PC Infected / Malware

PC has been slow lately and then I noticed that when I google a page and click on it I am redirected. Now I have tried to run avg anti virus, ad-aware and even malwarebytes anti-malware, however, I am not able to. Either the program starts and suddenly disappears or I receive the following message: "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item." I tried to run 'hijackthis' however received the same message as above. After reading the self help on the forum I ran dss and the output file is attached. Any assistance is appreciated. Pete

Hello petecall and welcome to the WhatTheTech forums.

I am currently looking through your DDS log and I will reply as soon as possible with instructions.

Thankyou

Hello and welcome to the WhatTheTech forums. I'm Achamian, and I'll be happy to help you with your malware problems.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts before I post them. This is to ensure that I am giving you the best possible advice. This may cause a delay, but I will do my very best to keep it as short as possible.

Before we begin, please note the following:

• All instructions given are customized for this computer only, the tools used may cause damage if used on a computer with different infections.
• Please do not attempt any kind of scans or fixes without my direction.
• Absence of malware symptoms does not necessarily mean the computer is clean.
• Please stay with this topic until I give you the final 'All Clean' post.

Please follow the instructions below:

On your keyboard, press the Windows logo key and the letter R to open a Run box

Type the following two commands one at a time, hitting Enter after each.

sc stop sysbus32
sc delete sysbus32

Then Reboot the computer.


NEXT:


Please download DeFogger to your desktop.
Double click DeFogger to run the tool.

• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• If it needs to, DeFogger may ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.


NEXT:


[external image: Posted Image]
Please download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries


NEXT:


If the malware prevents GMER from running to completion, please do the following:

Download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
• If it asks you if want to download the latest Avast definitions, click Yes
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

NEXT:


Please run DDS on your desktop again to generate a new set of logs, and post the contents of the new DDS.txt and Attach.txt logs in your next reply.


NEXT:


I need you to tell me a couple of things.

(1.) uInternet Settings,ProxyServer = http=127.0.0.1:25503 - Did you deliberately configure this proxy server?

(2.) TCP: DhcpNameServer = [removed] [removed] - These IP addresses belong to MELITACABLE in Malta. Is MELITACABLE your Internet Service Provider or Web Hosting Service?


In your next reply, please include:
The GMER or aswMBR log
The new DDS logs (DDS.txt and Attach.txt)
The answers to my two questions.
Also, please let me know if you had any problems with anything.

Note: Please copy/paste all the logs into your post, do not attach them.

Achamian,

First of all I would like to thank you for taking the time to help me and appreciate that the process can take a while.

Also thank you for you clear instructions, unfortunately my pc did not allow me to carry out all tasks.

Answers to your questions/instructions and additional comments as follows:

1. sc stop sysbus32 & sc delete sysbus32 done as instructed & rebooted - OK

2. DeFogger process - OK (defogger_disable log can be found below)

3. GMER Rootkit Scanner downloaded started to run but soon crashed & had to manually restart pc

4. aswMBR downloaded, scan started and then just stooped. Attempted to re-scan and received message: "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item."

5. DDS started running and just stopped. Attempted to run again but nothing happens.

6. In answer to your questions: (i) I did NOT deliberately configure any proxy server, I do not know how to or why I should do so; (ii) Yes, Melita Cable is my Internet Service Provider which is a very well known and respected company in Malta.

Once again, thanks for all your help.

Pete



DeFogger Log
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:51 on 08/09/2011 (Owner)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

Hi Pete.

First of all I would like to thank you for taking the time to help me and appreciate that the process can take a while.

No problem, Pete. I enjoy trying to figure out the puzzle.

The reason I asked you about those IP addresses is because some malware hijacks your computer settings to point to DNS servers which are not associated with your Internet Provider. This is done in order to redirect your Google searches, etc. But, as those IP addresses belong to Melita Cable, which is your Internet provider, there is no problem with them.

That proxy server entry is not a major problem. We can get rid of that later.

