Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infection, finally got a log


  • This topic is locked This topic is locked
2 replies to this topic

#1 xpuser231

xpuser231

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 31 August 2009 - 09:04 AM

Pasting in additional information from another post. ~ OB

im not able to run any of the programs specified in the help topic, all i can tell you is that i can't open explorer.exe and many other .exe files, there is nothing suspicious in the process tab in task manager, any help is greatly appreciated, thank you. Just to mention, i have spotted these processes in the task manager, but they went away after ending process: a.exe, find.exe

UPDATE: i ran sophos anti-rootkit and it discovered UACxxxxx.dll and UACxxxxxx.sys but could not remove because they're were in use by another application, i hope this helps a bit.

Root Repeal Log.

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/27 16:13
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xA97AA000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8A84000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA8E47000 Size: 49152 File Visible: No Signed: -
Status: -

Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0xF897C000 Size: 20480 File Visible: No Signed: -
Status: -

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xF87D4000 Size: 61440 File Visible: No Signed: -
Status: -

==EOF==

End of added information. ~ OB

This infection that i got wasnt allowing me to run and programs, even when i rename start in safe mode or whatever, i was still unable until i ran RSIT.exe, a program that runs hijack this. Attached File  log.txt   20KB   8 downloads

Edited by Orange Blossom, 31 August 2009 - 03:54 PM.


BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:06:40 AM

Posted 02 September 2009 - 10:29 PM

Hello xpuser231,

This utility fixes the exe file associations in the registry automatically.
http://windowsxp.mvps.org/exefile.htm

Let me know if it works.

You have a nasty rootkit on this computer.
When you come back, we will continue with the clean up process.

Edited by SifuMike, 02 September 2009 - 10:34 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:06:40 AM

Posted 10 September 2009 - 08:33 PM

This thread will now be closed due to lack of feedback.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users