Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Possible Unremovable Rootkit


  • This topic is locked This topic is locked
4 replies to this topic

#1 Geppie

Geppie

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:34 PM

Posted 17 August 2013 - 12:28 PM

Hello,

 

Im helping a friend of mine to disinfect his computer. (He has two left hands, if that's an English expression ;)

I used GMER to identify possible rootkit activity after the pc was disinjected from the police virus.

I consider myself as an reasonable experienced user disinfecting pc's but im not sure in this case. It is possible you will find some references in the logs because i already ran a lot of tools, but GMER is still warns me it has found system modifications caused by rootkit activity, and asks me to run a full scan. (Hidden Process! And a very weird reg key)

 

Here is my DDS log and GMER log, thank you in advance!

 

Gerben

 

 

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 7.0.6000.16982
Run by Medion at 19:29:05 on 2013-08-17
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.31.1043.18.1014.262 [GMT 2:00]
.
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\WButton.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\SearchIndexer.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Launch Manager\WisLMSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\mspaint.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.medion.com/
uDefault_Page_URL = hxxp://www.medion.com/
mStart Page = hxxp://www.google.com
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [LaunchAp] "c:\program files\launch manager\LaunchAp.exe"
mRun: [HotkeyApp] "c:\program files\launch manager\HotkeyApp.exe"
mRun: [LMgrOSD] "c:\program files\launch manager\OSD.exe"
mRun: [Wbutton] "c:\program files\launch manager\Wbutton.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [RemoteControl] "c:\program files\home cinema\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\home cinema\powerdvd\language\Language.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{CE2754BF-9BC5-409D-985B-CDB190BB6C9F} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{EA9BF79A-7E50-4190-A561-45C179FCA18D} : DHCPNameServer = 172.28.255.123
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\28.0.1500.95\npchrome_frame.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: igfxcui - igfxdev.dll
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.95\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
============= SERVICES / DRIVERS ===============
.
R0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [2013-8-16 26872]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-2 226016]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-2 29712]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-2 243152]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-9-2 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-9-2 308136]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2010-8-20 277504]
R3 WisLMSvc;WisLMSvc;c:\program files\launch manager\WisLMSvc.exe [2007-1-12 118784]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [2007-1-12 13976]
S3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\drivers\athrusb.sys [2007-1-8 449024]
S3 PhilCap;PhilCap service;c:\windows\system32\drivers\PhilCap.sys [2007-1-10 1053824]
.
=============== Created Last 30 ================
.
2013-08-17 15:28:43 -------- d-----w- c:\users\medion\appdata\local\ElevatedDiagnostics
2013-08-17 10:28:30 -------- d-----w- c:\windows\system32\MRT
2013-08-17 10:23:33 -------- d-----w- C:\56d02ce374df1d3dc68a8908d663c8
2013-08-17 10:00:07 -------- d-----w- C:\FRST
2013-08-16 21:40:58 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-08-16 19:51:55 -------- d-----w- C:\@RestoreQuarantine
2013-08-16 19:50:29 2 --shatr- c:\windows\winstart.bat
2013-08-16 19:50:29 -------- d-----w- c:\programdata\RegRun
2013-08-16 19:50:16 -------- d-----w- c:\program files\UnHackMe
2013-08-16 19:29:48 26872 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
2013-08-16 19:29:48 -------- d-----w- c:\users\medion\appdata\roaming\FixTDSS
2013-08-16 19:25:14 309320 ----a-w- c:\windows\system32\drivers\Trufos.sys
2013-08-16 19:21:01 -------- d-----w- c:\programdata\StarApp
2013-08-16 19:18:48 -------- d-----w- c:\programdata\savenshare
2013-08-16 18:29:45 -------- d-----w- c:\users\medion\appdata\roaming\Malwarebytes
2013-08-16 18:29:40 -------- d-----w- c:\programdata\Malwarebytes
2013-08-16 18:29:38 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-16 18:29:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-08-16 18:00:41 -------- d-----w- c:\users\medion\appdata\local\temp
2013-08-16 17:59:56 -------- d-sh--w- C:\$RECYCLE.BIN
2013-08-16 17:51:10 98816 ----a-w- c:\windows\sed.exe
2013-08-16 17:51:10 256000 ----a-w- c:\windows\PEV.exe
2013-08-16 17:51:10 208896 ----a-w- c:\windows\MBR.exe
.
==================== Find3M  ====================
.
2013-07-31 19:50:58 226016 ----a-w- c:\windows\system32\drivers\avgldx86.sys
.
============= FINISH: 19:29:42,64 ===============
 

 

 

 

 

GMER LOG

 

 

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-08-17 19:28:23
Windows 6.0.6000  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 Hitachi_HTS545016B9A300 rev.PBBOC64G 149,05GB
Running: fszjocyd.exe; Driver: C:\Users\Medion\AppData\Local\Temp\kglcyfob.sys
 
