Kaspersky can't delete virus "Rootkit.Win32.TDSS.a"
Hey Guys:
Kaspersky goes thru a special scan for this and then automatically reboots. But it can't seem to remove it. It says it's in system memory. I tried to run system restore and it won't let me. It seems to know what to stop so you cant get rid of it. I tried Trend-Micro and Panda online scans to no avail. I think maybe the only thing I can do is run Hijack this and post the output. If you have any other ideas that would be great.
Kaspersky goes thru a special scan for this and then automatically reboots. But it can't seem to remove it. It says it's in system memory. I tried to run system restore and it won't let me. It seems to know what to stop so you cant get rid of it. I tried Trend-Micro and Panda online scans to no avail. I think maybe the only thing I can do is run Hijack this and post the output. If you have any other ideas that would be great.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:28:05 AM, on 5/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Lock My PC 4\lockpc.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe
C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe
C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe
C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [lmpc4] C:\Program Files\Lock My PC 4\lockpc.exe /s
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: ChkDisk.lnk = ?
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: Qs Black Shine Blue.wsstyles
O4 - Global Startup: setupcomplete.cmd
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: fsp_lmwl - C:\WINDOWS\SYSTEM32\fsp_lmwl.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
--
End of file - 7946 bytes
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Have you tried to scan a full scan with KAspersky in safe mode first ?
ASKER
Hey guys:
I will try all these things later on tonight. I have a busy Sat. planned. I will post back then.
Admin3k:
I did try Kaspersky in safe mode. In safe mode it passes right by it so I think it must be something that is turned on and becomes visible at startup. When I start the scan, it snags it within 2 seconds and wants to run a special scan routine, delete and then re-boot the system. When it re-boots and I run the scan again, its back and wants to repeat the routine over and over again. It does offer the "skip" option, but, that not really helpful!!!
Thanks for the input and I post back later.
I will try all these things later on tonight. I have a busy Sat. planned. I will post back then.
Admin3k:
I did try Kaspersky in safe mode. In safe mode it passes right by it so I think it must be something that is turned on and becomes visible at startup. When I start the scan, it snags it within 2 seconds and wants to run a special scan routine, delete and then re-boot the system. When it re-boots and I run the scan again, its back and wants to repeat the routine over and over again. It does offer the "skip" option, but, that not really helpful!!!
Thanks for the input and I post back later.
I found the same rootkit on a computer in my organization about a month ago. The only thing I found that would remove it was UnhackMe available at http://www.greatis.com/unhackme/. It's not free but you can use it one time to remove the rootkit and uninstall the software later. I would scan your computer with Unhack Me and it will ask you to reboot your computer. Reboot your computer and it will scan your system on startup. It will notify you of any suspicious programs. I used Panda on this computer before hand and Panda would only scan about 1000 files on the system and report it as "clean". I knew something wasn't right because (a) there are more than 1000 files on the computer and (b) the scan finished in about a minute. Once UnhackMe removed the rootkit, follow up with a Panda scan. I would also recomment downloading MalwareBytes and running a scan. A layered approach is always a good solution.
ASKER
Ok... it looks like rpggamergirl is the winner. ComboFix took it right out!!!
Thanks for everyone's help here. You guys are great.
Thanks for everyone's help here. You guys are great.
Glad to know it's been resolved.
Since you didn't show us the Cf log, you might like to wait for a day or 2 before uninstalling combofix ,as its uninstallation will also remove the backup.
To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:
ComboFix /u
The above process will remove Combofix and its files, delete the created backup and reset System Restore.
Thanks!
Since you didn't show us the Cf log, you might like to wait for a day or 2 before uninstalling combofix ,as its uninstallation will also remove the backup.
To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:
ComboFix /u
The above process will remove Combofix and its files, delete the created backup and reset System Restore.
Thanks!
Hi, thanks for all the help you have given me. I have had that virus on my computer & have been trying to get rid of it to no avail. The combo fix has done the trick. I have attatched the Cf log if anyone wants to look at it. Do I have to do anything else?
ComboFix.txt
ComboFix.txt
ASKER
Hi Tammy:
I'm glad I was able to help you out. That was a tough one to get rid of but ComboFix did it with ease. Who knows what other viruses there are going to come up with next. I have also added the UnhackMe program to my computer. It also does a nice job. If someone checks back with this post they may take a look at your log file. You could post it over at ******** I am sure you will get a reply to it there.
Take care
*Link removed by rpggamergirl, Zone Advisor*
17/06/2009
I'm glad I was able to help you out. That was a tough one to get rid of but ComboFix did it with ease. Who knows what other viruses there are going to come up with next. I have also added the UnhackMe program to my computer. It also does a nice job. If someone checks back with this post they may take a look at your log file. You could post it over at ******** I am sure you will get a reply to it there.
Take care
*Link removed by rpggamergirl, Zone Advisor*
17/06/2009
ASKER
rpggamergirl:
My bad. I apologise for that posting. I didn't realize I had done that.
My bad. I apologise for that posting. I didn't realize I had done that.
Hello all, I have this exact same problem and I ran combofix and when i restarted Kaspersky, it all came up again. Same as before.
Did I miss something?
Did I miss something?
Once a system has been compromised by a rootkit, it is impossible to be 100% certain that the system is clean. A rootkit usually modifies parts of the OS to hide itself. How can you trust the OS after that?
Kaspersky and all of the others can only clean what they know about. There could be an unknown rootkit or variant still on your system.
I recommend you backup just the data from the system, reformat the hard drive, and do a clean installation of the OS from a known good DVD.
That's the only way to be sure the system is clean.
Kaspersky and all of the others can only clean what they know about. There could be an unknown rootkit or variant still on your system.
I recommend you backup just the data from the system, reformat the hard drive, and do a clean installation of the OS from a known good DVD.
That's the only way to be sure the system is clean.
Go to the Control Panel.
Select System -> Hardware -> Device Manager.
Select View from the Menu, then "Show hidden Devices".
Expand "Non Plug and Play Drivers". ,
Right click on the TDSSserv.sys driver and select Properties, Stop and Disable it.
You will be asked to restart the computer, Select No.
Also disable seneka or gao##### drivers if found.