What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

rootkit infection [Solved]

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi team: I seem to have a root kit infection. Tried taking it out with HJT - but i am not that good. Also - getting pop up with AVAST that says - Malicious web site blocked.. Also, (ugg) Malwarebytes does seem to want to load… I have upgraded to PRO version.. Can you take a peek - and help me? Many Thanks !! Mkinaz
Post #2
Hi Mkinaz,

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
Post #3
Hello Noodle Tech, Thank you for your reply. Ok, I was able to download DDS.scr, and I run it, but it runs for over three min, I get about 40-50 #-signs, and then the system appears to crash. I tried running in Safe mode - same thing. Also, Now, when I load Firefox, and try to navigate to whatthetech, I am hijacked I cant seem to do anything from that PC.. What next? Many thanks, mkinaz
Post #4 last edited
Hi mkinaz,

Let's try another version of DDS.

Download DDS from here
  • Double click it to run it.
  • At the options screen, click the + sign next to "Options for dds.txt" then remove the check from the box which says "check MBR"
  • Ensure there is also a check next to "attach.txt"
  • Next, click Start. It should run and produce 2 logs for you, DDS.txt and Attach.txt
  • Save those logs and attach them in reply.
Post #5
Ok, that seemed to work: DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Run by [removed] at 12:34:48 on 2012-03-30 #Option MBR scan is disabled. Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.500 [GMT -7:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k HPService C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab TCP: NameServer = 68.105.28.11 68.105.29.11 68.105.28.12 TCP: Interfaces\{065A1848-15E3-47B6-9361-595EA474F2E7} : DHCPNameServer = [removed] [removed] [removed] Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\btxppanel.dll Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\mk\application data\mozilla\firefox\profiles\3o29ml3g.default\ FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-3-24 612184] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-3-24 337880] R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-3-24 20696] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-3-24 44768] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-5-3 80384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-3-24 136176] S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-25 652360] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-3-24 136176] S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys –> c:\windows\system32\drivers\mbam.sys [?] S3 PTDWBus;Curitel PC Card Composite Device driver (UDP);c:\windows\system32\drivers\PTDWBus.sys [2008-1-12 27392] S3 PTDWMdm;Curitel PC Card Drivers (UDP);c:\windows\system32\drivers\PTDWMdm.sys [2008-1-12 41728] S3 PTDWVsp;Curitel PC Card Diagnostic Serial Port (UDP);c:\windows\system32\drivers\PTDWVsp.sys [2008-1-12 39808] S3 PWCTLDRV;The NECHostController Filter Driver;c:\windows\system32\drivers\PWCTLDRV.sys [2008-1-12 5888] . =============== Created Last 30 ================ . 2012-03-30 06:55:39 ——– d-sh–w- c:\documents and settings\mk\IECompatCache 2012-03-30 05:58:50 388096 —-a-r- c:\documents and settings\mk\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2012-03-30 03:26:59 ——– d—–w- c:\documents and settings\mk\application data\WinPatrol 2012-03-25 07:08:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2012-03-24 19:01:08 ——– d—–w- c:\documents and settings\mk\local settings\application data\Mozilla 2012-03-24 18:58:34 ——– d-sh–w- c:\documents and settings\mk\PrivacIE 2012-03-24 18:27:01 ——– d—–w- c:\documents and settings\mk\local settings\application data\Google 2012-03-24 17:52:34 ——– d—–w- c:\documents and settings\mk\application data\Malwarebytes 2012-03-24 17:38:21 ——– d—–w- c:\program files\CCleaner 2012-03-24 17:33:55 612184 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-03-24 17:33:11 41184 —-a-w- c:\windows\avastSS.scr 2012-03-24 17:32:47 ——– d—–w- c:\program files\AVAST Software 2012-03-24 17:32:47 ——– d—–w- c:\documents and settings\all users\application data\AVAST Software 2012-03-24 17:29:49 ——– d—–w- c:\windows\system32\appmgmt 2012-03-24 17:00:45 ——– d—–w- c:\documents and settings\all users\application data\InstallMate . ==================== Find3M ==================== . 2012-02-03 09:22:18 1860096 ——w- c:\windows\system32\win32k.sys 2012-01-11 19:06:47 3072 ——w- c:\windows\system32\iacenc.dll 2012-01-09 16:20:25 139784 ——w- c:\windows\system32\drivers\rdpwd.sys . ============= FINISH: 12:38:28.06 ===============

