Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

There's Something In The Machine...


  • This topic is locked This topic is locked
55 replies to this topic

#1 Walking Through

Walking Through

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 04 January 2011 - 10:59 AM

Hello -

Please tell me I have the right place...

Platform: WinXP Pro SP3. It visits Microsoft's update site once a week or so to pick up patches.
Microsoft Essential Security. It auto-updates.. and I often trip an update manually.
(as an aside, there's about 40 GB disk available)

Problem:

About a week ago Explorer began to hang when right-clicking on an icon. Task Manager could sometimes be brought up to kill and restart Explorer.. but now that's gotten problematic as, often, Task Manager won't launch. The system boots up, Microsoft Essentials looks like it's trying to start, *both* displays FLASH, then Explorer locks up. Sometimes Task Manager will launch.


What Has Been Done So Far

DDS.SCR was downloaded and run. Please find attached DDS.TXT and ATTACH.ZIP.

GMER was downloaded from the GMER web site and, per instructions, started with IAT/EAT and Show All checkboxes turned off and C: turned on. GMER runs for a few seconds then stops. It doesn't get killed... but it just sits there doing nothing. Task Manager shows it not consuming any CPU time and there is no system activity. Waited an hour for it to do something.

Another GMER attempt was done using the randomly-renamed version. Same thing: It runs for a few seconds then stops.

After reading a few posts dealing with Explorer hangs and investigating possibilities, the system was booted into Safe Mode and GMER run. It ran for a few seconds then there is a line of text advising there is a hidden service with the name "gijxezv" running.

REGEDIT shows there are multiple "gijxezv" and LEGACY_GIJXEZV entries. I can't seem to do anything about those entries; regedit claims I don't have sufficient permissions (even though I'm using the Administrator account).

"gijxezv" does not appear in the Services Control.

At this point I'm operating at the edge of my knowledge.

Please.. your assistance?

P.S. EMail notifications of replies has been turned on.
[attachment=84308:Attach.zip]

BC AdBot (Login to Remove)

 


#2 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 07 January 2011 - 08:44 AM

Follow-up...

It's getting worse. About everything I've tried to run to identify this chunk of malware is being defused at launch.

MBAM: stopped dead. Shows in Task Manager but is not consuming any CPU.

Spybot: runs for a few seconds then stops consuming CPU.

GMER: runs for a few seconds then stops. Doesn't react to anything.

SuperAntiSpyware: That ran, allowed an update, then didn't find anything.

Trend Micro HouseCall: Stopped dead.

SystemInternals RookKitRevealer: Doesn't find anything. Runs v e r y s l o w l y.

Microsoft Essential Security: It updates itself, runs for a while, stops consuming CPU, then starts up again and consumes 99%. After about a minute, it goes to 0% and stays there. Still displays the little green "house" in the taskbar.

NirSoft's Shell Extensions Viewer was run (suggestion found to look at Explorer's context menu handlers) but there's nothing out of the ordinary.

-----
There's 42 GB available space on the drive so I think it unlikely I'm running out of space.

That "gijxezu" service is still visible in safe-mode. Still can't delete or disable it. Doesn't show up at all in Task Manager, Manage-->Services, or in a fresh copy of SystemInternals/ProcessExplorer. AutoRuns doesn't see it, either.

-----
Reloading WinXP Pro SP3 is going to be a nightmare: playing "musical drives" to get it done is never "fun".

Please... constructive ideas (other than reloading the disk drive) would be appreciated.

Thanks in advance.

#3 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:33 PM

Posted 09 January 2011 - 06:31 PM

Hello and welcome to Bleeping Computer :welcome:

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log



IMPORTANT NOTE: :exclame:

If the system has been used after topic creation time we need to take a look at fresh logs. So, please post fresh copies of dds.txt & attach.txt logs.
If you still have troubles running DDS and GMER please let us know.



Regards,
Georgi :hello:

cXfZ4wS.png


#4 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 10 January 2011 - 05:16 PM

Hello Georgi -

And a Happy New Year to you, yours, and the crew at BC as well. Thank you for responding to my post (a read through the forum shows that your group has been busy stomping malware into the ground).

A fresh copy of DDS has been downloaded and run. Please find Attach.zip attached. DDS.txt is appended below.

A fresh copy of GMER was also downloaded... but I cannot get a complete run: it scans into the DEVICES folder and stops about ten seconds later. Task manager shows it in the process table but not consuming any CPU.

Your time is very much appreciated. Thanks.

