Jump to content

persistent tpcvi.sys (Rootkit.Agent)


LongLakeJ

Recommended Posts

I have a persistent Rootkit.Agent that will not leave despite several runs of Malwarebytes' Anti-Malware 1.46 as well as CCleaner and SAS. My logs are as follows:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4644

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

9/18/2010 12:28:42 PM

mbam-log-2010-09-18 (12-28-42).txt

Scan type: Quick scan

Objects scanned: 142156

Time elapsed: 6 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\system32\Drivers\tpcvi.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Jeff at 12:42:13.76 on Sat 09/18/2010

Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_18

Microsoft

Attach.zip

Link to post
Share on other sites

LongLakeJ:

icon11.gif Download Combofix from either of the links below, and save it to your desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

  • If you have trouble, stop and post back. Do not try to repeatedly run comboFix!
  • When finished, it will produce a report for you.

.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

LongLakeJ:

icon11.gif Download Combofix from either of the links below, and save it to your desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

  • If you have trouble, stop and post back. Do not try to repeatedly run comboFix!
  • When finished, it will produce a report for you.

.

Please include the following in your next post:

  • ComboFix log

Thank you for taking this on, RPMcMurphy. I very much appreciate your help. I downloaded ComboFix.exe to my desktop then attempted to disable AVG 9.0. I can disable the resident shield via unchecking the box. There however is no option for disabling the "Antivirus" and "Antispyware" portion of AVG 9. Meanwhile, ComboFix.exe is prompting me to close AVG Antivirus & AVG Antispyware. It appears I'd have to uninstall AVG 9.0 completely. Is this the course you recommend?

Link to post
Share on other sites

Ack! On the ComboFix popup, there is only an "OK" button. I clicked the "X" in the upper right corner of the popup, but my computer beeped and the ComboFix popup changed to warn me that The 2 AVG scanners are still enabled and that ComboFix will run anyway at my own risk. Is there a way to exit ComboFix so that I may follow your directions of rebooting in safe mode before proceeding with ComboFix?

Link to post
Share on other sites

Now I truly need some serious help... I clicked on the "x" in the upper right corner of the last popup mentioned in my previous post hoping then that ComboFix wouldn't start. Instead, it started right up, and let me know it was preparing a restore point and that it normally takes 10 minutes, sometimes double that on some machines. After 5 or 10 minutes, another ComboFix popup telling me that it there had been rootkit activity and that it needed to reboot the computer. I clicked "okay" at which point the computer shut itself down and started to reboot. It is now stuck at the screen that normally displays while I'm waiting for my logon screen to appear. It's simply been sitting at that point for about 1/2 hr with no disk activity. Please help!

Link to post
Share on other sites

Shortly after my last post, the computer shut itself down. This morning I powered on and received a msg that the computer had overheated and shut itself off last night. I had the option of a restore, to which I chose "no." At that point the computer powered up and ComboFix continued and finished. Keep in mind that AVG never did get properly disabled for the ComboFix run. Here's the log:

ComboFix 10-09-17.04 - Jeff 09/19/2010 9:41.1.2 - x86

Microsoft

Link to post
Share on other sites

LongLakeJ:

Sorry, I just missed your post last night. Please do this next:

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DDS::

DDS::
uInternet Settings,ProxyServer = proxy:8080
uInternet Settings,ProxyOverride = *.local;<local>
Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\tpcvi]

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

icon11.gif You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:

  • ComboFix log
  • MBAM log

Link to post
Share on other sites

RPMcMurphy, I apologize for being a very slow learner. I ended up simply uninstalling AVG, since I simply couldn't disable it. Yet I didn't realize that I'd left Windows Defender on, doh! Does that mean a redo? If so, at least I'm slowly getting the hang of this :)

Aside from my missteps, here are the logs you requested:

ComboFix 10-09-17.04 - Jeff 09/19/2010 14:32:35.2.2 - x86

Microsoft

Link to post
Share on other sites

LongLakeJ:

Looks like I need you to run one more ComboFix script; make sure you disable Windows Defender this time also:

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DDS::

File::
C:\Windows\system32\Drivers\tpcvi.sys
Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\tpcvi]

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

LongLakeJ:

That was fine, please run this now:

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Driver::

Driver::
tpcvi
KillAll::

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

RPMcMurphy,

I started ComboFix six or seven hours ago. The program seems to have progressed no further than it had in the first few minutes. Screen still reads, "Scanning for infected files

This typically doesn't take more than ten minutes

However, scan times for badly infected computers may easily double."

