MBR: \\.\PHYSICALDRIVE0- Rootkit?

[VancetehHunter]

So, I'd like to start this off by saying to those willing to help- you'll have to explain like you're talking to a dummy, I've never really had a serious computer problem until this.  That, and thank you very much for taking your time to check this thread!

Alright, so.  I read through some of the other topics about this, and I definitely have the "rootkit" problem.  'Malicious URL blocked' popping up, a blue screen three times.  I ran a boot scan, and it detected nothing- which also seemed to happen to everyone.  I had assumed it was gone, until it came up saying it found another rootkit.  So, what do I do first?

Again, I'm sorry for the ignorance, and I appreciate your time!

[Pondus]

* download and save aswMBR.exe to desktop  http://public.avast.com/~gmerek/aswMBR.exe
* click aswMBR.exe icon to start
* click scan, when done "save log" and post it here in your next reply

[VancetehHunter]

I downloaded it, tried to run the .exe, and it automatically blue-screened.  The error message was:

"DRIVER_IRQS_NOT_LESS_OR_EQUAL"

Unfortunately, I've gotta run to work, so I won't be able to check in for about 8.5 hours.  Should I run the .exe in Safe Mode, save the log to a WordPad file, and post it here?  Also, thanks for replying!

[essexboy]

Yes, you can run it in safe mode

Have you run an Avast bootscan ?

[VancetehHunter]

Yeah- it found nothing wrong, but right after I ran it, it popped up saying another rootkit (the same one) was detected.

[VancetehHunter]

Alright.  I went into Safe Mode, ran the program, and it blue-screened once more, with the same error message.  Do I maybe need to un-check "Trace disk IO calls"?

[essexboy]

Nope lets try a different programme

Please read carefully and follow these steps. 

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
   
   
  
   
   
  
• If an infected file is detected, the default action will be Cure, click on Continue.
   
   
  
   
   
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
   
   
  
   
   
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
   
   
  
   
   
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

[VancetehHunter]

I cut out a meaty portion of the log, where it was scanning all the .SYS files- otherwise, I'll need to break this up into multiple posts.  Thanks again!  I haven't had avast! come up and tell me "Hey dude, you've got a rootkit" yet, so it seems to have worked to me at least.

Code: [Select]

2011/05/28 14:57:09.0569 1152 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24
2011/05/28 14:57:10.0083 1152 ================================================================================
2011/05/28 14:57:10.0083 1152 SystemInfo:
2011/05/28 14:57:10.0083 1152
2011/05/28 14:57:10.0083 1152 OS Version: 6.0.6002 ServicePack: 2.0
2011/05/28 14:57:10.0083 1152 Product type: Workstation
2011/05/28 14:57:10.0099 1152 ComputerName: THEGRAILARBORPC
2011/05/28 14:57:10.0099 1152 UserName: Joshua
2011/05/28 14:57:10.0099 1152 Windows directory: C:\Windows
2011/05/28 14:57:10.0099 1152 System windows directory: C:\Windows
2011/05/28 14:57:10.0099 1152 Running under WOW64
2011/05/28 14:57:10.0099 1152 Processor architecture: Intel x64
2011/05/28 14:57:10.0099 1152 Number of processors: 2
2011/05/28 14:57:10.0099 1152 Page size: 0x1000
2011/05/28 14:57:10.0099 1152 Boot type: Safe boot with network
2011/05/28 14:57:10.0099 1152 ================================================================================
2011/05/28 14:57:11.0472 1152 Initialize success
2011/05/28 14:58:11.0579 1100 ================================================================================
2011/05/28 14:58:11.0579 1100 Scan started
2011/05/28 14:58:11.0579 1100 Mode: Manual;
2011/05/28 14:58:11.0579 1100 ================================================================================

2011/05/28 14:58:33.0169 1100 {55662437-DA8C-40c0-AADA-2C816A897A49} (15cc7077d2dc28776cd430ecabbffd66) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl
2011/05/28 14:58:33.0231 1100 MBR (0x1B8)     (3a9ead8efe486f1bf11d7d003209cef0) \Device\Harddisk0\DR0
2011/05/28 14:58:33.0247 1100 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/05/28 14:58:33.0247 1100 ================================================================================
2011/05/28 14:58:33.0247 1100 Scan finished
2011/05/28 14:58:33.0247 1100 ================================================================================
2011/05/28 14:58:33.0356 0676 Detected object count: 1
2011/05/28 14:58:33.0356 0676 Actual detected object count: 1
2011/05/28 14:58:44.0869 0676 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/28 14:58:44.0869 0676 \Device\Harddisk0\DR0 - ok
2011/05/28 14:58:44.0869 0676 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
2011/05/28 14:59:08.0565 1688 Deinitialize success

[essexboy]

Could you now run the OTS programme to look for remnants

Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
  
• Select All Users
  
• Under additional scans select the following

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT

• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[VancetehHunter]

Sorry for the delay!  I've been in the process of moving.  But, here's the OTS log for you- I had to split it into two parts, as the original log was over the 200 KB attachment limit, and the posting was being pretty finicky.  (It was at 180 KB and said "Your attachment was too large, the maximum size allowed is 192 KB.)  So, part one will be on this post.

[VancetehHunter]

And here is part two- sorry I had to break the posts up.  Again, thanks for your time and patience!

[essexboy]

Hi could you resave the file as ANSI and it will then fit as one attachment and I will be able to read it

[VancetehHunter]

Here's the ANSI format.  I'm so, so sorry, and I REALLY appreciate all your patience.

[essexboy]

There was one hidden in another users run key ready to bite

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-3965527832-1568573459-2271341338-1000\] > -> HKEY_USERS\S-1-5-21-3965527832-1568573459-2271341338-1000\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_USERS\S-1-5-21-3965527832-1568573459-2271341338-1000\] > -> HKEY_USERS\S-1-5-21-3965527832-1568573459-2271341338-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "2008087725" -> [C:\Users\Joshua\AppData\Local\Temp\0.08552691547477898.exe]
[Alternate Data Streams]
NY -> @Alternate Data Stream - 1154 bytes -> C:\Users\Joshua\AppData\Local\Wpk0oa8ZR:jEqG8xPJeyrmbUcUmFYpUl
NY -> @Alternate Data Stream - 1260 bytes -> C:\ProgramData\Microsoft:k8gOevXlvLlTQ72b6BdxLN3
NY -> @Alternate Data Stream - 1302 bytes -> C:\ProgramData\Microsoft:86KAGZK1ZkOL5WXIuimK5v7N3XOc4
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
 
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.
Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.

This is no sign of malfunction, do not panic!

THEN

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.