BleepingComputer.com: Infected with rootkit

Hi, I am desperately trying to rid my laptop of rootkit infections and probably related, browser redirections Mediashifter and Abnow.

I have managed to get back into normal mode as previously computer would just freeze. Managed in safe mode for a while to run malwarebytes and clean infections but they always re-appear on reboot as I thought they would.

Currently in selective start up mode with all my startup programmes disabled and all the non-microsoft startup services disabled.
At the moment I have no firewall as I have just relieved myself of Zonealarm. I had installed Outpost Pro and AVG antivirus. I also had installed Kingsoft PC doctor. All of these were removed as I thought I was having conflicts with them together with MS Office 2003. I assumed this because I found that closing any office application froze the computer completely, having to power down to restart. That will not be helping one bit I know.

I have ran hijack this with limited success only showing one red entry on Parsing 'C:\WINDOWS\system32\ctfmon.exe' This could be the genuine ctfmon.exe.
Have downloaded Combofix, FixTDSS.exe, (Not run), but now waiting for some erstwhile individual to hold my hand and talk me through this problem

Incidentally here is the malwarebytes log:

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.01.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
John :: INSPIRON [administrator]

Protection: Enabled

01/02/2012 11:33:35
mbam-log-2012-02-01 (11-33-35).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 302294
Time elapsed: 53 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 1
C:\WINDOWS\system32\IPSECSHM.dll (Rootkit.0Access) -> Delete on reboot.

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 13
C:\WINDOWS\system32\IPSECSHM.dll (Rootkit.0Access) -> Delete on reboot.
C:\WINDOWS\assembly\GAC_MSIL\Desktop.ini (Rootkit.0Access) -> Delete on reboot.
C:\WINDOWS\system32\issvc.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rasl2tp.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcsw.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bits.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\icm10blk.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cwafnotesservice.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Via4in1.dll (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Documents and Settings\John\Local Settings\Temp\{E9C1E1AC-C9B2-4C85-94DE-9C1518918D02}.TLB (Rootkit.Zeroaccess) -> Delete on reboot.
C:\Documents and Settings\LocalService\Local Settings\Temp\{E9C1E1AC-C9B2-4C85-94DE-9C1518918D02}.TLB (Rootkit.Zeroaccess) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Local Settings\Temp\{E9C1E1AC-C9B2-4C85-94DE-9C1518918D02}.TLB (Rootkit.Zeroaccess) -> Delete on reboot.
C:\WINDOWS\Temp\{E9C1E1AC-C9B2-4C85-94DE-9C1518918D02}.TLB (Rootkit.Zeroaccess) -> Delete on reboot.

(end)


At the moment Malwarebyte's protection mode is keeping these damn things from accessing the internet and my head from a brick wall.


System specs:


Computer:
Operating System Microsoft Windows XP Home Edition
OS Service Pack Service Pack 3
DirectX 4.09.00.0904 (DirectX 9.0c)
Computer Name INSPIRON (Inspiron)
User Name John

Motherboard:
CPU Type Mobile Intel Pentium M 740J, 1733 MHz (13 x 133)
Motherboard Name Dell Inspiron 9300
Motherboard Chipset Intel Alviso i915PM
System Memory 2048 MB (DDR2-533 DDR2 SDRAM)
BIOS Type Phoenix (09/19/05)

Display:
Video Adapter ATI MOBILITY RADEON X300 (64 MB)
Video Adapter ATI MOBILITY RADEON X300 (64 MB)
3D Accelerator ATI Mobility Radeon X300 (M22)
Monitor Generic Television

Multimedia:
Audio Adapter Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1]

Storage:
IDE Controller Intel® 82801FBM Ultra ATA Storage Controllers - 2653
IDE Controller Ricoh SD Host Controller
SCSI/RAID Controller A347SCSI SCSI Controller
Disk Drive FUJITSU MHV2060AH (60 GB, 5400 RPM, Ultra-ATA/100)
Optical Drive AXV CD/DVD-ROM SCSI CdRom Device (Virtual DVD-ROM)
Optical Drive SONY DVD+-RW DW-Q58A
SMART Hard Disks Status OK

Partitions:
C: (NTFS) 54078 MB (16516 MB free)

Input:
Keyboard Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Mouse HID-compliant mouse
Mouse PS/2 Compatible Mouse

Network:
Network Adapter Broadcom 440x 10/100 Integrated Controller
Network Adapter Intel® PRO/Wireless 2200BG Network Connection (192.168.1.2)
Modem Motorola SM56 Speakerphone Modem

This post has been edited by Benjy54: 01 February 2012 - 08:37 AM

Please follow the instructions in ==>This Guide<== starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

The current wait time is 1 - 5 days and ALL logs are amswered.

To avoid confusion, I am closing this topic.