system
April 25, 2012, 3:35am
1
Hello,
I am of course new to the forum and am have been using Avast free fro my home computers for about 2 years. I have since recommended the program to friends and relatives. I am pleased with the program and believe that it is the best free virus protection program available. I have a friend that I am trying to help out with a possible issue. I don’t know whether it is false positive or whether it was an actual rootkit so I will need your assistance in helping me to help him. Here is my friend’s configuration and other pertinent information. Thanks in advance.
Lenovo laptop, Windows 7 Home Premium 64-bit, 4 GB Ram, 314 GB HD, with restore partition
I’m the family and friends tech guy and we market some refurbished equipment. However we very seldom do this type of work. We usually send the computers away for any problems.
Avast Alerts me of “dragor rootkit” on 042312. I’m pretty sure that it was called “dragor.” I was unable to save a picture of my desktop before the computer shut down.
However, my skill-set is not at an expert level so it is possible that it is before my in hijack this and i am missing it. I noticed that hijack this is not one of the requested scans that you guys use, is there a reason why?
I received the root-kit alert 15-30 minutes after installing Avast. Again thanks for any help you can give me.
Pondus
April 25, 2012, 4:19am
2
follow this guide, and attach ( not copy and paste) the logs form malwarebytes / OTL / aswMBRhttp://forum.avast.com/index.php?topic=53253.0
then one of the removal specialists will help you when they arrive
system
April 25, 2012, 6:56am
3
Much appreciated. Here are the logs that you requested. After running second scan–aswMBR–there was a file created on the desktop, MBR.dat. Did you need that file as well? In addition, I want to add that I do not see any degradation of my friend’s system. It seems to run as well as it did 3 months ago. Here is the Mbytes scan results:
Malwarebytes Anti-Malware 1.61.0.1400www.malwarebytes.org
Database version: v2012.04.22.05
Windows 7 Service Pack 1 x64 NTFS
4/25/2012 12:05:04 AM
Scan type: Quick scan
Memory Processes Detected: 0
Memory Modules Detected: 0
Registry Keys Detected: 0
Registry Values Detected: 0
Registry Data Items Detected: 0
Folders Detected: 0
Files Detected: 0
(end)
system
April 25, 2012, 7:04am
4
BTW, I’m on Central Standard Time. Just in case I don’t reply quickly.
system
April 25, 2012, 12:01pm
5
Central Standard Time as well here…
system
April 25, 2012, 6:26pm
6
Thanks jeffce,
BTW, I noticed that Windows Defender was on his machine. As far as I know, I didn’t put it on the machine and he stated that he did not or had anyone to put it on his computer. Maybe it comes loaded with 7. Maybe this is useless information but I do know that sometimes Microsoft security products do not play nice with others. I would only use their security products with their other security products except maybe a firewall.
Again very appreciative that you are taking a look.
system
April 25, 2012, 6:37pm
7
Hi,
Yes Windows Defender is just preinstalled now.
Please download TDSSKiller.zip
[*]Extract it to your desktopTDSSKiller.exe Change Parameters ”Additional options” , put a check mark in the box next to “Detect TDLFS File System” OK Start Scan
[*]Only if Malicious objects are found then ensure Cure is selectedContinue > Reboot now
[*]Copy and paste the log in your next reply
[*]A copy of the log will be saved automatically to the root of the drive (typically C:)
system
April 25, 2012, 11:24pm
8
Sorry, I had to put out a “fire” with my college. I will be back and forth until I’m sure that the embers are cool. I noticed when I booted his computer that there were two “desktop.ini” files on the desktop. This was not the case before we started running scans. There was also the dat file that I mentioned before. Any idea as to why they were created? Is it OK to delete them from the desktop?
Attachment is at the end of posts.
system
April 25, 2012, 11:30pm
9
18:09:09.0111 3344 TDSS rootkit removing tool 2.7.33.0 Apr 24 2012 18:43:43
system
April 25, 2012, 11:34pm
10
18:09:42.0149 3316 Appinfo - ok
system
April 25, 2012, 11:36pm
11
18:09:48.0139 3316 CryptSvc - ok
system
April 25, 2012, 11:37pm
12
18:09:53.0537 3316 HomeGroupProvider - ok
system
April 25, 2012, 11:38pm
13
18:09:59.0559 3316 MpsSvc - ok
system
April 25, 2012, 11:39pm
14
18:10:00.0448 3316 napagent - ok
system
April 25, 2012, 11:41pm
15
18:10:03.0833 3316 p2psvc - ok
system
April 25, 2012, 11:42pm
16
18:10:09.0137 3316 SessionEnv - ok
system
April 25, 2012, 11:43pm
17
18:10:18.0326 3316 UxSms - ok
system
April 25, 2012, 11:45pm
18
Here is the attachment as well.
system
April 26, 2012, 5:36pm
19
Hi,
Download Combofix from either of the links below, and save it to your desktop.Link 1 Link 2
Note: It is important that it is saved directly to your desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.C:\ComboFix.txt for further review.
system
April 26, 2012, 9:30pm
20
jeffce
I will have to do it tomorrow since I have to save it directly to his laptop. My only option here is to download it on my laptop and transfer it over since he doesn’t have a dial-up modem on his machine and I do not have a broadband connection. Talk to you tomorrow or later.
Let me look over the logs and I will return shortly.