TechSpot

Logs after the 8 Steps

By chadt5382
Jul 19, 2009
  1. Hello all,

    I have completed the eight recommended steps after fighting with Rootkit/trojan/backdoor yada yada for many hours.Everything appears to be working fine for now. Here are my logs as I thought I had this licked quite a few times already and the pop ups or redirects resurfaced.

    If there is anyone who would mind looking this over -much appreciated. If I have corrected the issues and my logs can help someone else-that'd be great too.

    Thanks in advance
     
  2. chadt5382

    chadt5382 TS Rookie Topic Starter

    There back

    The malware is back. Redirecting when I am using Firefox.

    I am being taken to sites that I don't want and now both Superantispyware and Malware bytes logs are showing no problems.

    Spybot found Win32.TDss.rdk (x2)

    and

    Microsoft.WindowsSecurityCenter_disabled

    suggestions?
     
  3. Ruthe

    Ruthe TS Booster Posts: 70

    OK, this is my first stab at fixing someone else's malware problem. So you may want to wait to implement until my solution has been vetted by someone more knowledgable.

    First, Download ComboFix (Avenger or MalwareBytes might also work)
    http://forums.techguy.org/malware-removal-hijackthis-logs/836138-problem-rootkit-agent.html
    (look at the bottom of the page for the links and some instructions) and/or Google them to find the downloads. You may not be able to retrieve them from the official sites.
    SuperAntiSpyware should be able to kill off HP_admin.

    Optional, but not in my opinion: download a good hosts file like this one:
    http://www.mvps.org/winhelp2002/hosts.htm
    it's easy to read. All the sites listed are bad. If you inadvertantly click on one while in your browser the address is CHANGED to your local machine. So you don't go to the bad spot. Look about halfway down the page for the download and/or to just look at the entries. And if you can't get to a site or advert you want to go to, simply remove it from the hosts. file using Notepad or WordPad.

    Second, turn off your system restore. Right click My Computer, select Properties. Select the System Restore tab. Click the turn off checkbox and select apply. This will remove all the restore points you've made so far. But they are probably infected so they're not usable anyway.

    Next, << I >> would disconnect from the internet. Just pull the router plug. :)

    Third, shut down or suspend all other programs including the firewall, any anti-virus such as AVG and Symantec/Norton. You can do this from the icons on the system tray and verify in the task manager.

    Fourth, I would clean out the prefetch directory/folder. It's in C:\windows\prefetch. Open it, select all files and delete them all. (there's a registry entry for this you can change later if you want to know more).

    Fifth, for grins and optional, open the device manager (right click My Computer, Properties, hardware, device manager). Once there click View, Show Hidden Devices. Open Non Plug and Play and uacd should be there. (you can manually remove it, but let's let ComboFix do it - that's not the only step). You can also verify the location of HP_admin by looking in your docs and settings.

    Sixth, install and run ComboFix to fix uacd (and it will also install the windows recovery console, a useful tool). Run SuperAntiSpyware and it will kill HP_Admin.

    Here is where I'd install the hosts. file. If you have XP it's at C:\windows\system32\drivers\etc\hosts. You can rename the one that's there or delete it. Or if you downloaded it from the site above, it may install it for you, I don't remember.

    Reattach to the internet. Reboot (this shuold go fast since no prefetch). Verify both problems are gone (see fifth step above). Verify your virus checker and firewall are running. Turn on system restore.

    Last, you may want to do some clean up in MSConfig, but deal with that later. I think that's it. This has taken me FOREVER to type. Hope it helps you. Good luck!
     
  4. Ruthe

    Ruthe TS Booster Posts: 70

    Yikes! Forgot the other two. Don't forget to suspend teatimer (spybot). Go into spybot, select mode, advanced. Select tools (at bottom, left pane). Select the Resident button. Unclick Resident Tea Timer checkbox. Then you must reboot. Do this before you suspend all the other software running, since you will be rebooting. Spybot should be able to rid you of Win32.tdss. If not, ComboFix should.

    To turn back on windows security go to Start, Settings, Control Panel, Security Center. You can do this after all the bad stuff is removed.

    And I have seen advice that says not to turn off System Restore until immediately after you verify your system is clean. ALSO, if you have to transfer downloaded files from a clean machine to an infected one, don't use a media (like USB stick, floppy) that has been in the infected machine.
     
  5. Ruthe

    Ruthe TS Booster Posts: 70

    And don't forget to turn teaTimer back on. (oops!) I would do that right after installing the hosts file.
     
  6. chadt5382

    chadt5382 TS Rookie Topic Starter

    Fixed for good?

    Ruthe,

    Thank you for taking the time to write out instructions in great detail I hope that as your first attempt at helping someone out (me) I have held up my end by following the steps as laid out.

    Everything went smooth although I could not find UACD as mentioned in the fifth step

    "Fifth, for grins and optional, open the device manager (right click My Computer, Properties, hardware, device manager). Once there click View, Show Hidden Devices. Open Non Plug and Play and uacd should be there. (you can manually remove it, but let's let ComboFix do it - that's not the only step). You can also verify the location of HP_admin by looking in your docs and settings."


    At any rate, I have attached the combofix log and will let you know if any of the offenders return.

    Thanks very much
    Chad
     
  7. Ruthe

    Ruthe TS Booster Posts: 70

    You are most welcome. A thanks and a working machine makes my day.

    I've never run into uacd myself - I read that's where it could be seen.

    Your log looks good to ME. Do let us know if there's any more problems. You might try running SuperAntiSpyware once more just to see if uacd is still reported. We should know for sure if it's gone. You don't want another reoccurance.

    If you're interested, RegCleaner (registry cleaner) is really good and free. Easy to use and can help clean up your registry. I personally am a big fan of a good hosts. file, too. If you want advice on anything, you know where to come.

    Now be a good boy and keep your security up-to-date and running. :)
    Ruthe
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...