Infected - MB and HJT won't run - Skynet rootkit

The.Wanderer · August 28, 2009

My computer has been experiencing some problems for a few days now, mostly the annoying fake antivirus popups such as WinAntiVirus Pro and most recently Antivirus 2010. Malwarebytes Anti-Malware has been working fine for me up until this point. I started to see some of those popups so I ran MBAM. It scanned fine and then on removal crashed. After that, whenever I open it, it will scan for 2 seconds and then close. Upon rebooting MBAM it tells me that I don't have permission to access the file. The same scan, close, deny access situation happens with HijackThis as well.

Along with the program problems, whenever I do a google search the results are hacked and redirect me to various websites the first few attempts to load the page. If I open about 3 of the same page, the last one will finally load as it should. Anyway, please help me as soon as possible and get back to me with what kind of program I should run to get the necessary logs to those of you here who can help me. Thank you.

Edited September 4, 2009 by Maurice Naggar
Edited topic description for detail

Maurice Naggar · August 29, 2009

Hello The.Wanderer,

Your Windows version & edition is ?? Your Internet Explorer version is ??

That kind of information is important for more accurate guidance.

Do this to close the rogue window. Repeat as needed.

Use ALT+F4 keys to close those rogue pop-up windows. Press and hold the ALT key & then press F4 key.

Do NOT use this system for web searches or web surfing, online games, etc.

If unable to download tools on this system, use another and copy / burn to CD DVD or clean USB thumb-flash drive, and copy onto Desktop of this pc.

Do this:

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

=

1. Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

2. Take out the trash (temporary files & temporary internet files)

Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every user-login account {User Profile}

=

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

Double-click FixPolicies.exe.
Click the "Install" button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
A black box will briefly appear and then close.
This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.

Download DDS and save it to your desktop from http://www.techsupportforum.com/sectools/sUBs/dds here or http://download.bleepingcomputer.com/sUBs/dds.scr or

http://www.forospyware.com/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.

Then double click dds.scr to run the tool.

When done, DDS.txt will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
[*]Save both reports to your desktop.

Go >> here <<

and download RootRepeal and SAVE to your Desktop.

Doubleclick RootRepeal.exe icon on your Desktop.

Click on the Report tab at bottom of window and then click on Scan button.

A Windows will open asking what to include in the scan. Check all of the below and then click Ok.

Drivers

Files

Processes

SSDT

Hidden Services

Stealth Objects

You will then be asked which drive to scan.

Check C: (or the drive your operating system is installed on if not C) and click Ok again.

The scan will start.

It will take a little while so please be patient. When the scan has finished, click on Save Report.

Name the log RootRepeal.txt and save it to your Documents folder (it should default there).

When you have done this, please copy and paste it in this thread.

=

Please include the following logs in your next reply:

DDS.txt

Attach.txt

RootRepeal.txt

The.Wanderer · August 29, 2009

Sorry I have usually been able to fix most of my virus problems on my own so this whole having someone help through forum is a bit new to me so sorry for any non-included information.

Internet Explorer version is the newest(8?) I just installed it a few days ago and was working fine until now. It would not even open today until I reinstalled it but I'm not using that computer for internet right now anyway.

1. Downloaded and ran ERUNT and saved a backup in the default location.

2. Turned on show hidden file, extensions, and operating system files.

3. Downloaded and ran ATF Cleaner and deleted all files.

4. Downloaded and ran Fix Policies which gave me the brief command box as you said.

5. Downloaded and ran DDS however, when I tried to run DDS.scr a black command box appeared for a second or two and then closed itself. It had some text/instructions on it that I could not read because it closed itself so I'm assuming this isn't normal. Due to this I was not able to get the DDS.txt or Attach.txt to post here.

6. Downloaded and ran Root Repeal. Unlike DDS this had no problems opening. However when I tried to scan I got a few popup errors saying it "could not read the boot sector" and "could not read the registry" or something similar. It did however finish the scan and gave me a log file which I will still post here.

RootRepeal.txt

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/08/29 01:32

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP2

==================================================

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xA8AB4000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xA95BB000 Size: 8192 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA6727000 Size: 49152 File Visible: No Signed: -

Status: -

Name: SKYNETikvfsjmc.sys

Image Path: C:\WINDOWS\system32\drivers\SKYNETikvfsjmc.sys

Address: 0xAAFC3000 Size: 151552 File Visible: - Signed: -

Status: Hidden from the Windows API!

Name: win32k.sys:1

Image Path: C:\WINDOWS\win32k.sys:1

Address: 0xBA488000 Size: 20480 File Visible: No Signed: -

Status: -

Name: win32k.sys:2

Image Path: C:\WINDOWS\win32k.sys:2

Address: 0xBA2B8000 Size: 61440 File Visible: No Signed: -

Status: -

Stealth Objects

-------------------