Jump to content

CLB Driver Infection

ZebedeeMcDougal
 Share

Recommended Posts

ZebedeeMcDougal

ZebedeeMcDougal

Posted
Posted

Thanks for your help in advance guys :(

I have been following the self-help guide on treatment of a CLB Rootkit Infection (specifically mine is the GAOPDX... one). However, I have come unstuck in finding the CLB driver which is causing all the hassle - RootRepeal seems to show 4 different files fitting the description listed in the self-help guide i.e. gaopdx*********...yawn....****.sys

Just for the record I have been using and updating MBAM daily. It keeps finding the same trojan agent on reboot - gaopdxcounter - and 'successfully delelting it.'

Here is the RootRepeal log:

ROOTREPEAL © AD, 2007-2008

==================================================

Scan Time: 2009/03/25 23:21

Program Version: Version 1.2.3.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: C:\WINDOWS\WindowsUpdate.log

Status: Allocation size mismatch (API: 2326528, Raw: 1310720)

Path: C:\WINDOWS\SYSTEM32\gaopdxcounter

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\gaopdxhtkosvptbxsplqypnqqteypjhfvnyswt.dll

Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Philip Dodd\ntuser.dat.LOG

Status: Allocation size mismatch (API: 196608, Raw: 32768)

Path: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG

Status: Allocation size mismatch (API: 262144, Raw: 32768)

Path: C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG

Status: Allocation size mismatch (API: 65536, Raw: 32768)

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxdrutoqbitetillxodapxmdiyxyxuqwrq.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxmltsenqqlmsqtmwxwgodpmyvslyxuoov.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxqbivkipfqxodsxyiopxevdhairrputow.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxogjlkyrqjovtmxxnxdupqtogylmckbeb.sys

Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Temp\etilqs_lKpNdfXxUS9gXxKU1Wfd

Status: Allocation size mismatch (API: 32768, Raw: 0)

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Temp\etilqs_EFhY5ZP0awTFD6w92X4T

Status: Allocation size mismatch (API: 32768, Raw: 0)

Path: C:\FOUND.000

Status: Visible to the Windows API, but not on disk.

Path: C:\Store.LOG

Status: Visible to the Windows API, but not on disk.

Path: C:\FOUND.001

Status: Visible to the Windows API, but not on disk.

Path: C:\FOUND.002

Status: Visible to the Windows API, but not on disk.

Path: C:\FOUND.003

Status: Visible to the Windows API, but not on disk.

Path: C:\FOUND.004

Status: Visible to the Windows API, but not on disk.

Path: C:\BlueByte

Status: Visible to the Windows API, but not on disk.

Path: C:\a6km.bin

Status: Visible to the Windows API, but not on disk.

Path: C:\A6Km.30

Status: Visible to the Windows API, but not on disk.

Path: C:\NIS_ENG.LOG

Status: Visible to the Windows API, but not on disk.

Path: C:\NERO.LOG

Status: Visible to the Windows API, but not on disk.

Path: C:\ASUSDVD.LOG

Status: Visible to the Windows API, but not on disk.

Path: C:\WINDOWS

Status: Visible to the Windows API, but not on disk.

Path: C:\ntldr

Status: Visible to the Windows API, but not on disk.

Path: C:\NTDETECT.COM

Status: Visible to the Windows API, but not on disk.

Path: C:\XPHE_SP2.ENG

Status: Visible to the Windows API, but not on disk.

Path: C:\pagefile.sys

Status: Visible to the Windows API, but not on disk.

Path: C:\SUPPORT

Status: Visible to the Windows API, but not on disk.

Path: C:\VALUEADD

Status: Visible to the Windows API, but not on disk.

Path: C:\boot.ini

Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings

Status: Visible to the Windows API, but not on disk.

Path: C:\Program Files

Status: Visible to the Windows API, but not on disk.

Path: C:\CONFIG.SYS

Status: Visible to the Windows API, but not on disk.

Path: C:\AUTOEXEC.BAT

Status: Visible to the Windows API, but not on disk.

