Please help, got stuck with a Trojan and a rootkit

system · June 26, 2013, 2:49pm

Rubbing my eyes
Have you come to save me at last…

system · June 26, 2013, 2:51pm

Shall I run a " scan " or a " quick scan " ?

essexboy · June 26, 2013, 2:55pm

Sorry about that I had to do some actual work today

Press run scan and that should reveal anything that combofix missed

system · June 26, 2013, 3:14pm

It’s ok. I’m glad you came back anyway.
I’m running it at the moment, meanwhile I want to let you learn about a few things:
1- I checked " all users", " LOP", “Purity” for this scan i’m running now, just as the very first one I’d run.
2- I saw the black screen of the recovery console on reboot this time.
3- There seems to be a folder called Qoobox in my C:/ drive now, shall I look for any logs there?
4- There’s also a copy of " my computer" called “combofix” in C:/ drive
5- This time after the reboot a message came from the tray saying that I was insecure and I had my firewalls turned off, is it dangerous?

I know it’s a lot of things, but just wanted to make sure it’s ok.

essexboy · June 26, 2013, 3:18pm

Once done we will hide the recovery console until you need it (hopefully never)

Qoobox is where combfix quarantines the bad boys

We will check the firewall next, is it just the windows one ?

system · June 26, 2013, 3:30pm

yes, I think it’s the windows firewall, shall I have any others?

Here I attached the log from the OTL scan of today and you’ll find also the one after the running the fix yesterday together with that of the quick scan before running combofix.

essexboy · June 26, 2013, 3:35pm

Looks good, can you confirm that the avast alerts have ceased ?

Lets now look at the firewall

Download and run farbar service scanner

http://i1224.photobucket.com/albums/ee362/Essexboy3/Farbar/FSS-1.jpg

Tick “All” options.
Press “Scan”.
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

system · June 26, 2013, 3:40pm

Yes, they’ve ceased since the very first scan run by OTL yesterday, even along going online no alerts or pop-ups since then. ( previously I couldn’t get online without those alerts poping every couple of minutes that I disconnected the cable most of the time)

essexboy · June 26, 2013, 3:42pm

Good so it is now repair time

system · June 26, 2013, 4:00pm

Glad to hear it’s good. But for you, it wouldn’t have been so.
here’s farbar’s log…

I want to tell you that I’ve been having some difficulty since yesterday, after runing the OTL fix, making me unable to download anything, even a few megabytes, without being stopped at the 95% point exactly and getting a message in a window saying that whatsoever I was downloading couldn’t be downloaded because the operation timed out.
Yesterday I tried downloading Combofix about 6 or 7 times and getting to the same cut end. In the last time I went clicking continously on the download window at the 95% point and then it completed and I got the file at last.

Today, the same exact story happened with Farbar and was resolved in the same way.
I’m sorry for such a long story, but I want to know if it’s something to do with the either the infection or the fix.

essexboy · June 26, 2013, 5:19pm

OK we will need to run combofix one more time, this time it should run smoothly

Run combofix and allow it to update if it asks

The problems may be due to the shared access registry file being deleted by the malware, this time combofix should repair it

system · June 26, 2013, 6:34pm

It’s been running for more than 30 minutes now, but hadn’t stopped like before.
It’s scanning the machine while “-” is still blinking and the screen seems responsive.
I’m afraid it could freeze the same way as before if left to run to long, any advice ?

system · June 26, 2013, 7:09pm

Ok, here we go back to zero point.
Combofix has made everything freeze like it did yesterday.
It seems that you are offline, anyway I’ll wait for a couple of hours in case you replied.

essexboy · June 26, 2013, 7:55pm

OK reboot again and we will try a different fix

I will just create a registry fix for it

essexboy · June 26, 2013, 8:07pm

Here we go … The manual method

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000]
"Service"="SharedAccess"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000020
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Windows Firewall/Internet Connection Sharing (ICS)"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000\Control]
"ActiveService"="SharedAccess"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess]
"DependOnGroup"=hex(7):00,00
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch]
"Epoch"=dword:00000012

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001


:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

system · June 26, 2013, 8:15pm

Ok, I’ll begin immediately.
I beg you to stay online just for a while till we get through it all together.

essexboy · June 26, 2013, 8:18pm

Yep the wife has let me have the computer back

system · June 26, 2013, 9:04pm

here are both logs
I renamed the old OTL log so that it may not be overwritten, so this the most recent.

essexboy · June 26, 2013, 9:07pm

OK could you confirm the firewall is now working … Next how is the computer behaving what problems still remain

I will look at the latest log now whilst you let me know

system · June 26, 2013, 9:20pm

ok, first almost all the toolbars in IE went black before the fix. Now everything is normally back.
As for the firewalls, I can no longer see the red balloon in the tray, so most likely it’s working.
I may also mention that till the very moment, IE becomes unbearably sluggish the first time I run it after the reboot. Eventually it becomes “not responding” , I’d have to end the process manually and start all over again.
This has been the same for weeks, maybe months, and until now.

As for combofix, I doubt that it’d been corrupted during download because I don’t find a reason for the “freeze” it causes whenever run. Shall I redownload it? Is it crucial to use it with my infection? Could the computer ever get 100% clean once more without running it?

finally a big thank you

Please help, got stuck with a Trojan and a rootkit

Announcements