 
---- User code sections - GMER 2.1 ----
 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtCreateFile + 6                         77B7F41A 4 Bytes  [28, 0C, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtCreateFile + B                         77B7F41F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtMapViewOfSection + 6                   77B7FB6A 4 Bytes  [28, 0F, 2A, 00] {SUB [EDI], CL; SUB AL, [EAX]}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtMapViewOfSection + B                   77B7FB6F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenFile + 6                           77B7FBFA 4 Bytes  [68, 0C, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenFile + B                           77B7FBFF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcess + 6                        77B7FC7A 4 Bytes  [A8, 0D, 2A, 00] {TEST AL, 0xd; SUB AL, [EAX]}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcess + B                        77B7FC7F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcessToken + 6                   77B7FC8A 4 Bytes  CALL 76B8269C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcessToken + B                   77B7FC8F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcessTokenEx + 6                 77B7FC9A 4 Bytes  [A8, 0E, 2A, 00] {TEST AL, 0xe; SUB AL, [EAX]}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenProcessTokenEx + B                 77B7FC9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThread + 6                         77B7FCEA 4 Bytes  [68, 0D, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThread + B                         77B7FCEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThreadToken + 6                    77B7FCFA 4 Bytes  [68, 0E, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThreadToken + B                    77B7FCFF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThreadTokenEx + 6                  77B7FD0A 4 Bytes  CALL 76B8271D 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtOpenThreadTokenEx + B                  77B7FD0F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtQueryAttributesFile + 6                77B7FD9A 4 Bytes  [A8, 0C, 2A, 00] {TEST AL, 0xc; SUB AL, [EAX]}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtQueryAttributesFile + B                77B7FD9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtQueryFullAttributesFile + 6            77B7FE4A 4 Bytes  CALL 76B8285B 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtQueryFullAttributesFile + B            77B7FE4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtSetInformationFile + 6                 77B8036A 4 Bytes  [28, 0D, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtSetInformationFile + B                 77B8036F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtSetInformationThread + 6               77B803BA 4 Bytes  [28, 0E, 2A, 00] {SUB [ESI], CL; SUB AL, [EAX]}
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtSetInformationThread + B               77B803BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtUnmapViewOfSection + 6                 77B8065A 4 Bytes  [68, 0F, 2A, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[4020] ntdll.dll!NtUnmapViewOfSection + B                 77B8065F 1 Byte  [E2]
 
---- Devices - GMER 2.1 ----
 
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                        Wdf01000.sys
AttachedDevice  \Driver\tdx \Device\Tcp                                                                                        avgtdix.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                        avgtdix.sys
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                      avgtdix.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                       fltmgr.sys
 
---- Processes - GMER 2.1 ----
 
Process          (*** hidden *** )                                                                                             [4] 82E26D90                                                       
 
---- Registry - GMER 2.1 ----
 
Reg             HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@c!s!r!\30!t!`!\24!\24!j!r!t!\22!c!i!s!\30!  71230
 
---- EOF - GMER 2.1 ----

Attached Files


Edited by Geppie, 17 August 2013 - 12:29 PM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,921 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:34 PM

Posted 22 August 2013 - 10:07 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

--RogueKiller--
  • Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller+
===

Read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • Double-click on TDSSKiller.exe to run the application.
    tdss1.png
  • Click Change parameters
    settings20121003115955.png
  • Check the boxes next to Verify Driver Digital Signature and Detect TDLFS file system, then click OK
    tdss3.png
  • Click on the Start Scan button to begin the scan and wait for it to finish.
    NOTE: Do not use the computer during the scan!
  • During the scan it will look similar to the image below:
    tdss4.jpg
  • When it finishes, you will either see a report that no threats were found like below:
    tdss5.jpg
    If no threats are found at this point, just click the Report selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.
  • If any infection or suspected items are found, you will see a window similar to below:
    tdss7.jpg
    • If you have files that are shown to fail signature check do not take any action on these. Make sure you select Skip. I will tell you what to do with these later. They may not be issues at all.
    • If Suspicious objects are detected, the default action will be Skip. Leave the default set to Skip.
    • If Malicious objects are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
    • Make sure that Cure is selected. Important! - If Cure is not available, please choose Skip instead. Do not choose Delete unless instructed to do so.
  • Click Continue to apply selected actions.
  • A reboot may be required to complete disinfection. A window like the below will appear:
    tdss6.jpg
    Reboot immediately if TDSSKiller states that one is needed.
  • Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run.
  • Paste the log to your next reply, DO NOT ATTACH IT.
===

Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) to your desktop. Double click the aswMBR.exe to run it.
  • Click the "Scan" button to start scan.
  • Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT
  • Please paste the contents of that log in your next reply.
There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.
===

#3 Geppie

Geppie
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:34 PM

Posted 23 August 2013 - 07:24 AM

Hello Nasdaq,

 

First thank you for your time. I really appreciate it. I already performed these exact steps by myself, (but it didn't cure the problem/gave specific indications for an infection as far as i'm experienced).

To be sure we formatted and reïnstalled the pc (unfortunately) last weekend, so you can close this topic.

Again thanks for your time!

 

Regards,

 

Gerben



#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,921 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:34 PM

Posted 23 August 2013 - 09:13 AM

Thank you for the feedback.

#5 nasdaq

nasdaq

  • Malware Response Team
  • 39,921 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:34 PM

Posted 23 August 2013 - 09:13 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users