packed.generic.200 virus detected by startup norton 2009 scanner - cant locate the source of the infection

Can you please attach the Combofix log here.. if it shows there we can remove it using its script function. The CF log lists files created in the last 30 days and it has Gmer's Catchme embedded to show hidden files.

The log is --> C:\Combofix.txt

The detected files were apparently deleted. I have submitted what the Norton scanner says is the detected file via the Symantic on-line file submission system however as I do not know the location of the file I cannot access it for upload indirectly.

I will run CCleaner and and do the update as recommended and run another safe mode full scan though the system reports all Norton updates have already been applied.

I will also run GMER as recommended and upload the log file.

Thanks for you ongoing assistance.

Logs as requested.

Did a partial scan with GMER. Found entries in HKLM Current Control Set 3 Services pointing to UACd.sys. Reapplied permissions and deleted key tho findings are recorded in log posted. Ran a full scan after that but too late at night to wait for it to complete. Will post the full GMER scan log in the a.m.

Thanks guys and gals.

Also, disabled system restore and restarted system. Still coming up with original risk (as reported initially).

UACd.sys is a rootkit, I need the full log because as I know there are other malicious module files used by this one.

---- Registry - GMER 1.0.15 ----
 
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start                                           1
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type                                            1
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath                                       \systemroot\system32\drivers\UACobwexumxfjwcdjb.sys
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group                                           file system
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules                                         
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd                                    \\?\globalroot\systemroot\system32\drivers\UACobwexumxfjwcdjb.sys
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc                                    \\?\globalroot\systemroot\system32\UACnevpabrnsfoawrk.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr                                   \\?\globalroot\systemroot\system32\UACgeyqnwylvrbfxlp.dat
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog                                  \\?\globalroot\systemroot\system32\UACgbudboeuypbtuok.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask                                 \\?\globalroot\systemroot\system32\UACchlivppkskkolwm.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacserf                                 \\?\globalroot\systemroot\system32\UACkllxecmrxdksnbx.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr                                  \\?\globalroot\systemroot\system32\UACvddwrtxxphunriq.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc                                 \\?\globalroot\systemroot\system32\UACgtylmwwoskqrbmy.log
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls                                 \\?\globalroot\systemroot\system32\UACeemucgqmvukqfxn.log
Reg             HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors                               \\?\globalroot\systemroot\system32\UACbmhmhvpwvmbbxls.log
 
---- EOF - GMER 1.0.15 ----

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:

Let's start the cleaning process:

1) Download & run RootRepeal

http://rootrepeal.googlepages.com/RootRepeal.rar

Star the scan and once you found the following file (c:\windows\system32\drivers\UACobwexumxfjwcdjb.sys)

When you find it, rightclick on it and choose "Wipe File". Reboot when you have done

2) Download Avenger

http://swandog46.geekstogo.com/avenger2/avenger.zip

2) Open Avenger

3) Copy & paste attached code

4) Post the log file of both Avenger and RootRepeal

Drivers to delete:
UACd.sys
 
Files to delete:
C:\WINDOWS\system32\UACnevpabrnsfoawrk.dll
C:\WINDOWS\system32\UACgeyqnwylvrbfxlp.dat
C:\WINDOWS\system32\UACgbudboeuypbtuok.dll
C:\WINDOWS\system32\UACchlivppkskkolwm.dll
C:\WINDOWS\system32\UACkllxecmrxdksnbx.dll
C:\WINDOWS\system32\UACvddwrtxxphunriq.dll
C:\WINDOWS\system32\UACgtylmwwoskqrbmy.log
C:\WINDOWS\system32\UACeemucgqmvukqfxn.log
C:\WINDOWS\system32\UACbmhmhvpwvmbbxls.log
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:

Did Combofix deleted any files during its first and second run?
The combofix log you posted is the result of the 3rd run and it didn't show much.

The Gmer log is only showing the rootkit's service registry entries... it didn't show any rootkit files. The rootkit's reg entries services is showing in present configurations which could mean that the rootkit might no longer be active ( I could be wrong of course)
When you start Gmer and click on the "Files"tab and "rootkit/malware" tab do you see any of those rootkit names showing in the registry section of the Gmer's log?

Yes, it'll be good to look at Gmer's Full log.

@rpggamergirl

These are the rootkit related files from Gmer's log file (may be not all of them)

C:\WINDOWS\system32\UACnevpabrnsfoawrk.dll
C:\WINDOWS\system32\UACgeyqnwylvrbfxlp.dat
C:\WINDOWS\system32\UACgbudboeuypbtuok.dll
C:\WINDOWS\system32\UACchlivppkskkolwm.dll
C:\WINDOWS\system32\UACkllxecmrxdksnbx.dll
C:\WINDOWS\system32\UACvddwrtxxphunriq.dll
C:\WINDOWS\system32\UACgtylmwwoskqrbmy.log
C:\WINDOWS\system32\UACeemucgqmvukqfxn.log
C:\WINDOWS\system32\UACbmhmhvpwvmbbxls.log

If they still exist in the system32 folder, this means definitely not yet "neutralized"

other gmer log as requested...

Have you executed the cleaning script (above) using Avenger ?

xmachine,
I have no doubts that those filenames you listed are rootkits, but since Combofix also removes this "UAC*" rootkits, and since the Gmer log is not showing us any rootkit files that's why I asked if CF had removed those during its first and second runs, and I asked if he could see rootkit files when looking at Gmer's tabs.

Those rootkit filenames you listed you took from Gmer's registry entries, that doesn't mean that those filenames do exist.
And since Gmer is only showing us those reg entries in the ControlSet003 that's another indicative that the rootkit may not be active.
I hope you understand what I'm trying to say.

My reason for thinking that the rootkit may not be active:
1. Combofix log is the result of the 3rd run and CF does remove this rootkit.
2. Gmer is not showing any rootkit files.
3. Gmer is only showing rootkit registry entries in ControlSet003 and not in CurrentControlSet.

I am not an expert in analyzing Gmer's log but I know that any filenames in the registry doesn't necessarily mean the physical files are also present.
I'll be interested to see in the Avenger log.


bryndwcs,
Could you please check combofix Qoobox folder for combofix1.txt or combofix2.txt.... to check if it removed those rootkits?

RootRepeal and Avenger logs attached.

"rpgamergirl"
After I ran ComboFix, I must have removed the logs, which was silly of me but it was very late at night and I was probably not thinking too clearly. Sorry about that.

Sorry, hadn't loaded the script for Avenger. Am doing that now.

Post log shortly...

Combofix keeps the copies of the previous logs in the C:\Qoobox

RootRepeal's report did not show any rootkit files either... so it could be that this is just a remnant reg entry of the rootkit.

The avenger script will delete that driver..... avenger will probably not find any rootkit files either but at least it will remove the service.

Avenger log with script run + found the earlier ComboFix logs.

The above Combofix log is log 2 and 3.

Maybe somehow log 1 is gone.....
Combofix keeps a backup of all files that were deleted, you can see the deleted files there --> C:\Qoobox\Quarantine

The full GMER log earlier posted and the RootRepeal both show hooked items relating to a norton file SYMEFA.sys.

This is a bit suspicious (gut feeling).

As per last comment, the GMER full log shows that the file SYMEFA.sys could not be found yet it is visible in the windows explorer. Does this mean anything?

Don't worry about (SYMEFA.sys). This is related to Symantec Endpoint Protection virus/rootkit scanning.

Thanks xmachine.

So if the machine is clean. Why is NAV still reporting the heuristically identified infection?

Is there any way to force NAV to report the location of the "files" it is detecting?

Can a attach a screenshot/risk log?

Sure - will go organise that now...

Here you go...

Hope they mean something to you.

Thanks for all your help so far xmachine

Thanks to you both. I awarded most of the points to xmachine as his input was the guiding factor in removing the infection and then fixing Norton.
Cheers guys and gals. :-))))