CLB driver infection

[mago]

Hi,

I have a pc that is showing all the signs listed in the topic "MBAM wont install or will not run., CLB Rootkit driver=TDSS/Seneka/GAOPDX/UAC/ovfst/kungsf/SKYNET" but cannot find the sys file.

the rootrepeal log for the c drive is attached. i have more drives, but rootrepeal crashes after doing the c drive.

The system is a dual boot windows vista ultimate windows xp home, and the bug is on the vista system. I will try a mbam on the xp side.

thanks

Mago

rootrepealc.txt

rootrepealc.txt

[mago]

BTW, the link for rootrepeal in the topic MBAM wont install or will not run., CLB Rootkit driver=TDSS/Seneka/GAOPDX/UAC/ovfst/kungsf/SKYNET" does not work.

[mago]

XP side failed to boot. Any Ideas On the issue?

[sjpritch25]

Welcome to Malwarebytes

Are you able to get into Normal Mode?

[mago]

Thanks for the welcome.

Windows vista will boot into normal mode, but MBAM will not start (either in normal vista or safe mode). Is there a procedure you would like me to follow?

[sjpritch25]

Download DDS and save it to your desktop from here or here or here

Disable any script blocker, and then double click dss.scr to run the tool.

• When done, DDS will open two (2) logs:
  

1. DDS.txt
2. Attach.txt
   

• Save both reports to your desktop
• In your next reply, please attach both logs. Thanks
  

[mago]

Thanks for your help.

Here are the files

DDS.txt

Attach.zip

DDS.txt

Attach.zip

[sjpritch25]

Download GMER Antirootkit Here, click on Download EXE and save to your Desktop

• Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver
  
• Double-click Gmer.exe to run the program.
  
• When the program opens, click the "Rootkit" Tab
  
• On the right-side, check all the items to be scanned, but leave "Show All" unchecked
  
• Select all drives that are connected to your system to be scanned
  
• Click the Scan button
  
• When the scan is finished, click Copy to save the scan log to the Windows clipboard
  
• Open Notepad or a similar text editor
  
• Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
  
• Save the gmer scan log and post it in your next reply.
  
• Close Gmer
  
• Open a command prompt (Start | run |type cmd and hit Enter)
  • Type or paste the following to unload the gmer driver:
    
  • net stop gmer
    
  • Hit Enter
    
  • Exit the command prompt.
    

  [*]Re-enable all active protection.

[mago]

sorry for the delay - sick kid takes precedence over sick secondary pc. system offline until i kill this bug. files ( I ran the scan twice to be sure it checked all drives)

gmer.txt

gmer2.txt

gmer.txt

gmer2.txt

[sjpritch25]

Download RootRepeal:

http://rootrepeal.googlepages.com/RootRepeal.zip

• Extract the archive to a folder you create such as C:\RootRepeal
  
• Double-click RootRepeal.exe to launch the program (Vista users should right-click and select "Run as Administrator).
  
• Click the "File" tab (located at the bottom of the RootRepeal screen)
  
• Click the "Scan" button
  
• In the popup dialog, check the drives to be scanned - making sure to check your primary operating system drive - normally C:
  
• Click OK and the file scan will begin
  
• When the scan is done, there will be files listed, but most if not all of them will be legitimate
  
• Look for the following file
  C:\Windows\System32\drivers\MSIVXtorpvdipjrhyxfwlaeynvobtbcnxhcpf.sys
  
• Right-click on that files and choose wipe file.
  
• Reboot your pc.
  
• Open MBAM, update to the latest definitions, run a quick scan, remove all detected items, reboot(if prompted).
  
• In your next reply, please post the MBAM log. Thanks
  

[mago]

log attached. System is exclude from the internet until an all clear is given. BTW though MBAM would open, it could not update.

mbam_log_2009_07_11__14_53_21_.txt

mbam_log_2009_07_11__14_53_21_.txt

[sjpritch25]

Run mbam gain, try to update to the latest definitions, and post the log. Thanks

[mago]

MBAM update successful. log attached. scan clean. Thanks again for you help

mbam_log_2009_07_13__11_09_03_.txt

mbam_log_2009_07_13__11_09_03_.txt

[sjpritch25]

How is everything running???

[mago]

Everything is running fine. AV (trend micro) has been updated and scan found nothing. System is still off the net. Basically, once we found that there was a problem the system has not been used.

[sjpritch25]

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Ugrading Java:

• Download the latest version of Java Runtime Environment (JRE) 6u14.
  
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  
• Click the "Download" button to the right.
  
• Check the box that says: "Accept License Agreement".
  
• The page will refresh.
  
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java version.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on the download to install the newest version.