Possible Root Kit ?

[Helixreader]

Having issues with startup and crashing during use.  Previous trouble solved by this forum awhile back.  Malwarebytes detects nothing, intermittently the program has not been able to run the anti root kit.  Had to  download application to desktop and disable Norton for it to run.  Anti rootkit detects nothing.  Crashes are beginning to cause other hardware problems.

Addition.txt

FRST.txt

[kevinf80]

Hello and welome,

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Next,

 

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to  your reply.

 

Or select "Export" you are given the option to export as a Text file (*.txt) or XML file (*.xml) Choose text file, save the exported file to a place of your choice. That file can be attached to your reply...

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Thanks,

 

Kevin...

 

 

 

 

 

 

 

Fixlist.txt

[Helixreader]

Kevin,

 

Thanks for the response.  Please find attached requested log files.  Ran tools out of order as AdwCleaner crashed the first two times. This was the order of the tools, FRST, Malwarebytes, Junkware Removal tool, Malicious Software Tool, and then AdwCleaner.

 

Between the time I have posted and your response the computer has crashed a few times while using Google Chrome.  Only problem since then was the system freezing with AdwCleaner tool.

 

Brian

AdwCleanerS0.txt

Fixlog.txt

JRT.txt

MBAM.txt

mrt.log

[kevinf80]

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

 

• 
  

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:

 

C:\Programdata\RogueKiller\Logs <-------- W7/8

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

 

Thanks,

 

Kevin

[Helixreader]

Kevin,

 

RogueKiller crashed the system two times, only seconds into the scans. Each time gave me a blue screen of death.  Error was the following:

 

System_Service_Exception

 

STOP: 0x0000003B (0x00000000C0000005, 0xFFFFF800038B8AEC, 0xFFFFF88007DF4F70, 0x0000000000000000)

 

Brian

[kevinf80]

3B codes are usually indicative of a graphics driver issue, have you just updated video drivers?

 

Are there any files in this folder: C:\Windows\MiniDump if so zip up the folder and attach it

[Helixreader]

A couple of weeks ago I did.  Thought that was my issue but NVIDIA software wasn't letting me rollback to previous driver.  

 

I don't know if I did this correctly for the minidump files, never done that before.  Let me know if this is not what you need.  Windows cradhed again, this was the text saying what occurred.

 

Problem signature:

  Problem Event Name: BlueScreen

  OS Version: 6.1.7601.2.1.0.768.3

  Locale ID: 1033

 

Additional information about the problem:

  BCCode: 7e

  BCP1: FFFFFFFFC0000005

  BCP2: FFFFF800038CB55B

  BCP3: FFFFF880035E7908

  BCP4: FFFFF880035E7160

  OS Version: 6_1_7601

  Service Pack: 1_0

  Product: 768_1

 

Files that help describe the problem:

  C:\Windows\Minidump\011915-36831-01.dmp

  C:\Users\Brian\AppData\Local\Temp\WER-84895-0.sysdata.xml

 

Read our privacy statement online:

  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

 

If the online privacy statement is not available, please read our privacy statement offline:

  C:\Windows\system32\en-US\erofflps.txt

 

 

Brian

 

 

Minidump.rar

[kevinf80]

Hello Brian,

 

The minidump folder you attached is empty, yet the log you post does show the presence of one file C:\Windows\Minidump\011915-36831-01.dmp

 

Can you check the folder and see if the file is there, if so zip and attach the file this time...

 

Please download this program Blue Screen Viewer  and unzip "Bluescreen View.exe" to your desktop.
Next, Select Start > Right click on "Computer" and select "Properties" select "Advanced System Settings" then "Advanced" tab. From the "Start up and Recovery" section select "settings" make sure the default folder is "%SystemRoot%\Minidump".
Go back to your desktop and double click on Bluescreen Viewer to run it, if there is any info available the program will grab the most recent. Choose save from the Toolbar and copy paste to your next reply. If there is no information available try and re-create the BSOD and try again with the tool to collect the information.
 

Thanks,

 

Kevin...

[Helixreader]

Kevin,

 

The zip utility I am using will not allow me to zip the minidump files.  There is a padlock on the folder, when I try to zip I receive a message saying I do not have read options and the folder is empty but there is clearly three files in the folder.

 

I attached the file from the BSOD utility.

 

Brian

BSOD.txt

[kevinf80]

Thanks for the log, seems to confirm a graphics driver issue, can you either roll back to a previous driver via Device Manager or uninstall the present driver and re-boot.

Windows will see the card and attribute a fresh driver on boot....

[Helixreader]

Kevin,

 

Will do. 

 

At work now, I will try it around 4:30 - 5:00 pm Eastern.

 

Brian

[kevinf80]

Thanks for the update, catch up later...

