Last week my laptop got infected through Java vulnerability and and got a couple of Java downloader viruses. I was able to disinfect the laptop using Avast and SDFix but there is one nasty bugger that lies somewhere in explorer.exe modules and none of the scanners I’ve tried (Avast, F-Secure, BitDefender, MalwareBytes) is able to recognise it.
Only symptom is http network connections to hosts noname.inferno.name and random servers in servernap.net. Procmon shows, that the connecting process is explorer.exe and list of explorer modules is attached. It is not started if I change the login shell from explorer.exe to cmd.exe. I can’t find anything like this using Google and I’m pretty sure this is either malicious bot or most likely some adware gone bad (the visible part of the program has been cleaned but the back-office is still running).
I installed good ole ZoneAlarm to block communication, but is there any way to clean it properly?
Follow the directions for obtaining the OTS log. Post the OTS log as an attachment (Additional Options > Attach > Post).
I am going to refer you to our Certified Malware expert, named Essexboy. He will also review your log and give you further instructions, however he comes on the forum late UK time. He will respond to you in this thread, so remember to check this thread daily.
Please do not make any further changes to your machine after you have provided the log.
IMPORTANT: If you are on a home network, disconnect the affected machine from the network. Do not share a USB/flash drive with this affected machine. Do not use this machine unless Essexboy instructs you do to malware removal instructions; use a different machine to check email, sync your phone, etc. if possible.
Let me know if you have any questions. Thank you.
Edit: Essexboy has been notified and will await OP’s log.
Yes, just tried a scan with it, the save as window produces Unicode, whereas a normal notepad window gives ASCI…I guess that is a question for essexboy
The log is readable now.
He should be able to look at the log when he is online.
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here
I will review the information when it comes back in.
Yup, nothing’s changed. ZoneAlarm firewall is blocking them and I’m not too worried since I believe the resident part is not harmful as long as it can’t access network to download any new programs or be part of bot network.
I have WireShark log of the connections and the destinations include hosts in servernap.net, hostnoc.net, advancedhosters.com and level3.net. Now I’m pretty sure my machine would be part of bot network without firewall. This is very subtle Trojan, apart from the network traffic it does not give any signs of its presence and it is not detected by any of the scanners I’ve tried. I’m not even sure if this was result of last weeks infection, it may have been there already undetected.
Edit: Here’s a list of IP addresses it tries to connect initially: 69.65.49.114,69.65.49.122, 69.65.63.122, 95.211.22.217, 209.212.157.208. If it manages to connect those hosts then more connections are made to number of hosts.
Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop
Now an analysis scan
Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then upload to Mediafire and post the sharing link.
The file is located at C:\Users[i]your name[/i]\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip
Could you re-run AVP and kill this Untreated: MEM:Rootkit.Win32.Sst.a
Also is putty running with your agreement (Telnet client)
File Scanner
There are some files I need you to upload for checking
[]Make sure to use Internet Explorer for this
[]Please go to VirSCAN.org FREE on-line scan service
[*]Copy and paste the following file path into the “Suspicious files to scan” box on the top of the page:
[*]C:\WINDOWS\gmchReg.sys
[*]Click on the Upload button
[*]If a pop-up appears saying the file has been scanned already, please select the ReScan button.
[*]Once the Scan is completed, click on the “Copy to Clipboard” button. This will copy the link of the report into the Clipboard.
[*]Paste the contents of the Clipboard in your next reply.
Putty was running on purpose, no worries. AVP was not able to disinfect this virus. It’s probably just generic message program has detected memory SST not matching the initial SST from ntoskernel.exe. However it doesn’t know who modified it and how to fix it. Found this interesting article http://www.articlesbase.com/security-articles/simple-antirootkit-2003035.html about SST rootkits, unfortunately the sources and executable of this AntiRootkit-tool were missing.
Nothing in this file either:
VirSCAN.org Scanned Report :
Scanned time : 2011/04/14 21:18:56 (EEST)
Scanner results: Scanners did not find malware!
File Name : gmchReg.sys
File Size : 16896 byte
File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit
MD5 : 45ca6300263c8677edbf642bdf37a598
SHA1 : a6d74481902c3e748c04553f083abfe8bffedcb7
Online report : http://virscan.org/report/3d06611a993d0ddc31942d7adf7a615e.html
Download GMER from Here. Note the file’s name and save it to your root folder, such as C:.
[*]Disconnect from the Internet and close all running programs.
[*]Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
[*]Click on this link to see a list of programs that should be disabled.
[*]Double-click on the downloaded file to start the program. (If running Vista, right click on it and select “Run as an Administrator”)
[*]Allow the driver to load if asked.
[*]You may be prompted to scan immediately if it detects rootkit activity.
[*]If you are prompted to scan your system click “No”, save the log and post back the results.
[*]If not prompted, click the “Rootkit/Malware” tab.
[*]On the right-side, all items to be scanned should be checked by default except for “Show All”. Leave that box unchecked.
[*]Select all drives that are connected to your system to be scanned.
[*]Click the Scan button to begin. (Please be patient as it can take some time to complete)
[*]When the scan is finished, click Save to save the scan results to your Desktop.
[*]Save the file as Results.log and copy/paste the contents in your next reply.
[*]Exit the program and re-enable all active protection when done.
Too late, I think it’s gone now. Unfortunately infected file was lost in the process. Running the AVP scan again after it logged failure of removing the reported SST.A it found this:
14.4.2011 22:09:34 Detected: Virus.Win32.TDSS.e C:\WINDOWS\system32\drivers\volsnap.sys
14.4.2011 22:10:35 Will be deleted on system restart: Virus.Win32.TDSS.e C:\WINDOWS\system32\drivers\volsnap.sys
It recommended deleting this file. I answered “Yes” and as expected the boot halted with blue screen. I booted from live Linux CD and copied clean copy of volsnap.sys and after reboot the computer seems to be clean. AVP check is clear and no extra Internet connections are detected.
Thank you so much for the effort. I’m sorry that the file was lost but I was so sure it was just false positive that I didn’t save a copy.
