Nasty Rootkit won't let me run dds,gmer

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
←
1
2

You cannot start a new topic
This topic is locked

Nasty Rootkit won't let me run dds,gmer gmer warns me about system modification and possible rootkit.

#16 R00t_revealer

New Member

Group: Members
Posts: 13
Joined: 30-July 11

Posted 10 August 2011 - 10:38 AM

I know that curiosity killed the cat but I could not help it anymore and ran aswMBR again here is the log.

this line below came out in red.

21:19:01.312 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85712c10]<<

here is the log.

aswMBR version 0.9.8.978 Copyright© 2011 AVAST Software
Run date: 2011-08-10 21:18:26
-----------------------------
21:18:26.859 OS Version: Windows 5.1.2600 Service Pack 3
21:18:26.859 Number of processors: 1 586 0x209
21:18:26.859 ComputerName: HOME-0B20EBB6CA UserName: Administrator
21:18:28.750 Initialize success
21:18:38.062 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3
21:18:38.062 Disk 0 Vendor: ST3802110A 3.AAJ Size: 76318MB BusType: 3
21:18:40.078 Disk 0 MBR read successfully
21:18:40.078 Disk 0 MBR scan
21:18:40.093 Disk 0 Windows XP default MBR code
21:18:40.093 Disk 0 scanning sectors +156299375
21:18:40.609 Disk 0 scanning C:\WINDOWS\system32\drivers
21:18:47.031 Service scanning
21:18:48.093 Modules scanning
21:19:01.281 Disk 0 trace - called modules:
21:19:01.312 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85712c10]<<
21:19:01.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x863d8ab8]
21:19:01.312 Scan finished successfully
21:20:18.265 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
21:20:18.281 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
21:20:22.421 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
21:20:22.437 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"

This post has been edited by R00t_revealer: 10 August 2011 - 10:41 AM

#17 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 10 August 2011 - 12:25 PM

Hello

Quote

It says no infection found . Just curious as to what was preventing combofix to no without /nombr switch before?

this happens with a handfull of systems and there is no known reason for it

Re-Run aswMBR

Click Scan
On completion of the scan, click the FIXMBR button
There is a slight pause after clicking the 'Fix' button.
Wait for the tool to report 'Infection fixed successfully', now reboot the machine.
Rebooting the machine prematurely, before seeing this line will result in an incomplete fix.

Note:After the 'Infection fixed successfully' message appears, the machine may became unresponsive. You may have to do a hard boot of your machine. That may be a side effect from the fix. All will be well after the reboot.
Save the log as before and post in your next reply.

I will be online from 5-31 to 6-4 in a very limited amount

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->

<-- Don't worry every little bit helps.

#18 R00t_revealer

New Member

Group: Members
Posts: 13
Joined: 30-July 11

Posted 11 August 2011 - 01:29 AM

this time around it did not detect anything in red. Still I pressed the fixmbr button.

here is the log before hitting fixmbr

aswMBR version 0.9.8.978 Copyright© 2011 AVAST Software
Run date: 2011-08-11 12:10:28
-----------------------------
12:10:28.921 OS Version: Windows 5.1.2600 Service Pack 3
12:10:28.921 Number of processors: 1 586 0x209
12:10:28.921 ComputerName: HOME-0B20EBB6CA UserName: Administrator
12:10:29.796 Initialize success
12:10:32.546 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3
12:10:32.546 Disk 0 Vendor: ST3802110A 3.AAJ Size: 76318MB BusType: 3
12:10:34.578 Disk 0 MBR read successfully
12:10:34.578 Disk 0 MBR scan
12:10:34.578 Disk 0 Windows XP default MBR code
12:10:34.593 Disk 0 scanning sectors +156299375
12:10:35.125 Disk 0 scanning C:\WINDOWS\system32\drivers
12:10:42.109 Service scanning
12:10:43.265 Modules scanning
12:10:55.140 Disk 0 trace - called modules:
12:10:55.156 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
12:10:55.171 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86337ab8]
12:10:55.171 3 CLASSPNP.SYS[f74d7fd7] -> nt!IofCallDriver -> \Device\00000067[0x863da368]
12:10:55.171 5 ACPI.sys[f744e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-3[0x86384940]
12:10:55.578 Scan finished successfully
12:11:14.781 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
12:11:14.781 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
12:11:58.859 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
12:11:58.875 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"

and here is the one after

aswMBR version 0.9.8.978 Copyright© 2011 AVAST Software
Run date: 2011-08-11 12:15:55
-----------------------------
12:25:55.812 OS Version: Windows 5.1.2600 Service Pack 3
12:25:55.812 Number of processors: 1 586 0x209
12:25:55.828 ComputerName: HOME-0B20EBB6CA UserName: Administrator
12:25:57.281 Initialize success
12:26:37.437 AVAST engine download error: 0
12:26:50.750 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3
12:26:50.750 Disk 0 Vendor: ST3802110A 3.AAJ Size: 76318MB BusType: 3
12:26:52.765 Disk 0 MBR read successfully
12:26:52.765 Disk 0 MBR scan
12:26:52.765 Disk 0 Windows XP default MBR code
12:26:52.781 Disk 0 scanning sectors +156299375
12:26:53.265 Disk 0 scanning C:\WINDOWS\system32\drivers
12:26:58.578 Service scanning
12:26:59.656 Modules scanning
12:27:08.687 Disk 0 trace - called modules:
12:27:08.703 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
12:27:08.703 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x863d8ab8]
12:27:08.703 3 CLASSPNP.SYS[f74d7fd7] -> nt!IofCallDriver -> \Device\00000067[0x8637c308]
12:27:09.093 5 ACPI.sys[f744e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-3[0x86336940]
12:27:09.093 Scan finished successfully
12:27:15.625 Verifying
12:27:25.640 Disk 0 Windows 501 MBR fixed successfully
12:27:36.265 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
12:27:36.265 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR1.txt"

This post has been edited by R00t_revealer: 11 August 2011 - 01:48 AM

#19 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 11 August 2011 - 01:46 AM

so how are we doing with the computer now?

gringo

<-- Don't worry every little bit helps.

#20 R00t_revealer

New Member

Group: Members
Posts: 13
Joined: 30-July 11

Posted 11 August 2011 - 02:09 AM

taskbar problem has gone away but internet is not behaving the way it should me. I have IDM installed so when it captures and tries to download anything it does not. It just stalls. I can't download anything properly.

#21 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 11 August 2011 - 02:13 AM

Hello

have you tried to uninstall IDM and reinstall it and is the only problem we have left?

gringo

<-- Don't worry every little bit helps.

#22 R00t_revealer

New Member

Group: Members
Posts: 13
Joined: 30-July 11

Posted 11 August 2011 - 03:08 AM

I uninstalled IDM also uninstalled bit defender 2012 and installed avast antivirus. System is a lot more responsive now. Last problem remaining is that most of the time I have had to long press the power button to shutdown the computer. It says shuting down and then screen goes black but the fans are still spinning. So it does not compelely power down I have to then long press the power button.

This post has been edited by R00t_revealer: 11 August 2011 - 03:10 AM

#23 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 12 August 2011 - 01:58 PM

Hello

I would ike to see a report that combofix makes.

extra combofix report

push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
please copy and past the following into the box

C:\Qoobox\Add-Remove Programs.txt

click ok

copy and paste the report into this topic for me to review

Gringo

<-- Don't worry every little bit helps.

#24 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 14 August 2011 - 11:36 PM

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

<-- Don't worry every little bit helps.

#25 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,518
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 17 August 2011 - 11:31 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.