Hey guys…
I suspect I’ve got some kind of rootkit hidden away somewhere in my system, but I can’t be sure. Let’s go over this from the beginning, and I hope it makes sense.
Before we start, system details:
Windows 8.1
Running Avast! Pro antivirus (most recent version)
Now then…
I noticed something was rather amiss a couple of weeks back, when all of a sudden I was unable to access any of the following websites:
http://www.google.com/
http://www.google-analytics.com/
http://apis.google.com/
http://www.youtube.com/
http://www.wikipedia.org/
This was extremely odd, not least because my browser (Google Chrome) was perfectly well able to run a web search, I suspect, via http://www.google.com.au. As you can imagine, being unable to access Google Analytics and the apis server made a fair few websites look rather odd or become extremely slow to access.
A ping got absolutely nowhere with any of these websites (although it was still able to obtain an IP for them nonetheless), and a tracert would not even get to the first jump. However, any other server would work just fine. I only discovered wikipedia didn’t work when attempting to figure out what the hell was going on.
At the suggestion of a friend, I went hunting for some anti-rootkit tools. The results were… interesting, to say the least. Running Kaspersky’s TDSSKiller program with the option to scan objects currently loaded into memory found a “hidden service” that was unlisted everywhere. TDSSKiller listed it as a “medium risk”, but as far as I could tell it shouldn’t be there. I removed it. Now… it got weirder. Upon a reboot, as suggested by the program, it scanned again, and found another hidden service, apparently of the exact same type… except it had a different name. Six reboots later, it seemed to just keep going. It would alternate between two kinds of names – both 8-digit strings of numbers, either beginning with a “1” or a “6”. The most recent instance of this thing I got rid of was called “17946652.sys”.
Upon rebooting the first time, I was again able to access these websites, but as the tool kept finding these hidden services, I reasoned that it could simply come back at pretty much any opportunity. Using GMER, I determined that the only other apparent suspicious processes were those from Avast! itself. To be on the safe side, I downloaded Avast!'s uninstall tool, booted into Safe Mode and removed Avast! entirely. A quick scan with TDSSKiller confirmed that after one further reboot, the suspicious .sys file had not yet returned, and I was again able to access the previously unresponsive websites. Problem solved, right? Nope.
Now, a week after that last sequence of events, the symptoms began anew – once again, I had trouble accessing the above listed websites. And again, it did not appear to affect any other websites, and I have confirmed both with other people and online tools that the websites are not actually down. A further scan with TDSSKiller found the most recent instance of the suspicious .sys file (which has been removed). A noticed oddity is that removing this file appears to result in a Code 19 error for my Blu-Ray disc drive. If it is a rootkit, which I am still a little uncertain of, it appears it might have infected the drivers or firmware of my disc drive.
That’s all I know. Any ideas? This just gets weirder and weirder. I suspect the rootkit was already present prior to upgrading to Windows 8, which was shortly before noticing something seemed to be amiss.
EDIT: A brief registry fix for the disc drive appears to have fixed the disc drive temporarily (at least the error is no longer showing). As far as I can tell, it seems to be all okay, but this situation is so decidedly odd I think it best to check things over at least six times.
