Jump to content

Help with rootkit.fileless.mtgen

Recommended Posts

  • Root Admin

It looks like Rootkit scanning was not enabled. Please do the following.


Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.



Link to post
Share on other sites

Here is the updated log.  Note that it detected and quarantined rootkit.fileless.mtgen during the scan even though it shows no malicious items in the log.


Malwarebytes Anti-Malware

Scan Date: 5/4/2016
Scan Time: 11:58 AM
Administrator: Yes

Malware Database: v2016.05.04.05
Rootkit Database: v2016.04.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: garym

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 575546
Time Elapsed: 55 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


Link to post
Share on other sites

  • Root Admin

Okay let me have you restart the computer then. If it's really gone it should not show up again. After the restart please run another scan with MBAM and then also run FRST and make sure you place a check mark in the Additions check box and attach all new logs on your next reply.



Link to post
Share on other sites

  • Root Admin

Can you please zip the following file and upload it.


Do you see other files in this folder besides the bat file ?



The antivirus software is missing it too for some reason.



Link to post
Share on other sites

  • Staff


I am one of the researchers that has been looking at this case with Ron. (Hope you don't mind me asking for additional info Ron )

I have another file request from you if you don't mind please.

Please re-run FRST again & this time, checkmark the option for "shortcut.txt" & hit "scan"
Once scan is complete, a shortcut.txt will be in the same folder you have FRST (in your downloads folder). Please attach shortcut.txt to your next reply. Depending on this log result, I may have more file requests but this is good for now.


When you have MBAM fix the Fileless infection, are either Avast or Spybot notifying you afterward about registry changes?

Thank you for your continued patience! :)

Link to post
Share on other sites

  • Staff



The files you sent so far, the shortcut starts the bat file which in turn tries to open the file with the .0cc512 extension. This just results in an error message since that file is not an actual executable so windows doesn't know what to do with it.

Unless I just can't see it.. the shortcut log didn't show me what I wanted to see.

More digging. 

Can you find this file?
C:\Users\garym\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8012b.lnk
If so, zip a copy & attach it here? (if you zip it right in your startup folder, please delete the zip once you attach it here - otherwise next time you boot the zip will try opening as well)

Also: What is in here?

Zip & attach if anything in it? 


Link to post
Share on other sites

  • Root Admin

Let's have you run the following fix please.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.



Then restart the computer and run a new MBAM Threat Scan and let me know if you're still seeing or having any issues.



Link to post
Share on other sites

  • Root Admin

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.