1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Infected - Any ideas?

Discussion in 'Malware and Virus Removal Archive' started by omrsafetyo, 2011/10/03.

Page 1 of 3
  1. 2011/10/03
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    [Resolved] Infected - Any ideas?

    I have a particularly nasty issue.
    OS: XP SP3

    First-off, I have read this: http://www.windowsbbs.com/malware-virus-removal/announcements.html

    Unfortunately, the nasty little bug I have seems to prevent this from getting any useful information.

    I installed MBAM before coming across this forum, restarted in safe mode and ran a scan (if I tried to run it without first going into safe mode, the virus kills the process, and then modifies the executable and prevents me from using it - I needed to re-install after getting into safe mode).

    The virus behaves in a similar manner for any tool that seems to stumble across its handle information.
    Examples:
    process explorer (sysinternals)
    HiJackThis

    As soon as the program initializes, the virus catches it, kills the process and then somehow modifies the exe to prevent execution. I checked the files for e.g. read-only attributes, or modified ACLs that would prevent execution, but cannot find out why the execution is prevented. I can't even delete the files through the windows explorer at that point - I need a 3rd party tool such as Unlocker, or alternatively I found I can use the del command from cmd.exe

    It produces the following error message: Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item. The usual rename methodology does not work.

    Other behavior I have noticed for this virus:
    System Restore has been disabled. I ran this once to try to restore to before I noticed any symptoms, but now I cannot start the system restore service (Error 5: Access is Denied) I checked all registry settings and etc. in regard to system restore and I see no reason for it to be disabled, but have a feeling it is the same exact issue that plagues procexp.exe and etc. after trying to run it.
    All desktop icons hidden hidden attribute set, easily fixed
    Most everything else also hidden C:\program files, C:\windows, etc. etc. The Programs menu under start menu is set to hidden for all users, and "All Users ". It seems to me the actual links under "All Users" are actually removed.
    Website redirection I can search google, but trying to navigate to the page brings me elsewhere. (noticed that there is no proxy configured, so it is doing this through some other means)
    Card Reader software trying to read card Although I have no card inserted, it is trying to activate the software to read the card, I'm guessing so it can steal my card pin and other info


    As I said, I tried the process from the "Read First ", but unfortunately, I'm guessing this is meant to be run not from safe mode. Results:

    MBAM: It did remove several viruses/trojans, including:
    Backdoor.Bot
    Exploit.Drop.2
    Trojan.Downloader
    Rogue.OpenCloudSecurity
    Malware.Trace
    Trojan.ZbotR.Gen

    These were all removed.
    I restarted, expecting my woes were over (again, this was prior to coming across this site). Some of the problems persisted. It seems the very obvious Open Cloud Security symptoms have disappeared, however, the Exploit.Drop.2 keeps coming back (if I go back to safe mode and re-scan with MBAM).

    I have also ran ESET NOD32 (found nothing really) - and unfortunately the virus killed McAfee on me, which I don't have the install CD for (not sure when this got installed, honestly, either my company pushed it out, or it came as a software add-on somewhere, which seems unlikely but possible)

    Downloaded SuperAnti-Spyware and that only found cookies, nothing related to my issues.

    The persisting issue seems to be related to a process called 962772537:3326188998 (I can find no info on this online). I searched the registry for this file and found two entries under HKLM\SYSTEM\ControlSet002\Services\39be6239
    And the corresponding location ControlSet004. There was a key under this that pointed at the binary systemroot\962772537:3326188998.exe

    I tried to submit this to MBAM, but in doing so found that the binary file had 0 byte size, so none of the analyzers will pick it up - however, even after deleting both reg keys and the exe, they seem to all keep coming back, consistently in the same spot.

    I am unable to install STOPzilla at all on the machine, in safe mode or not, the installation is blocked.

    Next I stumbled across this site.
    Re-ran MBAM, which removed more Exploit.Drop.2 files.

    GMER doesn't find much from safe mode (will attach the logs from the infected PC in another post, currently running from my Linux PC).
    aswMBR also doesn't find much in safe mode (will attach logs)
    dds never completed (safe mode)

    Logged on not in safe mode, and ran GMER - the execution was prevented and the exe disabled.
    Ran aswMBR - this made it a ways in, and I could clearly see that some items were detected that were not detected when run in safe mode - but as soon as these items were picked up, the execution was halted, and the exe rendered unusable.
    dds had the same results.

    I re-downloaded aswMBR in safe mode and ran FixMBR (because, why not? - after all, I have linux live CDs laying around, worse comes to worse, I'm going to safe what files I need and nuke the HDD anyway)
    Re-ran Quick Scan (no reboot).. log file will be attached in the next post (found much more infections)

    Installing Avast AV now to see if it is more successful.
     
    omrsafetyo,
    #1
  2. 2011/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    Please, complete all steps listed HERE
    Complete as many steps as you can.
    If safe mode has to be used, do so.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
    broni,
    #2


  3. to hide this advert.

  4. 2011/10/03
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    Hi Broni, thank you.

    Here are my logs:
    Original MBAM:
     
    omrsafetyo,
    #3
  5. 2011/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please do nothing but only what I tell you.
    We have a very severe infection there.
    Hold on....
     
    broni,
    #4
  6. 2011/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
    broni,
    #5
  7. 2011/10/03
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    Thank you broni! I think we are getting somewhere!