Is this normal? Should I abort in some fashion and if so, what steps might I take? (Or do I just need to chill out and let it run?)

Thanks much:)

Link to post
Share on other sites

This scan was done without internet access. Hopefully that's ok. I won't be able to access the internet with the infected computer until tonight. I've transferred the combofix.txt file via flash drive to upload this on another computer. Here it is:

ComboFix 10-09-19.01 - Jeff 09/20/2010 9:52.4.2 - x86

Microsoft

Link to post
Share on other sites

LongLakeJ:

That was fine. You will need to have internet access for these next steps though:

icon11.gif Update MBAM and run another Quick Scan.

icon11.gifYour Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java components and update.

  • Go to this page.
  • Scroll down to where it says "Java Platform, Standard Edition."
  • Click the "Download JRE" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files

    [*]Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

    [*]Click OK to leave the Temporary Files Window

    [*]Click OK to leave the Java Control Panel.

icon11.gif Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take quite a long time to download.

  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases

    [*]Click on My Computer under the green Scan bar to the left to start the scan.

    [*]Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

    [*]Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

    [*]Click View report... at the bottom.

    [*] Click the Save report... button.

    [*] Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

  • MBAM log
  • Kaspersky log

Link to post
Share on other sites

Whew, the Kaspersy scan took just a hair short of 4 hours:) Here are its details preceded by the MBAM log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4660

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

9/20/2010 6:23:43 PM

mbam-log-2010-09-20 (18-23-43).txt

Scan type: Quick scan

Objects scanned: 143688

Time elapsed: 5 minute(s), 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\System32\drivers\tpcvi.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Monday, September 20, 2010

Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Monday, September 20, 2010 19:08:13

Records in database: 4230659

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

D:\

E:\

F:\

Scan statistics:

Objects scanned: 232739

Threats found: 2

Infected objects found: 2

Suspicious objects found: 0

Scan duration: 03:57:23

File name / Threat / Threats count

C:\Qoobox\Quarantine\C\Windows\system32\Drivers\i8042prt.sys.vir Infected: Virus.Win32.TDSS.b 1

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\6f69d9da-54c99ee9 Infected: Trojan-Downloader.Java.Agent.hi 1

Selected area has been scanned.

Link to post
Share on other sites

LongLakeJ:

Open notepad and copy/paste the text in the quotebox below into it:

@echo off

DIR /A %windir%\system32\drivers\tpcvi.sys > log.txt

notepad log.txt

del log.txt

Save this as peek.bat Choose to "Save type as - All Files"

It should look like this: bat_icon.gif

Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.

icon11.gif Open notepad and then copy and paste the contents of the code box below into it. Go to File > save as and name the file

Link to post
Share on other sites

Here we go <crossing fingers>:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4666

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

9/21/2010 4:33:23 PM

mbam-log-2010-09-21 (16-33-23).txt

Scan type: Quick scan

Objects scanned: 146650

Time elapsed: 5 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

LongLakeJ:

Your logs look good! All I have left for you do do is some very important cleanup:

icon11.gif Uninstall ComboFix

  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall

Combofix_uninstall_image.jpg

icon11.gif Delete the following tools along with any other logs you saved from our work:

  • DDS
  • GMER

icon11.gif Download TFC to your desktop

  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean

icon11.gif Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  • Please visit this General Computer Security Forum and review this post for some helpful information.

Please post once more so I know you are all set and I can mark this thread resolved. Good luck and stay safe!

Link to post
Share on other sites

Yeeha! Thank you, RPMcMurphy, for your perseverence, skill, and patience in guiding me through what I thought previously to be a computer disaster. You saved me much data and work and taught me lessons in security and backup of computer material. I've already instituted your suggestions and appreciate the links in the last post. All looks good from this end with one parting question: Do I need to rerun Defogger and hit "enable?" Thank you again!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.