Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Rootkit.TDSS


  • This topic is locked This topic is locked
3 replies to this topic

#1 tindrli

tindrli

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:31 PM

Posted 07 September 2009 - 05:04 PM

Greetings, today i found out that i have this Rootkit.TDSS on my comp.. and i just cant get rid of it .. i tryed
1. NOD32 .. notthing.. nod doesnt appear to recognise it 0 infections
2. Malwarebytes encounter 2 files but cant delete it i tryed 10 times even in safemode
:Memory Modules Infected:
\\?\globalroot\systemroot\system32\vsfocernqltdks.dll (Rootkit.TDSS)

Files Infected:
\\?\globalroot\systemroot\system32\vsfocernqltdks.dll (Rootkit.TDSS)
Posted Image


i tryed search funcction with all hiddeen included and nothing no vsfocernqltdks.dll on my machine.

1. here is my DDS.txt report as instructed in preparation guide

DDS (Ver_09-07-30.01) - NTFSx86
Run by fiju at 23:21:34,82 on pon 07.09.2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1250.385.1033.18.1023.567 [GMT 2:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
svchost.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\fiju\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
mStart Page = about:blank
mWinlogon: SFCDisable=-99 (0xffffff9d)
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [egui] "d:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
uPolicies-explorer: NoWindowsUpdate = 1 (0x1)
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\fiju\applic~1\mozilla\firefox\profiles\h6kwulxt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: d:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
d:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
d:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
d:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
d:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
d:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
d:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
d:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
d:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
d:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
d:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
d:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-8-18 34312]
R2 ekrn;Eset Service;d:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-8-18 468224]
S4 yaqqzdwdhidk;yaqqzdwdhidk;c:\windows\system32\drivers\lukartfsjcypm.sys [2009-9-4 75008]

=============== Created Last 30 ================

2009-09-07 22:59 <DIR> --d----- c:\program files\trend micro
2009-09-07 11:17 45,056 a------- c:\windows\system32\WNASPI32.DLL
2009-09-07 11:17 25,244 a------- c:\windows\system32\drivers\ASPI32.SYS
2009-09-07 11:17 5,600 a------- c:\windows\system\WINASPI.DLL
2009-09-07 11:17 4,672 a------- c:\windows\system\WOWPOST.EXE
2009-09-07 10:51 127,488 -------- c:\windows\system32\drivers\imagesrv.sys
2009-09-07 10:51 5,888 -------- c:\windows\system32\drivers\imagedrv.sys
2009-09-07 10:51 106,496 a------- c:\windows\system32\TwnLib20.dll
2009-09-07 10:51 364,544 -------- c:\windows\system32\TwnLib4.dll
2009-09-07 10:51 155,648 a------- c:\windows\system32\NeroCheck.exe
2009-09-07 10:51 1,568,768 -------- c:\windows\system32\ImagX7.dll
2009-09-07 10:51 476,320 -------- c:\windows\system32\ImagXpr7.dll
2009-09-07 10:51 471,040 -------- c:\windows\system32\ImagXRA7.dll
2009-09-07 10:51 262,144 -------- c:\windows\system32\ImagXR7.dll
2009-09-07 10:51 <DIR> --d----- C:\ppGames
2009-09-07 10:51 5 a------- c:\windows\ppAppDrive.ini
2009-09-07 10:50 4 a------- C:\Fade.ini
2009-09-04 18:38 <DIR> --d----- c:\docume~1\fiju\applic~1\Malwarebytes
2009-09-04 18:38 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-04 18:38 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-09-04 18:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-04 17:07 75,008 a------- c:\windows\system32\drivers\lukartfsjcypm.sys
2009-08-17 16:40 <DIR> --d----- c:\docume~1\fiju\applic~1\uTorrent
2009-08-17 16:18 <DIR> --d----- c:\program files\NVIDIA Corporation
2009-08-17 16:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NVIDIA Corporation
2009-08-17 16:17 1,706,528 a------- c:\windows\system32\nvcuvenc.dll
2009-08-17 16:17 1,597,690 a------- c:\windows\system32\nvdata.bin
2009-08-17 16:17 <DIR> --d----- C:\NVIDIA
2009-08-17 16:14 27,672 a----r-- c:\windows\system32\drivers\Entech.sys
2009-08-17 16:14 <DIR> --d----- c:\windows\system32\Futuremark
2009-08-17 16:14 <DIR> --d----- c:\program files\common files\Futuremark Shared
2009-08-17 16:05 <DIR> --d----- c:\program files\SystemRequirementsLab
2009-08-17 15:50 107,888 a------- c:\windows\system32\CmdLineExt.dll
2009-08-17 15:44 <DIR> --d----- c:\windows\system32\xlive
2009-08-17 15:44 <DIR> --d----- c:\program files\Microsoft Games for Windows - LIVE
2009-08-14 17:54 <DIR> --d----- c:\docume~1\fiju\applic~1\Ubisoft
2009-08-14 17:50 281,760 a------- c:\windows\system32\drivers\atksgt.sys
2009-08-14 17:50 25,888 a------- c:\windows\system32\drivers\lirsgt.sys
2009-08-14 14:20 <DIR> --d----- c:\docume~1\fiju\applic~1\BSplayer PRO
2009-08-11 18:43 660 a------- c:\windows\CDPLAYER.UNI
2009-08-11 15:30 <DIR> --d----- c:\docume~1\fiju\applic~1\LimeWire
2009-08-11 15:30 <DIR> --d----- c:\docume~1\fiju\applic~1\Thinstall
2009-08-08 23:36 34 a------- c:\documents and settings\fiju\jagex_runescape_preferences.dat
2009-08-08 23:36 <DIR> --d----- c:\windows\.jagex_cache_32

