Solved

Kaspersky can't delete virus "Rootkit.Win32.TDSS.a"

Posted on 2009-05-15
15
5,471 Views
Last Modified: 2013-12-06
Hey Guys:

Kaspersky goes thru a special scan for this and then automatically reboots.  But it can't seem to remove it.  It says it's in system memory.  I tried to run system restore and it won't let me.  It seems to know what to stop so you cant get rid of it.  I tried Trend-Micro and Panda online scans to no avail.  I think maybe the only thing I can do is run Hijack this and post the output.  If you have any other ideas that would be great.
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:28:05 AM, on 5/16/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\VMware\VMware Workstation\vmware-authd.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\Lock My PC 4\lockpc.exe

C:\Program Files\Styler\Styler.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe

C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe

C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HJTInstall.exe

C:\Documents and Settings\Admin\My Documents\Downloads\Programs\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [lmpc4] C:\Program Files\Lock My PC 4\lockpc.exe /s

O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O4 - Startup: ChkDisk.lnk = ?

O4 - Startup: Styler.lnk = ?

O4 - Global Startup: Qs Black Shine Blue.wsstyles

O4 - Global Startup: setupcomplete.cmd

O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm

O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll

O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: fsp_lmwl - C:\WINDOWS\SYSTEM32\fsp_lmwl.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
 

--

End of file - 7946 bytes

Open in new window

0
Comment
Question by:jwmghf
15 Comments
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 500 total points
ID: 24401584
Use Combofix or MalwareBytes or both.

You need to rename the tools before saving to your desktop, rename it before actually downloading the file.
MalwareBytes:
http://www.geekstogo.com/forum/redirect.php?url=http%3A%2F%2Fwww.malwarebytes.org%2Fmbam-download.php
 

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
 
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 24401595
You can also chck if any TDSSserv driver is listed and disable it.
Go to the Control Panel.
Select System -> Hardware -> Device Manager.
Select View from the Menu, then "Show hidden Devices".
Expand "Non Plug and Play Drivers". ,
Right click on the TDSSserv.sys driver and select Properties, Stop and Disable it.
You will be asked to restart the computer, Select No.

Also disable seneka  or gao##### drivers if found.
0
 
LVL 23

Expert Comment

by:Admin3k
ID: 24401948
Have you tried to scan a full scan with KAspersky in safe mode first ?

0
 

Author Comment

by:jwmghf
ID: 24402504
Hey guys:

I will try all these things later on tonight.  I have a busy Sat. planned.  I will post back then.  

Admin3k:  

I did try Kaspersky in safe mode.  In safe mode it passes right by it so I think it must be something that is turned on and becomes visible at startup.  When I start the scan, it snags it within 2 seconds and wants to run a special scan routine, delete and then re-boot the system.  When it re-boots and I run the scan again, its back and wants to repeat the routine over and over again.  It does offer the "skip" option, but, that not really helpful!!!

Thanks for the input and I post back later.
0
 

Expert Comment

by:molard
ID: 24406385
I found the same rootkit on a computer in my organization about a month ago.  The only thing I found that would remove it was UnhackMe available at http://www.greatis.com/unhackme/.  It's not free but you can use it one time to remove the rootkit and uninstall the software later.  I would scan your computer with Unhack Me and it will ask you to reboot your computer.  Reboot your computer and it will scan your system on startup.  It will notify you of any suspicious programs.  I used Panda on this computer before hand and Panda would only scan about 1000 files on the system and report it as "clean".  I knew something wasn't right because (a) there are more than 1000 files on the computer and (b) the scan finished in about a minute.  Once UnhackMe removed the rootkit, follow up with a Panda scan.  I would also recomment downloading MalwareBytes and running a scan.  A layered approach is always a good solution.
0
 

Author Comment

by:jwmghf
ID: 24406689
Ok... it looks like rpggamergirl is the winner.  ComboFix took it right out!!!

Thanks for everyone's help here.  You guys are great.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 47

Expert Comment

by:rpggamergirl
ID: 24409100
Glad to know it's been resolved.
Since you didn't show us the Cf log, you might like to wait for a day or 2 before uninstalling combofix ,as its uninstallation will also remove the backup.

To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

The above process will remove Combofix and its files, delete the created backup and reset System Restore.

Thanks!
0
 

Expert Comment

by:tammy5
ID: 24622960
Hi, thanks for all the help you have given me. I have had that virus on my computer & have been trying to get rid of it to no avail. The combo fix has done the trick. I have attatched the Cf log if anyone wants to look at it. Do I have to do anything else?
ComboFix.txt
0
 

Author Comment

by:jwmghf
ID: 24640828
Hi Tammy:

I'm glad I was able to help you out. That was a tough one to get rid of but ComboFix did it with ease. Who knows what other viruses there are going to come up with next. I have also added the UnhackMe program to my computer. It also does a nice job. If someone checks back with this post they may take a look at your log file. You could post it over at ******** I am sure you will get a reply to it there.

Take care
*Link removed by rpggamergirl, Zone Advisor*
17/06/2009
0
 

Author Comment

by:jwmghf
ID: 24647974
rpggamergirl:

My bad.  I apologise for that posting.  I didn't realize I had done that.
0
 
LVL 3

Expert Comment

by:itsofmi
ID: 24788488
Hello all, I have this exact same problem and I ran combofix and when i restarted Kaspersky, it all came up again. Same as before.

Did I miss something?
0
 
LVL 6

Expert Comment

by:RootsMan
ID: 34075458
Once a system has been compromised by a rootkit, it is impossible to be 100% certain that the system is clean. A rootkit usually modifies parts of the OS to hide itself. How can you trust the OS after that?
Kaspersky and all of the others can only clean what they know about. There could be an unknown rootkit or variant still on your system.

I recommend you backup just the data from the system, reformat the hard drive, and do a clean installation of the OS from a known good DVD.

That's the only way to be sure the system is clean.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
how to block outgoing mail to specified domain 6 36
Locky virus 9 74
Yet another Ransome ware 13 148
Is this virus ? 6 16
12 Steps to a more secure Internet experience (http://tekblog.teksquisite.com/) Everyone who is a licensed driver initially had to pass a driving test that consisted of taking:    1. a written test    2. a road test    3. a vision test Le…
PREFACE The purpose of this guide is to explain how to manually move a SEP client to a different client group by performing steps on the client-side. These steps may prove particularly useful because they allow the client to move after it has alrea…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now