    I did vary from your guidance ever-so-slightly. While waiting, I manually deleted 3 registry keys:
    HKLM\SYSTEM\ControlSet001\Services\39be6239
    HKLM\SYSTEM\ControlSet002\Services\39be6239
    HKLM\SYSTEM\ControlSet004\Services\39be6239

    I then deleted the offending file %systemroot%\962772537:3326188998.exe . I then re-created the file, and set it as read-only. I then rebooted.

    When Windows started back up, I verified that the persistent process did not come back. I then verified that I could run MBAM and process explorer without having them get killed by the virus. I then followed your instructions and received the following:

    Thank you for your help, I think the process itself has been removed. Please guide me on how to verify the computer is now clean - I can now run AV software from Windows without trouble.
     
    omrsafetyo,
    #6
  8. 2011/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please don't make any moves by yourself.

    Post new aswMBR log.
     
    broni,
    #7
  9. 2011/10/03
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    Thank you, I hadn't run any other scans on my own, just verified that they would open without issue.

     
    omrsafetyo,
    #8
  10. 2011/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #9
  11. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    ComboFix appears to have only locked the system up. Nearly 7 hours later it is sill running.
    It did: install the recovery console.

    After this completed, I did not click on the window it runs in, but it appears to have locked the system up - the clock still indicates the time at which I started the program.

    Re-ran with rkill, same behavior.
    Re-ran in Safe mode, same behavior.
    Re-ran in Safe mode with rkill, same behavior.

    Rkill log:
    For reference, when ComboFix freezes I am unable to do anything - can't open taskkiller, etc. My only option for abort is hard reboot.
     
    Last edited: 2011/10/04
    omrsafetyo,
    #10
  12. 2011/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run TDSSKiller one more time.
     
    broni,
    #11
  13. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    No threats found.
     
    omrsafetyo,
    #12
  14. 2011/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK, post new aswMBR log.

    How is computer doing anyway?
     
    broni,
    #13
  15. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    After running a google search, clicking on links brings me to the wrong location (www.google.com/go) - no other behavior indicates there is still an infection.

    Running aswMBR now, will post log when finished.
     
    omrsafetyo,
    #14
  16. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-10-04 20:40:13
    -----------------------------
    20:40:13.656 OS Version: Windows 5.1.2600 Service Pack 3
    20:40:13.656 Number of processors: 2 586 0xF0D
    20:40:13.656 ComputerName: NKULAS UserName:
    20:40:16.531 Initialize success
    20:40:26.109 AVAST engine defs: 11100401
    20:40:28.718 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
    20:40:28.718 Disk 0 Vendor: TOSHIBA_MK6037GSX DL340D Size: 57231MB BusType: 3
    20:40:30.781 Disk 0 MBR read successfully
    20:40:30.781 Disk 0 MBR scan
    20:40:30.812 Disk 0 Windows XP default MBR code
    20:40:30.812 Disk 0 scanning sectors +117210240
    20:40:30.875 Disk 0 scanning C:\WINDOWS\system32\drivers
    20:40:43.625 Service scanning
    20:40:46.609 Modules scanning
    20:40:55.031 Disk 0 trace - called modules:
    20:40:55.046 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
    20:40:55.046 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a878ab8]
    20:40:55.062 3 CLASSPNP.SYS[ba138fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x8a982940]
    20:40:55.453 AVAST engine scan C:\WINDOWS
    20:40:58.953 AVAST engine scan C:\WINDOWS\system32
    20:42:53.375 AVAST engine scan C:\WINDOWS\system32\drivers
    20:43:08.015 AVAST engine scan C:\Documents and Settings\nathan.kulas
    20:46:08.015 AVAST engine scan C:\Documents and Settings\All Users
    20:46:08.015 Scan finished successfully
    20:47:25.703 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\nathan.kulas\Desktop\MBR.dat "
    20:47:25.718 The log file has been saved successfully to "C:\Documents and Settings\nathan.kulas\Desktop\aswMBR.txt "
     
    omrsafetyo,
    #15
  17. 2011/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Looks good.

    Delete your Combofix file, download fresh one.
    Try to run it again.
    If still no go...
    MAKE SURE COMBOFIX FILE IS ON YOUR DESKTOP.

    Then...
    Go Start>Run and type paste this:
    "%userprofile%\desktop\ComboFix.exe" /KillAll

    If still a problem, try this command:
    "%userprofile%\desktop\ComboFix.exe" /nombr
     
    broni,
    #16
  18. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    I am experiencing some difficulties, example: windows cannot find 'nircmd'

    It appears to be that (possibly) one of my AV programs was still running in processes in the background (there were none in the system tray) and was deleting these files when ComboFix tried to access them.

    I uninstalled all AV software. I tried uninstalling combofix with combofix /uninstall, but this didn't work, same error messages.

    I extracted combofix with uniextract and found the missing binaries, and copied them into C:\WINDOWS. rebooting.

    Note: That worked, I am no longer receiving error messages. Letting ComboFix run.
     
    Last edited: 2011/10/04
    omrsafetyo,
    #17
  19. 2011/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Don't uninstall Combofix as it clears restore points.
    As I said, just delete the file and download new one.
     
    broni,
    #18
  20. 2011/10/04
    omrsafetyo

    omrsafetyo Inactive Thread Starter

    Joined:
    2011/10/03
    Messages:
    23
    Likes Received:
    0
    Thank you, I re-downloaded the binary and after removing all other AV from the PC it is now running.
     
    omrsafetyo,
    #19
  21. 2011/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Cool :)
     
    broni,
    #20
Page 1 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...