Path: C:\IO.SYS

Status: Visible to the Windows API, but not on disk.

Path: C:\MSDOS.SYS

Status: Visible to the Windows API, but not on disk.

Path: C:\System Volume Information

Status: Visible to the Windows API, but not on disk.

Path: C:\Win32.Worm.Downladup.Gen.log

Status: Visible to the Windows API, but not on disk.

Path: C:\ASWL2K.ini

Status: Visible to the Windows API, but not on disk.

Path: C:\Finish.log

Status: Visible to the Windows API, but not on disk.

Path: C:\devlist.txt

Status: Visible to the Windows API, but not on disk.

Path: C:\Recycled

Status: Visible to the Windows API, but not on disk.

Path: C:\MSOCache

Status: Visible to the Windows API, but not on disk.

Path: C:\Dev-Cpp

Status: Visible to the Windows API, but not on disk.

Path: C:\5a2a2020ddabe3b7eff220

Status: Visible to the Windows API, but not on disk.

Path: C:\CM9798

Status: Visible to the Windows API, but not on disk.

Path: C:\log.txt

Status: Visible to the Windows API, but not on disk.

Path: C:\plap.txt

Status: Visible to the Windows API, but not on disk.

Path: C:\MPS

Status: Visible to the Windows API, but not on disk.

Path: C:\cm9798a

Status: Visible to the Windows API, but not on disk.

Path: C:\My Downloads

Status: Visible to the Windows API, but not on disk.

Path: C:\WESTWOOD

Status: Visible to the Windows API, but not on disk.

Path: C:\Logs

Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Temp\~NSU.TMP\Au_.exe

Status: Allocation size mismatch (API: 19202048, Raw: 0)

Path: C:\Documents and Settings\Philip Dodd\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\places.sqlite-journal

Status: Allocation size mismatch (API: 1081344, Raw: 98304)

Path: C:\Documents and Settings\Philip Dodd\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\places.sqlite

Status: Allocation size mismatch (API: 2392064, Raw: 1572864)

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\urlclassifier3.sqlite

Status: Allocation size mismatch (API: 21921792, Raw: 21790720)

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\Cache\_CACHE_001_

Status: Allocation size mismatch (API: 1081344, Raw: 622592)

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\Cache\_CACHE_002_

Status: Allocation size mismatch (API: 1081344, Raw: 655360)

Path: C:\Documents and Settings\Philip Dodd\Local Settings\Application Data\Mozilla\Firefox\Profiles\uevu5exf.default\Cache\_CACHE_003_

Status: Allocation size mismatch (API: 2129920, Raw: 1474560)

Thanks again for any help that you can give.

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted

Ok and yes your on the money.

If you wipe all of these in one sitting then reboot immediately,update MBAM and run quick scan then post back the log generated :(

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxdrutoqbitetillxodapxmdiyxyxuqwrq.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxmltsenqqlmsqtmwxwgodpmyvslyxuoov.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxqbivkipfqxodsxyiopxevdhairrputow.sys

Status: Invisible to the Windows API!

Path: C:\WINDOWS\SYSTEM32\DRIVERS\gaopdxogjlkyrqjovtmxxnxdupqtogylmckbeb.sys

Status: Invisible to the Windows API!

Link to post
Share on other sites
ZebedeeMcDougal

ZebedeeMcDougal

Posted
  • Author
Posted

Here it is:

Malwarebytes' Anti-Malware 1.34

Database version: 1898

Windows 5.1.2600 Service Pack 3

26/03/2009 00:09:14

mbam-log-2009-03-26 (00-09-14).txt

Scan type: Quick Scan

Objects scanned: 86418

Time elapsed: 6 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted

Ok that dose'nt seem to be dislodging CLB for your variant so lets try another powerful diagnostic tool into the equation.

STEP 01

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:
You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.
Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

http://www.forospyware.com/sUBs/ComboFix.exe' rel="external nofollow">

Note:
The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.
Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.