Broni Posted June 1, 2011 ID:435414 Share Posted June 1, 2011 I have a topic here: http://www.techspot.com/vb/topic165862.htmlThe computer in question had pci.sys file rootkited.That was cured by TDSSKiller and re-confirmed by 2nd TDSSKiller run.Little bit later, the user ran MBAM, which removed pci.sys file, making the computer unbootable.Eventually, I was able to replace the file and the computer is fine, but....what happened? Link to post Share on other sites More sharing options...
sUBs Posted June 1, 2011 ID:435435 Share Posted June 1, 2011 It would help if you would attach a copy of the pci.sys that was detected. Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435708 Share Posted June 2, 2011 Hi sUBs I just asked the poster to provide a copy of his quarantined files.I'll attach them, as soon, as I'll get them. Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435733 Share Posted June 2, 2011 Attached are zipped both files from MBAM quarantine folder...BACKUP1.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted June 2, 2011 Staff ID:435737 Share Posted June 2, 2011 I got the file from the post. i scanned it on VThttp://www.virustotal.com/file-scan/report.html?id=222920f3d16d61b2d42c062d860c33b535c1b3049b0c5ebb40fd53e534bee736-1306977711Looks like it was still present there. This file in the quaritine was definately tdss.. Can you get the scan log?Anyways we worked around it for now so it wont kill anymore systems. Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435740 Share Posted June 2, 2011 Thanks for looking at it I just requested that log. Link to post Share on other sites More sharing options...
Staff shadowwar Posted June 2, 2011 Staff ID:435741 Share Posted June 2, 2011 Read the post some more..2011/05/31 17:04:33.0703 3744 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pci.sys. Real md5: 1e575703eead3ddf0ead9ba6324e9d01, Fake md5: a219903ccf74233761d92bef471a07b12011/05/31 17:04:35.0984 3744 Backup copy not found, trying to cure infected file..2011/05/31 17:04:35.0984 3744 Cure success, using it..2011/05/31 17:04:36.0031 3744 C:\WINDOWS\system32\DRIVERS\pci.sys - will be cured after rebootSeems tdsskiller if cant find a backup just disables but leaves the tdss part inside the file. If you notice the VT report you will see there is no version info=Tdss code replaces this.. Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435742 Share Posted June 2, 2011 Aha...good stuff.Thanks Link to post Share on other sites More sharing options...
Staff shadowwar Posted June 2, 2011 Staff ID:435744 Share Posted June 2, 2011 Thanks for reporting it! Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435748 Share Posted June 2, 2011 Sure thing Thank you for (as always) rapid replies The OP can't find the log, so far. Possibly deleted.If found, I'll make sure to post it back here. Link to post Share on other sites More sharing options...
Staff shadowwar Posted June 2, 2011 Staff ID:435752 Share Posted June 2, 2011 Thats ok. We have a pretty good handle on what happened now. Not necessary at this point. Thanks for all the info though. Link to post Share on other sites More sharing options...
Broni Posted June 2, 2011 Author ID:435753 Share Posted June 2, 2011 Cool beans Thanks again.... Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now