[Helixreader]

Kevin,

 

Went back to an older version of my video card driver that I know I wasn't having trouble with.  Prior to that I unistalled all Nvidia related stuff and did a clean install of the driver.  After that I tried to run RogueKiller again and it crashed the system again, only moments after starting its scan.  I ran the Blue Screen utility and the log file is attached.

 

This was the Windows message that appeared following a restart:

 

Problem signature:

  Problem Event Name: BlueScreen

  OS Version: 6.1.7601.2.1.0.768.3

  Locale ID: 1033

 

Additional information about the problem:

  BCCode: 3b

  BCP1: 00000000C0000005

  BCP2: FFFFF80003908AEC

  BCP3: FFFFF8800AB27F70

  BCP4: 0000000000000000

  OS Version: 6_1_7601

  Service Pack: 1_0

  Product: 768_1

 

Files that help describe the problem:

  C:\Windows\Minidump\012015-75005-01.dmp

  C:\Users\Brian\AppData\Local\Temp\WER-300691-0.sysdata.xml

 

Brian

BSOD_2.txt

[kevinf80]

Boot to safemode with networking, see if RogueKiller runs in that mode... The latest BSOD log indicates a graphic card or driver issue....

[Helixreader]

Booted to safe mode with networking.  System crashed during RogueKiller scan, blue screen occurred slightly further into the scan than it did in the normal Windows environment, but not by much.

 

Blue Screen View log attached.

 

Brian

BSOD_3.txt

[kevinf80]

The log again indicates graphics card or driver issue.. As you`ve rolled back to a known working driver maybe worthwhile reseating the Graphic card, or if possible get the card stress tested.... http://www.sevenforums.com/tutorials/100356-video-card-stress-test-furmark.html

[Helixreader]

Kevin,

 

Ran the stress test, not sure what I was looking for, system never crashed, saw some breakup of the pattern, and a low frame rate, but system never crashed.  Do you think this would be of any help? http://support.microsoft.com/kb/2719704

I try to stay up to date with Windows updates so I figure I should have already received and installed already.  

 

Tried RogueKiller again, crashed again.

 

Brian

[kevinf80]

I`m still concerned why the system crashes running RogueKiller, although crash details indicate a graphics problem i would still like to be certain there is no Malware/infection on your system.

The scanners we ran successfully do not show a definite infection or similar, rootkit etc. See if the following will run:

 

Please read carefully and follow these steps.

• Download TDSSKiller from here  http://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop.
• Doubleclick on to run the application.
  
• The "Ready to scan" window will open, Click on "Change parameters"  
  
  
  
  
  
• Place a checkmark next to Verify Driver Digital Signature  and Detect TDLFS file system, (Leave "Service & Drivers" and "Boot Sectors" ticked. Click OK.
   
  
  
  
  
  
• Select "Start Scan"
  
  
  
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

 

Next,

 

Please download aswMBR from here: http://files.avast.com/files/rootkit-scanner/aswmbr.exe Save to your desktop.

 

• 
  

Double click theaswMBR.exe icon, and click Run
There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
Click the Scan button to start the scan once the update has finished downloading
On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.

 

Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).

 

Thanks,

 

Kevin..

[Helixreader]

Thanks Kevin.  Will try this after work again.

 

Brian

[kevinf80]

Thanks for the update Brian, post logs anytime you`re ready.

 

Kevin..

[Helixreader]

Kevin,

 

aswMBR loaded with a prompt that said,  This computer supports "Virtualization Technology". Would you like to use it for root kit detection?  I selected "yes".

 

Logs attached.

 

Brian

aswMBR.txt

Kaspersky.txt

[Helixreader]

Kevin,

 

System crashed checking e-mail this morning.  Different error on BSOD.  Attached log from Blue Screen View.

 

Brian

BSOD_4.txt

[kevinf80]

Hello Brian,

 

Good to see the rootkit scans were clear, at least we have no malware/infection to worry about.

 

The latest BSOD is pointing the finger of blame at memory (RAM) issues, I guess we need to check that out and see what gives...

 

Go here: http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html follow those instructions and run a memory check...

 

If those checks come back ok go here: http://www.memtest86.com/ d/l and run MemTest86, ensure to use version 5, it supports 64bit systems.. Support forum at this link: http://www.passmark.com/support/index.htm if you need help/advice...

 

Cheers,

 

Kevin...

[Helixreader]

That is a relief.  Thanks Kevin.  Since it is probably not malware related is there anything else I need to do or just get rid of the programs?  Reaaly appreciate your time.

 

Brian

[kevinf80]

There is nothing on the logs to indicate malware/infection as the root cause of the BSOD, certainly does look a possible hardware issue.

 

Run the following to clean up tools etc..

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

 

• 
  

   Remove disinfection tools
   Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Any remnant files/logs from tools we have used can be deleted...

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Let me know if we are ok to close out.....

 

Cheers,

 

Kevin..