Attachments:

Post #6
Hi mkinaz,

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
Post #7
Noodle, I downloaded it, (twice) but it will not run. I have tried running as administrator - and – nothing. double click or open, and nothing happens. ? mkinaz.
Post #8
Hi mkinaz,

Let's try a different tool.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan.
    • If Malicious objects are found, DO NOT cure them.
    • Choose Skip then click on Continue.
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
Post #9
Noodle Tech, Well, I downloaded GMER and ran it. I get a message LoadDriver (c::documents…..\admini….\Locals…\Temp\pxtdapow.sys) error 0xC000010E: Canot create a stable subkey under a volatile parent key Then GMER loads, but the only items to the right that are checked are Services Registry FIles C: ADS Everything else is gray'd out and is un-selectable. I then can run the scan, and it scans, but… at the end of the scan i get a message: GMER hasn't found any system modification. The log/txt file is empty I need to let you know that prior to contacting you, I ran a HiJack this scan, and despite the warning, i deleted a few items that came up from the scan. I think - perhaps I may have deleted some items that should have not been deleted, and caused this? I also continue to get an avast! ROOTKIT found warning The name of this (which is the only part i can read) is filename: MBR:….\Par then it is cut off, can't expand window and Rootkit name: MBR:Alureoi… again rest is cut off in the avast window. TDSKiller downloads, but when I run it, – nothing happens. Also, Should i have avast shields turned off during all of this? I have also tried running both of the above in safe mode - (so i guess avast is off in that mode..?) but had the exact same results. What can you suggest at this point as the next step? Many thanks Mkinaz
Post #10
I have the items backed up in HiJack This - so I can restore them, and we can then try this again? Let me know And thanks Mkinaz
Post #12
NT:
I opened all of the individual backup files in HJT - and put them all together in a notepad file, here is what was deleted:

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe


O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}]
@="Component Categories cache daemon"

[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,72,00,\
6f,00,77,00,73,00,65,00,75,00,69,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}]
@="Browseui preloader"

[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
"ThreadingModel"="Both"
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,72,00,\
6f,00,77,00,73,00,65,00,75,00,69,00,2e,00,64,00,6c,00,6c,00,00,00

I have not executed the last scan until I here what you want me to do with these HJT items
Many thanks
mkinaz
Post #13
Hi mkinaz,

None of those items should have been deleted. Please restore them all, they are legitimate.

After doing so, I would like for you to run the following scan.

Please download Listparts.
Run the tool, click Scan and post the log (Result.txt) it makes.
Post #15 last edited
Hi mkinaz,

Thanks for the log. You have a TDL4 bootkit infection which creates a hidden partition on your hard drive. It's probably responsible for preventing you from running the tools.

Preferably from a clean computer, I need you to download:
gparted-live-0.10.0-3.iso (115.1 MB)
Windows XP Recovery Console rc.iso  (7.7 MB)

Create a bootable CD, 1 for Gparted and 1 for the Windows XP Recovery Console, from the ISO images.  You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

[external image: Posted Image]
You should be here…
Press ENTER

[external image: Posted Image]
By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.

[external image: Posted Image]
Choose your language and press ENTER. English is default [33]

[external image: Posted Image]
Once again, at this prompt, press ENTER

You will now be taken to the main GUI screen below
[external image: Posted Image]
According to your logs, the partition that you want to delete is 7.552 MB
Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:
[external image: Posted Image]

Now you should be here:
[external image: Posted Image]

[external image: Posted Image]
Is "boot" next to your OS drive?

If "boot" is not next to your OS drive under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
[external image: Posted Image]

Now double-click the [external image: Posted Image] button.

You should receive a small pop up like this:
[external image: Posted Image]
Choose reboot and then press OK.

Now reboot from the Windows XP Recovery Console CD and execute the following commands:

  • fixmbr \Device\HardDisk0
  • fixboot c:
  • exit

Once back in Windows.

Download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.  
  • Attach that file.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI