Annoying Rootkit

Willlb

Hello. :rolleyes:

I've an annoying rootkit and almost tried everything but no use.

It create the two "RECYCLER" and "System Volume Information" folders even after force removing them using "Unlocker".

There are folders called:

C:\RECYCLER\S-1-5-21-823518204-854245398-1801674531-1003

Files called:

Dc1

Dc2.ini

desktop.ini

INFO2

those were inside that folder, in "RECYCLER".

I opened the folder "System Volume Information" by changing the security settings and found:

Folders:

_restore{11B876CE-2020-48E1-BE34-06069ABC531B}

_restore{7204C611-CD45-4BDF-859C-F1D7C1D3C4C2}

Files:

MountPointManagerRemoteDatabase

tracking.log <--- It's inside svchost.exe

EXEs outside "System Volume Information" And "RECYCLER":

aadrive32.exe (In Windows folder). (Trojan.FakeAlert).

41.exe (In System32 folder). (Backdoor.IRCbot).

ecleaner.exe (Forgot where it is or what it's type) Removed.

-----------------------------

It seems like the rootkit is inside the registry as well. But can't remove the key(s). It shows an error when I do.

It disables the autoscan in Bitdefender sometimes.

I've tried to reinstall a fresh copy of Windows. But it didn't help.

Removing the stuff in safe mode makes them even more.

I've tried bitdefender-tdss-tdl4-removaltool-x32.exe, but it says: "Initialization Error".

I've tried ZeroAccessRemovalTool_32b.exe

I've tried a lot of programs which remove the rootkits but I don't think I can name them.

I've attached "ntbtlog.txt".

"bdsyslog.zip" is in here: http://www.4shared.com/file/POaKNqA7/bdsyslog.html

I've Bitdefender Internet Security 2012

My OS: Windows XP SP3

My Computer specs if needed:

Intel® Core i3-2100 CPU @ 3.10GHz

4GB of RAM

Would you please help me get rid of it? I'm ready if you need to know anything else.

Thanks.

William

/applications/core/interface/file/attachment.php?id=8758" data-fileid="8758" rel="">ntbtlog.txt

Find more posts tagged with

Comments

rootkit

Hello and welcome to our forums

If you have Bitdefender 2012 installed, please run a system scan in Rescue Mode.

http://www.bdantivirus.com/bitdefender/tot...ion.rescue.html

Thank you.

Willlb

Thanks a lot for being nice.

I'll try that. Thanks for your reply.

Willlb

I've tried it but it freezes in a moment of running it. ( I left it freezing for like 3 hours hoping that it might resume, but nothing changes ).

Now when I restarted Windows, the On-Access Scanning feature in Bitdefender is disabled. Can't enable it (Can't fix the issue).

I noticed a new thing happens sometimes. The rootkit (sometimes) changes the folder settings. Like, don't show hidden and system files, when I try to change it back, I've to restart the whole Windows.

Would you please help me again?

Thanks.

rootkit

Hello

I have send all the data to our antimalware lab.

I will get back to you ASAP.

Thank you.

Willlb

Thanks a lot. Much appreciated

rootkit

Hi Will

In order to be able to further investigate the reported situation we need a log generated by the GMER application and some samples.

[how to GENERATE A GMER LOG]

. Save the GMER tool (and then extract it if needed) to a location of your choice:

alternative: http://www.bitdefender.com/files/KnowledgeBase/file/gmr.exe

. Make sure you close all active applications and then run the tool;

. Allow the tool a few moments to load up and perform the initial scan;

. Click on the "Scan" button from the lower right side of the window; You will notice that the button will change to "Stop" indicating that the tool is creating the report;

. When the scanning process is over the button will change back to "Scan";

. Click on the "Save..." button and save the log to a location of your choice, naming it "gmerlog";

. Attach the "gmerlog.log" file to the reply to this post.

[How to take samples with GMER]

. Disable the Bitdefender real-time protection and/or any other active security solution(s) that you are using;

. Save the GMER tool (and then extract it if needed) to a location of your choice:

alternative: http://www.bitdefender.com/files/KnowledgeBase/file/gmr.exe

. Make sure you close all active applications and then run the tool;

. Allow the tool a few moments to load up ;

. In the upper left of the GMER window, you will see the tab "Rootkit/Malware" and ">>>"; Please click on ">>>"; Next click on the tab "Files";

. Use the tree list on the left to browse and the list on the right to locate the following file(s):

f:\windows\system32\xfcodec.dll

f:\windows\system32\drivers\regguard.sys

. Once you located the file select it with one click (in the list on the right), then press the button "Copy"; A new window will open allowing you to choose the location for the copy of the file to be saved (please choose a convenient location); Enter the file name, and then select "Save";

. Close the tool once this operation is completed;

. Compress the files using a common archiver of your choice (e.g.: WinZip, WinRAR, WinAce etc.); Protect the archive with the password "infected" (or another password of your choice);

. Attach the archive to a reply to this message and make sure to enclose the password in the message body.

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2012]

In order to disable the antivirus protection,please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield"tab and click on "Turn off" under On-access scanning.Select the time interval that suites your troubleshooting needs and click "OK" . The On-access scanning should be enabled back after finishing the troubleshooting procedure.

We will contact you once the analysis is complete. Thank you.

Willlb

Hello again

Thanks for your reply.

I've closed and killed the processes of all security programs I've, but about Bitdefender:

When I go to settings ( In Bitdefender's main window ) then "Antivirus", I click "Off". But when I come back to it right away, it goes "On" (checked on "Custom"). Seems like the rootkit is doing that.

Anyways, the icon of Bitdefender that in the Taskbar has turned to black, so I started GMER.

I've attached the log file. I've just scanned my "F" Part of my HDD. Because when I tried to scan all of my HDD, GMER has stopped working. (Error).

The Part "F" is where my Windows installed.

Don't mind the results about the program "BitComet" Because I've forgot it open.

I've uploaded the files (Samples) with the same password: "infected". Using WinRAR. I didn't attach them because I couldn't.

Here is the link:

http://www.4shared.com/file/2isQ6L2p/Samples.html

Other four things:

1. I've attached a PNG Image, please check it. A fake account has the same name of the folder inside the "RECYCLER" folder. With security rights. I could not complete the scan in GMER without removing that fake user. The fake user exists with all other programs and files.

2. I can't use Unlocker anymore.

3. About the file "F:\Documents and Settings\Will\Application Data\Zpaead.exe" that inside the log file. I've removed it before, twice.

4. When I enabled Bitdefender again, it detected a malicious process right away!

Here: "F:\WINDOWS\ndghd.exe" And it's blocked now.

Thanks a lot. Appreciated!!

/applications/core/interface/file/attachment.php?id=8781" data-fileid="8781" rel="">gmerlog.log

gmerlog.log

Willlb

Sorry for double posting, but I should send you a Private Message with something important. Check your Forums Inbox please.

rootkit

Welcome back Will.

All the information was sent to our labs.

Until then, use that software to remove those infections and send me the scan log via PM.

I will get back to you soon. Thank you.

Willlb

Thanks a lot.

I will.

rootkit

Welcome back Will

Could you please search for this file?

F:\Documents and Settings\Will\Application Data\Zpaead.exe

And also the ones that are detected as Kido(from the screenshots). Pack them like the other ones and send me the archive via PM.

After this, please run:

http://forum.bitdefender.com/index.php?showtopic=12389

This should clean Kido/Conficker.

Thank you.

Willlb

Hello

I don't think that I've them now.

But I will always ave such files. I'll send them in a moment.

Thanks a lot!

Willlb

Hello, would you please teach me how to edit my posts. Because it's annoying to have double posts

I've tried that Program. It didn't detect anything. Because, I've cleaned "Kido" already by the program shown on that screenshot.

Thanks

rootkit

Hello

I am waiting for an answer regard those last sample. I will get back to you ASAP.

Thank you.

Willlb

Hello

Take your time

Thanks a lot.

rootkit

Welcome back

Thank you very much for your cooperation.

The results will be posted here really soon.

Now please tell, Bitdefender is active on that system? Can you run a scan with it?

Thank you.

rootkit

Hello

I'm back with the results:

157.tmp, 45.exe and ndghd.exe are infected and detected by Bitdefender

50.exe is damaged.

bddel.exe, etdrv.sys, tsnpstd3.exe, unvise32.exe, vsnpstd3.exe and zip.exe are clean and currently not detected by our product.

Please answer to those question so I can assist you further

Thank you.

Willlb

Hello

Yes Bitdefender can detect them.

But the most annoying thing is when I remove the two folders "System Volume Information" And "RECYCLER", the System creates them again.

Tried to remove the files inside them, but no use. The System creates even more.

vsnpstd3.exe and snpstd3.exe are for my WebCam.

Thanks a lot!

rootkit

Hi Will

Please turn off System Restore

http://support.microsoft.com/kb/310405

and run a Full System Scan task with Bitdefender. Send me via PM the resulting scan report.

[how to GENERATE A FULL SYSTEM SCAN LOG]

- Before running the scan please make sure that you have the latest virus definitions downloaded via the Update module.

For this you need to open Bitdefender and from the main interface click on Update now;

- After the update process has completed successfully you can proceed to

running the scan task.

In the same window go to Antivirus and press the Scan now button =>Full system scan.

- After the scan has finished you need to submit the scan log file.

This is accomplished by running the Support tool file that can be

downloaded from this location:

http://www.bitdefender.com/files/Knowledge...or_scanlogs.exe

Save the file prior to running it and to continue you need to accept the terms of use.

At the end of this process an archive will be created on your Desktop starting with bdamst.

. Send me that file via PM.

Willlb

Hello

I'm sorry for being late. I reinstalled Windows and took some time with that. But the rootkit is still there anyways.

The Windows I had, when I turn off it's system restore, the rootkit turns it on.

I'll try with this new OS. I'll let you know if anything happened.

Thanks a lot!

rootkit

Welcome back Will

Please tell me, did you install the new operating system without an active network connection? Most of the time, customers do this and their machines are infected before installing our product.

We are looking to hearing from you. Have a nice day.

Willlb

Hello, sorry for being late.

Without Network, I guess. I'll reinstall Bitdefender anyways after cleaning the registry errors and stuff, then I'll do what you told me to do. Again, sorry for being away, had to.

Willlb

WOW! It found 12 threats so far! And it's still nothing.

I'll PM you when it's done.

Thanks a lot.

Willlb

@ jeriGregiap :huh:

rootkit

Hi Will

Please ignore that user, just another spammer.

Now, let back to your machine.

Please browse to these locations:

C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs

C:\Users\[uSER]\AppData\Roaming\Bitdefender\Desktop\Profiles\Logs

* USER = the current user from Windows, the one that you are using right now.

You will see there some folders with random names.

Archive them all and send me a PM with the 2 archives. The last scan log was clean, is not the one that was generated with all those infections.

In the current case, I need all the logs so I can analyze them.

Thank you.

Willlb

Thanks for the fast reply, as always. Much appreciated.

I was making a full system scan minute ago.

I'll just let it complete then send you all of them, because I've made some changes and removed some files from the HDD so you can read the log and check it easier. like "cvvvvv.rar". It spams the result log because it's password protected.

I'll send them all once I'm done with the last scan. I'll separate the last scan log from the others.

Thanks a lot.

rootkit

Welcome back Will

I will get back to you here after the analysis.

Thank you.

Willlb

Thanks!

I'll PM the logs to you in 5 minutes.

rootkit

Hello

I will try to post the results today. If not, tomorrow you will find them here.

Thank you.

Willlb

It's so ok. Please take your time.

Thanks

Willlb

New issues:

1. An error appears about svchost.exe (AcGenral.dll).

2. All USB devices such as mouse, cam, keyboard etc... freeze out of sudden. Like I unplugged them. And when I unplug then plug any of them again, the whole Windows freeze, so I've to restart.

3. I've found like 8 EXEs inside System32. Bitdefender couldn't find any threats inside them. Their names are like 44.exe 38.exe and such.

Things I'm focusing in:

1. How to remove the System Volume Information and RECYCLER folders permanently. I've used Unlocker, changed the security settings so I can remove and get into the folder "System Volume Information", and it worked. But I find it again. I disabled System Restore but no use. The RECYCLER folder is not just inside the system disk part "C". It's in all parts.

2. How to remove the registry values of the fake user takes full control of my system. You've the screenshot showing it's name.

3. How to remove the fake user's name from the security permissions.

rootkit

Hi Will

Thank you for your feedback.

Before giving you the final results(the situation could change because of these files), I need to analyze those files from the screenshots(they look suspicious).

Please pack all those files in archive and send me a PM with the archive.

I will send them to our lab and get back to you soon.

Willlb

Thanks a lot.

I'm working on it.

rootkit

All the files are not at the lab. Thank you.

rootkit

Hi Will

The files 13_exe, 52_exe and 88_exe are truncated and do not run.

The files 32_exe, 35_exe, 37_exe, 63_exe, 82_exe are have their headers damaged, and after my colleague fixed the file header, they are all detected as Trojan.Generic.7018818.

The file netsh85_ex_ is infected, and will be detected as Trojan.Agent.ATGF in a few updates.

netsh_exe is clean and system_volume_information_rar does not contain any malicious files.

All other files are clean.

Now: please delete all these files from your system(the ones named from 2 numbers with .exe extension from system32 and netsh85_ex_). After this, rerun a full scan and send me back via PM the scan logs( you have the instructions here: http://forum.bitdefender.com/index.php?sho...st&p=129808 )

Thank you.

Willlb

Will do it.

Thanks a lot!

rootkit

Hi Will

That last log is clean.

Do you still encounter any issues on the system?

Thank you.

Willlb

Hello

I don't think so. But I can do nothing about the fake account making the "RECYCLER" and "System Volume Information" folders inside all of my HDD parts. Used almost everything to remove them, even after I remove them, the rootkit generates them again with some files inside. After some searches in the net, I got sure that this is a rootkit. I've opened some files with notepad and found the fake user's name in there. With the names RECYCLER and System Volume Information. The files tracking.log get into the system. And so with some other files. (I disabled the system restore by the way).

The fake user's name is: S-1-5-21-1993962763-1801674531-682003330-1003. And it's in the registry also. I can't remove it due to an error.

The System sometimes freeze.

Thanks a lot.

Willlb

Some Cookies get deleted, but after a while, here we go again:

Cookie:will@tribalfusion.com/ - Deleted

Cookie:will@stats2.clicktracks.com/ - Deleted

Cookie:will@rubiconproject.com/ - Deleted

Cookie:will@ru4.com/ - Deleted

Cookie:will@quantserve.com/ - Deleted

Cookie:will@pixel.rubiconproject.com/ - Deleted

Cookie:will@ad.yieldmanager.com/ - Deleted

Cookie:will@tap2-cdn.rubiconproject.com/ - Deleted

rootkit

Hi Will

RECYCLER and System Volume Information are valid directories from Windows. The first one handles the Recycle Bin and the second one is related to System Restore.

These folders have system privileges(higher that an administrator account).

Please go to Control Panel -> User Accounts and check if that "fake" account is listed there. Also, please tell me if anyone besides you is using your PC.

Note: any private information can be sent via PM.

Regarding those cookies, the action is normal. Those are tracking cookies and our product removes them.

Thank you.

Willlb

Sorry for multi-posting.

One more thing, I can not empty my recycle bin.

When I try to empty it, a message box appears with "access denied".

I've tried "Unlocker" to delete them but they get more.

They're folders. Same folders as those I've uploaded for you. The file: "System Volume Information.rar".

The folders' name start with: "Dd" or "Df" ....

Willlb

I went before to "User Accounts". It's not there.

The folder RECYCLER and System Volume Information are system folders, I know that.

But they're system folders when they're just inside the system disk part. Not all parts.

Not when some people have the same problem I've.

The computer is for me alone. Just one user.

A computer for a friend of mine, with the same system and everything. It doesn't has those two folders.

Note: I disabled the system restore too....

Thanks

Edit:

Does the System Volume Information folder has desktop.ini inside it?

Not just that... A lot of other files.

Some people told me that I can remove it by disabling the System restore. I did but no use.

Did you try to open the files I've sent to you with notepad? And figure how those files try to generate the same files when I remove them?

I always format people's system and so. I've never found such problem.

rootkit

Welcome back Will.

Thank you for post.

Let do this:

Reboot your machine in Safe Mode. Try to delete those files again an empty the Recycle bin.

After this reboot your machine in Normal Mode.

In order to be able to further investigate the reported situation we need a log generated by the HijackThis application.

[how to GENERATE A HIJACKTHIS LOG]

. Make sure you close all active applications and run "HijackThis.exe";

. If you are presented with the "New users quickstart" select "None of the above, just start the program";

. Do a system scan only ; The tool will scan the computer and list the results in the main window;

. When "Save log" appears instead of "Scan" then the report is complete;. Click on the "Save log" button and save the log to a location of your choice, naming it "hijackthis.log";

. Attach the "hijackthis.log" and send me a PM with it.

We will contact you once the analysis is complete. Take care.