-- Mark

-----

DDS (Ver_10-12-12.02) - NTFSx86
Run by DEFAULT at 17:00:22.04 on 01/10/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.267 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\niSvcLoc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\DEFAULT\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
mRun: [nwiz] nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [AtiPTA] atiptaxx.exe
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257344586390
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - file:///C:/psdk/controls/sdkinst.cab
TCP: {51D819CC-5B90-4867-B9E0-ADD83DC7EF62} = 8.8.8.8,8.8.4.4
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\default\applic~1\mozilla\firefox\profiles\tdvnbumn.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - %profile%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-1-5 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-1-5 74480]
R2 niarbk;niarbk;c:\windows\system32\drivers\niarbk.dll [2003-10-16 37376]
R2 nibffrk;nibffrk;c:\windows\system32\drivers\nibffrk.dll [2003-10-16 21504]
R2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [2003-10-17 674304]
R2 nidimk;nidimk;c:\windows\system32\drivers\nidimk.dll [2003-4-23 107102]
R2 nidmmk;NI DMM and Data Logger Kernel Driver;c:\windows\system32\drivers\nidmmk.dll [2003-10-17 50688]
R2 nimdsk;nimdsk;c:\windows\system32\drivers\nimdsk.dll [2003-10-16 30208]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmk.dll [2003-9-22 41071]
R2 nistck;nistck;c:\windows\system32\drivers\niSTCk.dll [2003-10-16 111616]
S1 rspipci;rspipci;c:\windows\system32\drivers\RSPIPCI.SYS [2002-10-10 10863]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [2003-6-24 17920]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-1-5 7408]
S3 TEK-VISAUSBTMC;Tek-VISA USBTMC driver;c:\windows\system32\drivers\TekUsb.sys [2009-10-15 30776]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2003-7-16 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 QEC;QEC;c:\docume~1\default\locals~1\temp\qec.exe --> c:\docume~1\default\locals~1\temp\QEC.exe [?]

=============== Created Last 30 ================

2011-01-07 16:40:52 1825196 ----a-w- C:\STUFF.REG
2011-01-03 19:23:54 798 ----a-w- C:\LEGACY_GIJXEZV.reg
2010-12-29 18:11:37 -------- d-----w- c:\program files\Panda Security
2010-12-28 15:44:56 -------- d-----w- c:\program files\NirSoft
2010-12-28 15:16:27 10456 ----a-w- C:\cc_20101228_101622.reg
2010-12-28 15:01:48 -------- d-----w- c:\program files\scilab-5.3.0
2010-12-28 14:28:44 354366 ----a-w- C:\cc_20101228_092834.reg
2010-12-28 14:26:43 -------- d-----w- c:\program files\CCleaner
2010-12-23 22:15:10 -------- d-----w- c:\docume~1\default\locals~1\applic~1\PackageAware
2010-12-23 20:54:38 -------- d-----w- c:\windows\B5297E231E504260976F777F9A71370A.TMP
2010-12-23 20:25:48 -------- d-----w- C:\FOO
2010-12-20 23:45:38 -------- d-----w- c:\docume~1\default\applic~1\Malwarebytes
2010-12-20 23:37:42 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-20 23:37:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-20 23:06:53 -------- d-sh--w- c:\documents and settings\default\PrivacIE
2010-12-15 18:46:29 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-15 18:45:15 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2010-12-13 23:09:44 -------- d-----w- c:\windows\system32\wbem\repository\FS
2010-12-13 23:09:44 -------- d-----w- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 23:53:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 21:34:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51:33 222080 ------w- c:\windows\system32\MpSigStub.exe

============= FINISH: 17:01:54.01 ===============

#5 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 11 January 2011 - 02:09 PM

Hello and sorry for the delay!
Looks on first sight like a rootkit, so lets see if we can get rid of it soon! :)

COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#6 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 12 January 2011 - 11:07 AM

Hello Elise -

ComboFix was downloaded and run.

Please find attached the generated log file.

Your time on this is greatly appreciated.

--Mark

#7 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 12 January 2011 - 11:48 AM

Please run the following steps:

CF-SCRIPT
-------------
We need to execute a CF-script.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:
Driver::
GIJXEZV

Rootkit::
c:\windows\system32\drivers\GIJXEZV.sys
Save this as CFScript.txt, in the same location as ComboFix.exe

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#8 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 12 January 2011 - 12:38 PM

Hello Elise -

The CF-script from your post was cut/pasted to CFScript.txt and drag-dropped onto ComboFix.

(Thank you for your quick response).

ComboFix ran, turned off the display at one point, the computer made a few noises, and the system rebooted.

The logfile C:\ComboFix is attached.