The main infection you have is called a ZeroAccess rootkit. And, as the name implies, it is notorious for stopping malware diagnostic/removal tools from running. It is a very nasty infection and it is not easy to remove. We may have a bit of a 'battle' getting tools to run and we may need to try various options before we start getting somewhere. But, if you're prepared for the battle, then so am I.

That being said, let's give it our best shot.


Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 5 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of them to run, not all of them.

• rkill.exe
• rkill.com
• rkill.scr
• WiNlOgOn.exe
• uSeRiNiT.exe

Do not reboot your computer after running rkill as the malware programs will start again.


NEXT:

• Please Download Rootkit Unhooker and Save it to your desktop.
• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers, Stealth. Uncheck the rest, then Click OK.
• Wait till the scanner has finished and then click File, Save Report.
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in your next reply here.

Note: You may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Achamian Thank you for your reply and assistance. Rest assured I am up for the battle with your support. Just got home from work and switched on pc but all I get is a clear sky blue blank screen Attempts to restart yield the same result and even tried safe mode options but only difference is that I get a blank black screen with "safe mode" written in corners. Replying from a different pc. You are tight the problem is serious. Any ideas of what can be done? Thanks & best regards Pete

Hi Pete.

Yes, ZeroAccess is one of the nastiest bad guys out there at the moment. But we're not beaten yet.

To help me solve the boot up problem I need a bit more information.

1.) What is the make and model of your unbootable computer?

2.) Do you have a Windows XP Setup Disk? Or, if you don't have one, can you borrow one from somewhere?

Until I have that information we can try this. (If it works it will be a bonus. )

In the Windows Advanced Options Menu where you selected Safe Mode, you should also see this entry:

Last Known Good Configuration (your most recent settings that worked)

Try selecting that one and let me know if it makes any difference to the boot up problem.

Achamian Thanks for giving me some hope. Appreciate it. Did as instructed and tried setting up with Last Known Good Configuration (your most recent settings that worked). at first nothing happened but after quite some time I got a box stating Windows is setting up. Then after more time (quite a bit) I got the original desktop background (default background of blue sky with cloudsa nd green hils). But no icons or anything else on screen just cursor. Tried clicking with mouse (left and right) but nothing happens. Then after about 20 more minutes I got another box stating: [Title] Microsoft Visual C + + Runtime Library Runtime Error! Program:…ommon Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe The application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. Make and model of computer: I've had the pc about 4 or 5 years. I bought it from a well known pc shop in Malta but is probably assembled locally. I will try to find some document with specs. What I can tell you is that uses a Intel pentium 4 (this used to come on screen when I start). The only thing written on the front is Cooler Masterand a serial number on the back. I have an original Windows XP Home Edition version 2002. I do have the original cd in my possession. On the cd it states this includes Service Pack 2, however, I'm quite sure that I now have Service Pack 3 (probably through an upgrade). As I'm finishing this email and trying to find as much info as possible, the icons appeared on my pc (roughly 45 mns) however, attempts to connect to the internet are proving unsuccessful. There is no task bar at bottom (clock, start, etc) but all other icons are there. Internet Explorer does not launch while Mozilla FireFox states that I'm not connected to internet which I am. As always thanks for your help. Pete

