Rootkit in the BIOS? Please Help!

[Sinn]

Not quite sure what type of infection I have, but it has survived a reformat. I ran KillDisk on my drives and deleted all partitions. Upon reinstalling Windows 7 I'd noticed it came back with the same two registry keys.

RogueKiller detects two keys as "HJ DESK" and when I click the 'Delete' button it says they are 'Replaced' and throws my user folder ('Greg') and 'My Computer' shortcut on my desktop and they are immovable. Inside this user folder is a copy of all my files and other folders (My Pictures, My Videos, My Music, etc.) that Windows creates on fresh install, plus 3 files called "NTUSER, ntuser.dat.OG1 and ntuser.dat.OG2" all of which are "in use" and cannot be manually deleted. When I delete the shortcuts from my desktop, the system tells me that I can go to Control Panel to restore the shortcuts but nothing appears in my Recycle Bin and it seems as if they just disappear. If I scan with RogueKiller after they disappear it will find the same keys, except this time there will be four (like it duplicates itself?) and throw the same shortcuts on my desktop again with a useless quarantine folder and log file that I don't know how to read.

So, I figured my only option left is to flash my BIOS. It must be hiding there, unless my modem is somehow infected (if that's possible). However if I can avoid having to do that I will. From what little I know about reinstalling a BIOS it's risky and could permanently disable my motherboard. Also, it could be possible that the infection I have has made it impossible for me to reinstall my BIOS after wiping. I figured it was safest to first get another's opinion, someone who knows how to deal with this kind of stuff.

Here are the screenshots after I delete the 'My Computer' shortcut and 'Greg' folder from my desktop:

After deleting initial two keys (all other tabs in RogueKiller are clear aside from MBR):

Same thing as the first screenshot, just wanted to show the rest of the key:

After hitting 'Delete' in RogeKiller:

Currently, the files aren't on my desktop so I'm not sure what happened. But I can guarantee they'll be back when I restart my system.

I've scanned with Malwarebyte's PRO trial version and it didn't find anything. TDSSKiller hasn't found anything but I haven't tried scanning loaded modules yet.

Any help with this issue would be greatly appreciated. I will provide new screenshots when the rootkit decides to show me something I haven't already posted.

thanks in advance

-Greg

[Sinn]

Forgot to post the log output! Here are the RogueKiller logs that go along with the screenshots:

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Greg [Admin rights]

Mode : Scan -- Date : 11/13/2012 23:09:21

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3000HLFS-01G6U0 ATA Device +++++

--- User ---

[MBR] cac06dce2f91b4b3b47dfc74298b7569

[bSP] 02e1d13f38e1f3d9838aac813f23aed8 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 286066 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_11132012_02d2309.txt >>

RKreport[1]_S_11132012_02d2309.txt

After deleting:

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Greg [Admin rights]

Mode : Remove -- Date : 11/13/2012 23:09:26

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\NewStartPanel : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3000HLFS-01G6U0 ATA Device +++++

--- User ---

[MBR] cac06dce2f91b4b3b47dfc74298b7569

[bSP] 02e1d13f38e1f3d9838aac813f23aed8 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 286066 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[2]_D_11132012_02d2309.txt >>

RKreport[1]_S_11132012_02d2309.txt ; RKreport[2]_D_11132012_02d2309.txt

New scan shows this after RogueKiller's key deletion:

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Greg [Admin rights]

Mode : Scan -- Date : 11/13/2012 23:09:34

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3000HLFS-01G6U0 ATA Device +++++

--- User ---

[MBR] cac06dce2f91b4b3b47dfc74298b7569

[bSP] 02e1d13f38e1f3d9838aac813f23aed8 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 286066 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[3]_S_11132012_02d2309.txt >>

RKreport[1]_S_11132012_02d2309.txt ; RKreport[2]_D_11132012_02d2309.txt ; RKreport[3]_S_11132012_02d2309.txt

[Sinn]

New screenshots showing what I mean by "desktop shortcuts," I believe the threat is still active while these icons are on my desktop:

"Greg" user folder and "My Computer" are located on the top right hand corner of the desktop.

Screenshot taken after deleting "My Computer," also shows contents of "Greg" desktop version:

Now if I delete that "Greg" folder from the desktop and then scan with RogueKiller it will find the same initial two registry keys I posted before. I hope this helps.

[MrCharlie]

my only option left is to flash my BIOS

I wouldn't do that!

There's no need to fix those entries by RogueKiller in the first place IMO.

They appear in just about every RK log.

RK creates a quarantine folder on your desktop that has a backup of anything fixed by RK.

Leave those entries alone and stop worrring about them.

Good Luck.....MrC

[Sinn]

So I am not infected with a rootkit right now?

Also, if that's the case and my comp is clean, shouldn't RogueKiller not detect anything at all when I press scan?

[MrCharlie]

So I am not infected with a rootkit right now?

Also, if that's the case and my comp is clean, shouldn't RogueKiller not detect anything at all when I press scan?

In just about every log from RogueKiller those entries appear. Keep in mind that not all that RK finds is bad.

If you want to check for rootkits:

Please create a new system restore point before running Malwarebytes Anti-Malware.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

MrC

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!