--Mark

#9 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 12 January 2011 - 01:22 PM

Hi, how are things running at this point?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#10 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 12 January 2011 - 02:20 PM

Hello Elise -

Shortly after sending you that file, I rebooted the computer into Slackware 13.1 (this computer dual-boots). Indeed, one of the "indicators" was that the Linux side of things was running as expected while the Windows side was having a problem with the right-click on desktop icons... and getting slower and slower...

I've been monitoring this thread and looking for your followup. :-)

"Is it safe now?"

Any idea where that thing came from or how long it's been in there?

I've been keeping the computer up-to-date via update.microsoft.com and have MS Essentials Security package installed. Not one squeak out of Essentials or the Malicious Software Removal Tool. Neither of SysInternal's Process Explorer or Autoruns showed that gijxezv "thing" (rootkit?). RootkitRevealer was silent. TrendMicro's HouseCall didn't catch it. MalwareBytes and SuperANTISpyware were ineffective: not one blip.

GMER's initial check while in safe-mode did find "gijxezv" but could not finish a scan nor could REGEDIT delete any of the associated keys. Everything I tried (scanning around the net for information was only partly usable) was unable to delete that Registry key.

What about USB-based memory sticks? Would they be infected as well? (I've got a bunch of 'em but haven't plugged any in since this problem started).

My next step was to connect the drive to another XP machine (an off-line effort), back everything up to a USB-disk, and reload the entire computer. If your efforts succeeded then a mighty THANK YOU (for you've saved me a bucket of time).

Questions:
1. Reload Microsoft's Essentials package?
2. Any ideas on where this gijxezv came from (network share? drive-by web attack? Something stupid I did?)
3. A rootkit.. delightful. What information might have escaped? I should run around changing passwords?
(groan - I use ssh. Might that thing have captured typed-in passwords?)

Your time IS appreciated.

--Mark

#11 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 12 January 2011 - 04:09 PM

Hi Mark,
This did not get picked up because regular scanners are nto able to detect rootkits (rootkits hide itself from the Windows API in order to avoid detection). Since rootkits are not linux compatible, your linux installation was not affected.

Its very difficult to say how you got infected. It may have been a bad download, a bad site, a drive-by download, an infected email, difficult to say.

This rootkit leaves USB drives alone, I have seen no indication of autorun infections. As for compromised data, I recommend to change any sensitive data, just in case.

Are you still having issues at this point?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#12 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 13 January 2011 - 08:54 AM

Hello Elise -

I .. don't think I'm out of the woods just yet.

The system boots up... after a short interval both displays turn off, turn on, alternate one cycle, then the system seems to sit still. The Taskbar at bottom takes a long time to appear.

Clicking any icon produces a dead Explorer. Once Explorer is dead, so is CTRL ALT DEL and Task Manager won't launch.

Regained control by pressing the front panel Reset. Once rebooted, immediately did CTRL ALT DEL to bring up Task Manager.

Started Firefox from there and here I am.

DDS.scr ran and results are on the desktop. Say the word and I'll post them here.

A fresh copy of GMER does not finish. The initial scan seems to complete OK (no warnings)... but un-checking that IAT/EAT switch and clicking on Scan... GMER runs for a few seconds then dies and takes the system with it. Rebooted into Safe mode and re-ran GMER. Same behavior: initial scan finishes with no complaints but a Scan runs for a few seconds then the system locks up.

-----

This thing does still dual boot into Linux... is there anything I could do from the LinuxLand side of things (which does have access to the WinXP partition) that might help? (Linux is installed on a completely separate disk drive).

-- Mark

#13 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 13 January 2011 - 09:09 AM

Can you please redownload and rerun Combofix? Post me the new log.

Did your computer only now start this behavior, or did it occur all along?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#14 Walking Through

Walking Through
  • Topic Starter

  • Members
  • 63 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Boston
  • Local time:05:33 AM

Posted 13 January 2011 - 09:45 AM

Hello Elise -

The flashing displays seem to be new behavior. I don't recall it doing this before. The LONG delay on the Task Bar appearing is new.

The clock and Quick start blocks on the Task Bar are blank for almost the entire interval. Now that it's displayed, there's an odd with the ethernet connectivity indicator (this computer has a static IP). The indicator has that little moving ball.. like it's looking for an ether address? Unusual.. I don't remember seeing that one at all.

Just downloaded and ran a fresh copy of ComboFix. Log file attached.

--Mark

#15 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,816 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:12:33 PM

Posted 13 January 2011 - 12:29 PM

Does the internet work, despite the fact that it keeps acquiring network access?

Please try to do a clean boot and let me know how things are running that way.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users