Achamian Conscious of the fact that I need to give you more info to work with, I once again tried to access pc through "your most recent settings that worked". This takes over half an hour to arrive at the stage where I get the icons on my desktop and the toolbar at the bottom is non-existent. In the meantime I saved the 5 files you mentioned (rkill, uSeRiNeT, etc) to cd using my laptop as the pc was not reading pen drives but opening the cd drive. Attempts to run the 5 programs all failed (I think) as all I was getting was a brief glimpse (less than a second) of something happening when I tried to run them time and time again. I also tried the Rootkit Unhooker (downloaded and copied to cd also) and after a while it worked. I did as instructed in your last email and saved the report to my desktop which I was then able to save to a pen drive and post on this site using my laptop. This can be found below. For some reason I cannot access the internet using my pc as it is not finding any connection. But when I plug the cable into my laptop access to the internet is instant. As always, thanks for your help. Looking forward to your next reply. RkU Version: 3.8.389.593, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #2 ============================================== >Drivers ============================================== 0xF6050000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 12546048 bytes (NVIDIA Corporation, NVIDIA Windows XP Miniport Driver, Version 280.26 ) 0xBD012000 C:\WINDOWS\System32\nv4_disp.dll 4214784 bytes (NVIDIA Corporation, NVIDIA Windows XP Display driver, Version 280.26 ) 0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2265088 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2265088 bytes 0x804D7000 RAW 2265088 bytes 0x804D7000 WMIxWDM 2265088 bytes 0xBF800000 Win32k 1859584 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF5C79000 C:\WINDOWS\system32\drivers\P17.sys 1404928 bytes (Creative Technology Ltd., WDM Audio Miniport) 0xF5E68000 C:\WINDOWS\system32\DRIVERS\IntelC51.sys 1286144 bytes (Intel Corporation, Modem DSP Driver) 0xF774E000 PCI_PNP8216 1048576 bytes 0xF774E000 spch.sys 1048576 bytes 0xF774E000 sptd 1048576 bytes 0xF5DD0000 C:\WINDOWS\system32\DRIVERS\IntelC52.sys 622592 bytes (Intel Corporation, Modem CP Driver) 0xF75EA000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xF257F000 C:\WINDOWS\system32\drivers\Senfilt.sys 393216 bytes (Sensaura, Sensaura WDM 3D Audio Driver) 0xF474D000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xF2478000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xF2350000 C:\WINDOWS\System32\Drivers\avgldx86.sys 331776 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver) 0xBD417000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xF47D3000 C:\WINDOWS\System32\Drivers\agqpwkr3.SYS 221184 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xF2504000 C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\29574\RapportCerberus32_29574.sys 208896 bytes 0xF5C25000 C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 196608 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM)) 0xF7708000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xF75BD000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xF5FC5000 C:\WINDOWS\system32\DRIVERS\e1000325.sys 176128 bytes (Intel Corporation, Intel® PRO/1000 Adapter NDIS 5.1 deserialized driver) 0xF6014000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xF23E9000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF25FF000 C:\WINDOWS\system32\drivers\ADIHdAud.sys 155648 bytes (Analog Devices, Inc., High Definition Audio Function Driver(Release Candidate 1)) 0xF5BFF000 C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 155648 bytes (Creative Technology Ltd, SoundFont® Manager (WDM)) 0xF2411000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xF23A1000 C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys 155648 bytes (Trusteer Ltd., RapportPG) 0xB7D47000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xF5C55000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF5FF0000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF5FA2000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xF23C7000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x80700000 ACPI_HAL 134400 bytes 0x80700000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF25DF000 C:\WINDOWS\system32\drivers\AEAudio.sys 131072 bytes (Andrea Electronics Corporation, Andrea Audio Noise Cancellation Driver) 0xF76A0000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF76D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xF75A3000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF245F000 C:\WINDOWS\System32\Drivers\avgtdix.sys 102400 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher) 0xF76C0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xF2248000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF7736000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver) 0xF7677000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF47BC000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xF603C000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xF24D1000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF768E000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF76F7000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF47AB000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xB7ADE000 C:\WINDOWS\System32\Drivers\Udfs.SYS 69632 bytes (Microsoft Corporation, UDF File System Driver) 0xF793F000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF7A5F000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes 0xF79AF000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xF786F000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xF79DF000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF6CBF000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xF79BF000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF799F000 C:\WINDOWS\system32\DRIVERS\IntelC53.sys 61440 bytes (Intel Corporation, Modem AFE Driver) 0xF78DF000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver) 0xF6CAF000 C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys 61440 bytes (Trusteer Ltd., RapportEI) 0xF7068000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xF6FE8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF787F000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xF6CCF000 C:\WINDOWS\system32\Drivers\NEOFLTR_530_10641.SYS 57344 bytes (Neoteris, NetBIOS Redirector) 