==================== Find3M ====================

2009-09-07 10:45 66,664 a------- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-07-16 17:58 410,984 a------- c:\windows\system32\deploytk.dll
2009-07-14 20:54 10,457,088 a------- c:\windows\system32\nvoglnt.dll
2009-07-14 20:54 7,741,664 a------- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 20:54 5,842,816 a------- c:\windows\system32\nv4_disp.dll
2009-07-14 20:54 2,189,856 a------- c:\windows\system32\nvcuvid.dll
2009-07-14 20:54 2,002,944 a------- c:\windows\system32\nvcuda.dll
2009-07-14 20:54 868,352 a------- c:\windows\system32\nvapi.dll
2009-07-14 20:54 485,920 a------- c:\windows\system32\nvudisp.exe
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcodins.dll
2009-07-14 20:54 151,552 a------- c:\windows\system32\nvcod.dll
2009-07-14 13:35 2,173,472 a------- c:\windows\system32\nvcplui.exe
2009-07-14 13:35 81,920 a------- c:\windows\system32\nvwddi.dll
2009-07-14 13:35 4,026,368 a------- c:\windows\system32\nvvitvs.dll
2009-07-14 13:35 3,170,304 a------- c:\windows\system32\nvwss.dll
2009-07-14 13:34 13,877,248 a------- c:\windows\system32\nvcpl.dll
2009-07-14 13:34 4,923,392 a------- c:\windows\system32\nvdisps.dll
2009-07-14 13:34 3,547,136 a------- c:\windows\system32\nvgames.dll
2009-07-14 13:34 1,286,144 a------- c:\windows\system32\nvmobls.dll
2009-07-14 13:34 188,416 a------- c:\windows\system32\nvmccss.dll
2009-07-14 13:34 168,004 a------- c:\windows\system32\nvsvc32.exe
2009-07-14 13:34 143,360 a------- c:\windows\system32\nvcolor.exe
2009-07-14 13:34 86,016 a------- c:\windows\system32\nvmctray.dll
2009-07-14 13:34 229,376 a------- c:\windows\system32\nvmccs.dll
2009-07-10 16:48 4,096 a------- c:\windows\d3dx.dat
2009-07-10 07:01 485,920 a------- c:\windows\system32\NVUNINST.EXE
2009-07-09 06:18 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-07-08 08:39 60,416 a------- c:\windows\ALCFDRTM.EXE
2009-07-07 05:50 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-08-24 19:12 13,622 a------- c:\documents and settings\fiju\STARTUP.reg

============= FINISH: 23:23:00,51 ===============

sadly i cant post you RootRepeal log coz of the BSOD screen that i got every time i start FILES Scan..
this is the image of the BSOD
Posted Image

actualy i have another problem with Root Repeal.. when i start it it says
***Could not read the boot sector. Try adjusting The disk acces level in the options dialog***
so i need to clikc OK 5 times and then program interface apears i go to settings/options tab and i select this
Posted Image
and i close the program but when i start it again i got the same message over and over..
so .. on the end RootRepeal alows me to do next scans:
Drivers, Processes, SSDT, Stealth objects, Shadow SSDT
if i select Hidden services i got the same Could not read the boot sector., and Could not read system registry please contact the author

also i would like to apologise for my bad english i will try to do my best

Thanx in advance
Tindrli

BC AdBot (Login to Remove)

 


#2 tindrli

tindrli
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:31 PM

Posted 08 September 2009 - 09:49 AM

while waiting i posted my problem on other assistance site and got response so i will report here how it goes..

thanx again

#3 tindrli

tindrli
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:09:31 PM

Posted 09 September 2009 - 05:27 AM

i sucesfully deleted a rootkit threat so this post is unececary..

best regards to all of you and see you around

#4 Guest_The weatherman_*

Guest_The weatherman_*

  • Guests
  • OFFLINE
  •  

Posted 09 September 2009 - 05:30 PM

Thanks for letting us know tindrli. :(




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users