Jump to content

Sara

Members
 View Profile  See their activity

  • Posts

    3

  • Joined

  • Last visited

 Content Type 

Posts posted by Sara

    Help removing rootkit

    in Resolved Malware Removal Logs

    Posted

    I installed and ran ComboFix with the Windows Recovery System as per your instructions. However, after completing the scan, ComboFix rebooted the computer and then failed to produce a log. In the blue box it said "Preparing Log, do not run any other programs until ComboFix has completed this action" or something to that effect. I waited about 20 minutes and nothing happened. I ran ComboFix again, this time it did not reboot the computer, but the same thing happened, no log was produced.

    During the first ComboFix scan some files were deleted, but I could not tell you which ones. I ran Malware Bytes to check if the Rootkit was still there after the first scan and failed log, and it was Malware Bytes still picked it up. After that I ran the second Combo Fix scan with a failed log and then I ran Hijack This. Here is that log:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 01:12, on 2008-10-22

    Platform: Windows XP SP1 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE

    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

    C:\WINDOWS\System32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\system32\svchost.exe

    c:\program files\internet explorer\IEXPLORE.EXE

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

    O4 - HKUS\S-1-5-18\..\Run: [speedRunner] C:\Documents and Settings\Sara Ellen\Application Data\SpeedRunner\SpeedRunner.exe (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [Aida] "C:\PROGRA~1\PPATCH~1\cmd.exe" -vt yazb (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [Raovvgs] "C:\Program Files\?icrosoft.NET\?serinit.exe" (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [sfKg6wIP] C:\Documents and Settings\Sara Ellen\Application Data\Microsoft\Windows\owuqgwd.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [speedRunner] C:\Documents and Settings\Sara Ellen\Application Data\SpeedRunner\SpeedRunner.exe (User 'Default user')

    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm

    O16 - DPF: {01016526-5E80-11D8-9E86-0007E96C65AE} (SmartAccess Ctl Class) - https://install.charter.com/diskless/bin/ssctlsma.dll

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - http://portal.uga.edu/nps/portal/gadgets/c...t/LocalExec.CAB

    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe

    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...83/mcinsctl.cab

    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1201067388406

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,20/mcgdmgr.cab

    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

    O20 - Winlogon Notify: netprp - netprp.dll (file missing)

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --

    End of file - 4544 bytes

    Thanks,

    Sara

    Help removing rootkit

    in Resolved Malware Removal Logs

    Posted

    Greetings Sara,

    It's not clear from your statement if you rebooted. You said the file is always there but don't really indicate if that's after a reboot. Please advise. Thanks!

    Yes, I have rebooted after every time I use the malware bytes scan. It indicates that rebooting will remove the rootkit, but it is always there upon rebooting my computer.

    Thanks for your help!

    Sara

    Help removing rootkit

    in Resolved Malware Removal Logs

    Posted

    I read a thread posted by a user with a similar problem (http://www.malwarebytes.org/forums/index.php?showtopic=6478&st=0) but he decided to rebuild his computer before the problem was resolved. I have run malware bytes several times and it continually picks up an infected file, says it will be deleted upon reboot, but the file is always there. I downloaded hijack this also so I will post that log and the malware bytes log. I hope you can help me with this problem.

    Sara

    Malware Bytes log:

    Malwarebytes' Anti-Malware 1.29

    Database version: 1299

    Windows 5.1.2600 Service Pack 1

    10/21/2008 2:20:50 AM

    mbam-log-2008-10-21 (02-20-49).txt

    Scan type: Quick Scan

    Objects scanned: 48158

    Time elapsed: 4 minute(s), 50 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 1

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    And my HijackThis log:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 02:27:38, on 10/21/2008

    Platform: Windows XP SP1 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\cisvc.exe

    C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE

    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

    C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\MSN Messenger\msnmsgr.exe

    C:\WINDOWS\system32\ntvdm.exe

    C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe

    C:\WINDOWS\System32\wuauclt.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

    C:\WINDOWS\system32\cidaemon.exe

    C:\Program Files\Mozilla Firefox\firefox.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adb...//www.yahoo.com

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

    O4 - HKLM\..\Run: [iPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe"

    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    O4 - HKUS\S-1-5-18\..\Run: [speedRunner] C:\Documents and Settings\Sara Ellen\Application Data\SpeedRunner\SpeedRunner.exe (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [Aida] "C:\PROGRA~1\PPATCH~1\cmd.exe" -vt yazb (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [Raovvgs] "C:\Program Files\?icrosoft.NET\?serinit.exe" (User 'SYSTEM')

    O4 - HKUS\S-1-5-18\..\Run: [sfKg6wIP] C:\Documents and Settings\Sara Ellen\Application Data\Microsoft\Windows\owuqgwd.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [speedRunner] C:\Documents and Settings\Sara Ellen\Application Data\SpeedRunner\SpeedRunner.exe (User 'Default user')

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm

    O16 - DPF: {01016526-5E80-11D8-9E86-0007E96C65AE} (SmartAccess Ctl Class) - https://install.charter.com/diskless/bin/ssctlsma.dll

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - http://portal.uga.edu/nps/portal/gadgets/c...t/LocalExec.CAB

    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe

    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...83/mcinsctl.cab

    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1201067388406

    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (Download Helper Class) - http://activex.microgaming.com/DLhelper/ve...n7/dlhelper.cab

    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab

    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,20/mcgdmgr.cab

    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

    O20 - Winlogon Notify: netprp - netprp.dll (file missing)

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\SYSTEM32\CTsvcCDA.EXE

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

    O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --

    End of file - 5529 bytes

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    C:\WINDOWS\System32\drivers\mrxdavv.sys (Rootkit.Agent.H) -> Delete on reboot.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.