0xF6CDF000 C:\WINDOWS\system32\Drivers\NEOFLTR_620_14085.SYS 57344 bytes (Juniper Networks, NetBIOS Redirector) 0xF78CF000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF6C8F000 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 53248 bytes (HP, IEEE-1284.4-1999 Driver (Windows 2000)) 0xF79CF000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF7058000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF78AF000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF7018000 C:\WINDOWS\System32\Drivers\Pcouffin.sys 49152 bytes (VSO Software, low level access layer for CD/DVD/BD devices) 0xF78FF000 RapportKELL.sys 49152 bytes (Trusteer Ltd., RapportKE) 0xF7038000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) !!!!!!!!!!!Hidden driver: 0xF792F000 4157366624 45056 bytes 0xF6C9F000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF79EF000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF789F000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF7048000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF788F000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF6FF8000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF78EF000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF7008000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF22D0000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver) 0xF78BF000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF798F000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF7028000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF6CEF000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF7C07000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xF7C5F000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF7C77000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xF7C0F000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xF7AEF000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF7BEF000 C:\WINDOWS\system32\DRIVERS\RimSerial.sys 28672 bytes (Research in Motion Ltd, RIM Virtual Serial Driver) 0xF7B4F000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver) 0xF7B37000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xF7C6F000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver) 0xF7B77000 C:\WINDOWS\system32\drivers\gearaspiwdm.sys 24576 bytes (GEAR Software Inc., CD DVD Filter) 0xF7B57000 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 24576 bytes (HP, 1284.4<->Usb Datalink Driver (Windows 2000)) 0xF7C17000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF7BFF000 C:\WINDOWS\system32\DRIVERS\mohfilt.sys 24576 bytes (Intel Corporation, Filter Driver to Support Modem-on-Hold) 0xF7C1F000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF7C67000 C:\WINDOWS\System32\Drivers\StarOpen.SYS 24576 bytes 0xF7BF7000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF7C4F000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF7C3F000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver) 0xF7C57000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF7AF7000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF7BDF000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF7BE7000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF7BD7000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF7B8F000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF756F000 C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS 16384 bytes (B.H.A Corporation, CD-ROM Filter Driver for Windows2000/xp) 0xF4725000 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 16384 bytes (HP, IEEE-1284.4-1999 Print Class Driver) 0xF7D6B000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter) 0xF6C47000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xF7573000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xF4729000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver) 0xF7C7F000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF2557000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF6C53000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF6C63000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7DD1000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF7DF1000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF7DCF000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF7D73000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0xF7D6F000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7DD3000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7DD5000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF7DB5000 C:\WINDOWS\System32\Drivers\RootMdm.sys 8192 bytes (Microsoft Corporation, Legacy Non-Pnp Modem Device Driver) 0xF7DB7000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF7DC7000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7D71000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF4829000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xF7EC2000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7F04000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7E37000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) 0xF7F15000 C:\WINDOWS\System32\Drivers\register.sys 4096 bytes 0x873661F8 unknown_irp_handler 3592 bytes 0x863121F8 unknown_irp_handler 3592 bytes 0x85FAE1F8 unknown_irp_handler 3592 bytes 0x862FC1F8 unknown_irp_handler 3592 bytes 0x871881F8 unknown_irp_handler 3592 bytes 0x873D71F8 unknown_irp_handler 3592 bytes 0x870CB1F8 unknown_irp_handler 3592 bytes 0x863191F8 unknown_irp_handler 3592 bytes 0x8625C1F8 unknown_irp_handler 3592 bytes 0x871C9430 unknown_irp_handler 3024 bytes !!!!!!!!!!!Hidden driver: 0xF7A059D0 00001038 1584 bytes 0xF7A059D0 unknown_irp_handler 1584 bytes ============================================== >Stealth ============================================== 0xF7A05693 Unknown page with executable code, 2413 bytes 0xF7A02617 Unknown page with executable code, 2537 bytes 0xF7A024E6 Unknown page with executable code, 2842 bytes 0xF7A001C5 Unknown page with executable code, 3643 bytes 0xF7A05185 Unknown page with executable code, 3707 bytes 0xF7934465 Unknown thread object [ ETHREAD 0x870422F8 ] TID: 136, 600 bytes 0xF7934465 Unknown thread object [ ETHREAD 0x8704D198 ] TID: 140, 600 bytes 0xF7A07105 Unknown thread object [ ETHREAD 0x870511A8 ] TID: 144, 600 bytes 0xF7A07105 Unknown thread object [ ETHREAD 0x87013AF8 ] TID: 148, 600 bytes 0xF7A07105 Unknown thread object [ ETHREAD 0x87016DA8 ] TID: 152, 600 bytes WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys] 0xF7A04C20 Unknown page with executable code, 992 bytes

