Rootkit infection

[practiceryan]

Hi,

I had a redirect virus which also slowed youtube videos. After some investigation i have discovered there is a rootkit on the system. MBAM does not find anything, the malwarebytes anti rootkit crashes after "Malware Found: 2" at sector 1953505700.

I'm at a loss as to what to do from here. Kaspersky's TDSSKiller does not even start.

Cheers

[practiceryan]

I have tried TDSSKiller and malwarebytes in safe mode, both have the exact same problem. When i try and find a solution Chrome has the frame of mind of stopping working. Very frustrating

[jeffce]

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.
  
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that....Let's get going!!

----------

[jeffce]

Please download DDS from either of these links

LINK 1

LINK 2

and save it to your desktop.

• Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
  
• Double click dds to run the tool.
  
• When done, two DDS.txt's will open.
  
• Save both reports to your desktop.
  

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

Attach.txt

----------

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
  
• Click the Scan button to start scan.
  
• If you are asked to update the Avast Virus database please allow it to do so.
  
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
  

Click the image to enlarge it

----------

[practiceryan]

These are the files, The aswMBR does not run. Should i start in safemode or will it not matter (similar to TDSSKiller issue)

attach.txt

dds.txt

[practiceryan]

Cant edit my post -

I have tried in safe mode. no luck, it wont open, the dialog box opens to confirm the action then nothing

[jeffce]

Malwarebytes Anti-Rootkit

Please download Malwarebytes Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page.
  
• Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  
• Scan your system for malware
  
• If malware is found, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  

If no malware is found please let me know.

----------

[practiceryan]

As previously stated, the anti-rootkit crashes (not responding) after a short time. Both in and out of safe mode.

I have left it running to see if catches up (i dont have high hopes for it)

[jeffce]

Sorry about that...I misread you ran the rootkit tool...I thought it was just Malwarebytes.

FRST

Download the 64 bit version for your system of FRST and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Use the arrow keys to select the Repair your computer menu item.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account an click Next.
  

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.
  

On the System Recovery Options menu you will get the following options:

• 
  
  • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
    

  [*]Select Command Prompt

  [*]In the command window type in notepad and press Enter.

  [*]The notepad opens. Under File menu select Open.

  [*]Select "Computer" and find your flash drive letter and close the notepad.

  [*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

  Note: Replace letter e with the drive letter of your flash drive.

  [*]The tool will start to run.

  [*]When the tool opens click Yes to disclaimer.

  [*]Press Scan button.

  [*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

----------

[practiceryan]

although i couldnt go down the repair your computer root, it got stuck at windows loading files. I'm starting to think a remaster will be the solution, although with all the files i have (raw audio files) i would rather avoid

Thanks for the help so far

FRST.txt

[jeffce]

ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your desktop**

If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

• 
  When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.
  

[practiceryan]

Combofix report. Let me know if i need to do it outside of safemode, i can attempt it again

Cheers for the help so far

ComboFix.txt

[jeffce]

Yes please run ComboFix again in Normal Mode and post the new log if you are able.

[practiceryan]

The out of safe mode report

ComboFix.txt

[jeffce]

Hi,

Good job!

Please go to: VirusTotal

On the page you'll find a "Choose File" button.

Click on the Choose File button.

In the Choose File to Upload window which opens, copy and paste this into the File Name box.

C:\Users\Main\killbot.exe

Next, click the Open button.

Then click the "Scan It!" button just below.

This will scan the file. Please be patient.

If you get a message saying File has already been analyzed: click Reanalyze file now

Once scanned, copy and paste the link to the results page in your next reply.

----------

[practiceryan]

That file cannot be found, also, previous to posting here i (potentially messed up all kinds of fixing) followed some earlier posts on forums. (renaming certain programs to stop viruses from cancelling the job, killbot.exe was what i named mbar i believe)

[jeffce]

Ok thanks for letting me know about that....how is your system running?

[practiceryan]

no change. It's like a bad spot, you know its there and its really off putting but it's not really doing anything (slows things down and effectively disables youtube but everything else is fine-ish)

[jeffce]

Is this taking place in all your browsers or which one?

[practiceryan]

We use chrome, is it worth re-installing it?

[jeffce]

I like Chrome myself. You might try a complete uninstall of Chrome and reinstall it and see if that helps.

[practiceryan]

Ok, Cheers i shall give it a go

[jeffce]

Ok let me know if that fixes it up.

[practiceryan]

Everything is still slow, it hasnt made a difference

[jeffce]

OTL

• Download OTL to your desktop.
  
• Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Select All Users
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
    

----------