Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rootkit.tdss??


  • This topic is locked This topic is locked
3 replies to this topic

#1 csbeginner

csbeginner

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:41 PM

Posted 04 June 2011 - 12:41 AM

Hi,

I am running Windows XP SP3.

The problem first manifested itself shortly after browsing the megaupload.com website. There was a popup in the background I did not notice. Twenty minutes later, Avira Antivir guard detected an infection and reported the following:

Is the TR/Crypt.ZPACK.Gen Trojan C:\documents and settings\HP_administrator\local settings\temp\srcwenmoax.tmp
Is the TR/Crypt.ZPACK.Gen Trojan C:\documents and settings\HP_administrator\local settings\temp\rwcoeansmx.tmp


As I prepared to have Avira updated to perform a more complete scan of my system, I noticed that something started to take up all my system resources. Since things were running slowly, I opted to restart my computer. As expected, it didn't shut down very quickly. A few strange close program popups appeared before Windows shut down. I recall one program being titled something like hiddenfax... sorry, I don't remember the others; probably should have paid closer attention to them.

Anyways, my computer appeared to be restarting. Then when it hit the windows loading screen, I encountered the BSOD, a screen very similar to the one on this page: http://www.symantec.com/connect/blogs/tidserv-and-ms10-015 . There was an error with the atapi.sys file. I tried restarting using the last known good configuration and safe mode, and still the same BSOD. I finally found some instructions on this page http://www.myfixes.com/articles/system that allowed me to perform a system restore using the Windows recovery console. I was able to boot into Windows. Naturally, I wasn't confident that the problem was resolved, so I ran two programs which have helped me before.

Malwarebytes reported two instances of Rootkit.tdss and one other problem, which I asked the program to correct. They were:

Files:

C:\documents and settings\HP_administrator\local settings\temp\33.tmp
C:\documents and settings\HP_administrator\local settings\temp\34.tmp


registry data item:

hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced\start_showhelp PUM.Hijack.startmenu


Hijackthis output a log with some suspicious entries that weren't found in a clean log generated at an earlier time.

I don't know whether or not my computer is still infected. Can someone please advise on next steps to take?

Thank you! Your help is much appreciated!

Edited by csbeginner, 04 June 2011 - 12:48 AM.


BC AdBot (Login to Remove)

 


#2 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:41 PM

Posted 04 June 2011 - 01:16 AM

That certainly matches the M.O. of TDSS so I'm going to ask you to follow this guide here. It will instruct you on how to generate some logs using the DDS and GMER analysis tools and how to post them to the Malware Logs Analyses forum. These logs will provide much more detailed and pertinent information than HijackThis is capable of and will assist the Malware Removal Team member who responds to your post to craft the necessary fixes to clean your system.

#3 csbeginner

csbeginner
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:41 PM

Posted 04 June 2011 - 12:27 PM

Thank you, Andrew!!

I have already backed up some files earlier on another drive. A firewall is already active and any CD emulation software has been disabled. As soon as the scans are done, I will have the output posted in a new thread on that section of the forum.

Edited by csbeginner, 04 June 2011 - 12:28 PM.


#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:10:41 PM

Posted 04 June 2011 - 09:34 PM

Malware topic
http://www.bleepingcomputer.com/forums/topic401786.html

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users