Hi Pete.

Thank you for the Rootkit Unhooker log. That is very useful to me.

Let's give this a try.

As you are unable to connect to the Internet with the infected machine, you will need to download the tools on another computer, copy the tools to a flash drive, and then transfer them to the infected system. (Or you can use a CD to transfer the tools if that works better for you.)

If the machine you are going to use to download the tools is running Windows XP, please run the following tool first on the non-infected machine to reduce the chance of cross-infection.


Flash Disinfector

• Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
• Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
• The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
• Wait until Flash disinfector has finished scanning and then exit the program.
• Reboot your computer.

If the machine you are going to use to download the tools is running Windows Vista or Windows 7, please use the following tool on the non-infected machine instead.


AutoRun Eater

• Download Autorun Eater and save it to your desktop.
• Plug all of your removable storage devices into the machine (USB sticks etc) and run the tool.

Once you have run the appropriate tool above, please do the following on the non-infected machine:

On your keyboard, press the Windows logo key and the letter R to open a Run box.
Type the following command in the Run box and press enter.

control folders

In the Folder Options box that appears, click the View tab
Un-check "Hide file extensions for known file types" (remove the Tick)
Click Apply, and then click OK.

NEXT:

Please download ComboFix from the link below and save to your Desktop.

ComboFix

Rename ComboFix.exe to pete.com

NEXT:

Copy pete.com to your flash drive (or CD) and transfer it to the to the root of C:\ drive on the infected computer.

NEXT:

Boot the infected computer into Safe Mode with Networking

(This will be listed in the Windows Advanced Options Menu)

NEXT:

Navigate to C:\pete.com and double click on it to run the tool.
It might display a pop up saying that "Recovery Console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this.
If it cannot download the Recovery Console, click to allow it to continue scanning without installing the Recovery Console.
When finished, it will produce a report for you. It will be saved at C:\ComboFix.txt. Please post this report in your next reply.

If you get any problems or error messages, please make a note of them and let me know what they were.

I hope it goes well, Pete.

Achamian Thank you for your last email. Downloaded combofix file and changed name as instructed on laptop (vista) and copied to pen drive and cd. My infected pc does not recognise external pen drives from 'my computer' but if I list a file to 'save as' (eg word, excel) the external pen drive is found?????? PC is not allowing copy & paste function. 'Copy' button is OK but 'paste' is disabled. I tried 'save as', 'move to', etc but nothing is pasted. The best I can do is create a shortcut key to desktop or run files directly from cd. I ran the renamed combofix file from cd (and desktop shortcut). It works but I receive the error: Error opening file for writing C:\32788R22FWJF\iexplore.exe Buttons: Abort Retry Ignore Abort stops the process, Retry - nothing happens, Ignore - program continues. This happens very fast and in the end there appears to be 'Output file: C:\32788R22… but attempts to find this file were unsuccessful. I looked on c: drive, under C:\32788R22, etc. Nothing found. Also any attempt to connect to internet on infected pc is unsuccessful. Even in 'Safe Mode with networking'. Tried to reboot the computer in 'safe mode with networking' and it takes over half an hour for icons to appear on screen but internet explorer fails to load and mozilla firefox opens stating there is no connection. Plugging cable into 'non infected' laptop and everything works fine. Shutting down infected pc properly also takes quite a bit of time. Thanks. Pete

Hi Pete.

If you want to battle on, there are lots more things we can try yet. Let's start with this.

On your non-infected computer, please download ARCDC (Latest EXE Download) from Artellos.com and save it to your Desktop.

