. There are plenty to choose from but I personally recommend the free options of Avast and Avira Antivir. If you want to purchase a security program then I recommend any of the following: AVG, Norton, McAfee, Kaspersky and ESET Nod32.

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. If you use a commercial antivirus program you must make sure you keep renewing your subscription. Otherwise, once your subscription runs out, you may not be able to update the programs virus definitions.


Make sure your applications have all of their updates

Use this next program to check for updates for programs already on your system. Download Security Check by screen317 from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically, make sure that updates on any that are flagged are carried out as soon as possible

It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Install an AntiSpyware Program

A highly recommended AntiSpyware program is SuperAntiSpyware. You can download the free Home Version. or the Pro version for a 15 day trial period.

Installing this or another recommended program will provide spyware & hijacker protection on your computer alongside your virus protection. You should scan your computer with an AntiSpyware program on a regular basis just as you would an antivirus software.


Finally, here's a treasure trove of antivirus, antimalware and antispyware resources


That's it, happy surfing!

Cheers.

m0le