• Double click ARCDC.exe
• Follow the dialog until you see 6 options. Please pick: Windows Home Edition SP2 & SP3
• You will be prompted with a Terms of Use by Microsoft, please accept.
• You will see a few dos screens flash by, this is normal.
• Next you will be able to choose to add extra files. Select the Default Files.
• The last window will allow you to burn the disk using BurnCDCC

Your ISO is located on your desktop.

• Insert the CD we created into the CD-ROM drive of your infected computer, and then restart the computer.
  
• If your PC is not booting from the CD, you need to change the boot order:
  • Restart your PC
  • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a
    different one. It should, however, be stated on the screen which key is the setup key.
  • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
  • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
  • The tab should now show your current boot order. If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
  • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
  • If you need it, there is more information here about booting from a CD.
• Your PC should now boot from your CD.
  
  Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  
• When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  
• When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.
  
• A command prompt will open

Type fixmbr and then press Enter. Confirm if asked.

Now type exit and press Enter to restart your computer.

NEXT:

Follow my previous instructions and try to run pete.com in Safe mode with Networking again.

If it runs successfully, please post the C:\ComboFix.txt log in your next reply.

If you get any problems or error messages, please make a note of them and let me know what they were.

Achamian I am still battling on. I do not give up easy. Did as instructed and created CD through ARCDC and rebooted infected pc with CD and successfully carried out 'fixmbr' process. Restarted pc in 'safe mode with networking' but situation is the same. First of all it takes very long to arrive at page with desktop icons. I cannot connect to the internet and cannot copy and paste, save from cd to c: drive or move any files from one location to another. [NB when I restarted the infected pc in safe mode, the ARCDC cd was not in pc, is that OK?] I did run the 'pete.com' from the cd but received same error as before and no report is found on c: drive or anywhere else I looked. I don't know if we have made any progress. As always, thanks for your assistance. Let's keep on fighting. Pete

Hi Pete.

I'm pleased that you have decided to battle on. As you already know, the ZeroAccess rootkit is one of the worst malware infections out there, but I'm still confident that we can beat it. Let's break out the 'big guns'.

You followed the last set of instructions perfectly. You were correct to remove the ARCDC CD before booting into Safe Mode with Networking. Believe it or not, we are definitely making progress. Knowing that certain fixes have not improved the situation gives me good information about what I should try next.

The instructions are going to get a bit more complicated from now on. Just let me know if you are not clear about anything.

This is what we need to do next. You will need a USB drive and a CD.

Download GETxPUD.exe to the desktop of your clean computer

• Run GETxPUD.exe
• A new folder will appear on the desktop.
• Open the GETxPUD folder and click on the get&burn.bat
• The program will download xpud_0.9.2.iso, and when finished, it will open BurnCDCC which will be ready to burn the image.
• Click on Start and follow the prompts to burn the image to a CD.
  
  
• Next download driver.sh to your USB drive
• Remove the USB and insert it in the infected computer
• Boot the infected computer with the CD you just burned
• The computer must be set to boot from the CD
• Follow the prompts
• A Welcome to xPUD screen will appear
• Click on File
• Expand mnt
• sda1 or sda2 will usually correspond to your HDD
• sdb1 is likely your USB
• Expand your USB (sdb1)
• Confirm that you see the file driver.sh that you previously downloaded
• Press Tool on the top menu bar
• Choose Open Terminal
• Type bash driver.sh
• Press Enter
• If successful, the script will check all the drivers on the machine
• After it has finished a report will be located in the USB drive as report.txt

Please post the report.txt in your next reply.

NEXT:

When we have removed the infection from your computer, it's very likely that we will need a Windows XP Setup disk with SP3 integrated into it. We can use this to repair any Windows system files that the malware might have damaged. The Windows XP Setup disk you have only has SP2 integrated into it. There are instructions here on how to do it. (There is no need to integrate Windows Media Player 11, Internet Explorer 7 or Firefox 2.0 into the slipsteeam ISO.) If you can make this ISO file, it will be very handy. If you are not sure how to burn the ISO file to a CD, I can give you instructions on how to do that later.

The battle is on.