Author Topic: Rootkit removal  (Read 6193 times)

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Rootkit removal
« on: October 05, 2009, 04:29:49 AM »
Avast keeps telling me that I have a rootkit and every time I've tried to move it to the chest it tells me that it can't because the program is being used. I downloaded a rootkit specific program and the most its done is tell me that its in the master boot record but it can't remove it. Any suggestions?

Offline Pondus

  • avast! Überevangelist
  • Maybe Bot
  • *****
  • Posts: 21682
  • Gender: Male
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #1 on: October 05, 2009, 05:20:22 AM »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline Tarq57

  • avast! Evangelist
  • Massive Poster
  • ***
  • Posts: 3696
  • Gender: Male
  • If at first you don’t succeed; call it version 1.0
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #2 on: October 05, 2009, 05:56:00 AM »
Can you please post the name of the rootkit, and any filename and path information.
What rootkit program did you download? You might be able to run it in safe mode.
WindowsXP Home SP3,Avast Free 5.1.889,Windows Firewall, Autorun Eater,Firefox w/Noscript+ /Adblock+/Better Privacy, IE8 all zones except MS Update set to "untrusted" settings,MVPS Host file.SecuniaPSI.

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #3 on: October 05, 2009, 07:41:48 AM »
The boot time scan doesn't work. I used the Trend Micro rootkit buster and the rootkit itself is called Win32:Alureon-DA and its under the file C:\\Windows\System32\gasfkyphtttxw.dll I don't know about the path information, where would I find it?

Offline YoKenny

  • Serious Graphoman
  • **
  • Posts: 8800
  • Gender: Male
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #4 on: October 05, 2009, 08:27:08 AM »
Welcome Thistledown

Using Search I found:
http://forum.avast.com/index.php?topic=49215.0
http://forum.avast.com/index.php?topic=49203.0

Looks like a bit of a nasty infection so its best to include operating system and Service Pack level to aid in infection removal.
E5200 2.5GHZ, 4GB RAM, 320GB HD, Windows 7 Home Premium 64bit, avast! V9.0 Free, IE10
P4 2.8GHZ, 1.5GB RAM, 40GB HD, XP Pro SP3 32bit, avast! V9.0 Free, Google Chrome
with hpHosts, MVPS HOSTS files, SpeedFan, WinPatrol PLUS

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #5 on: October 05, 2009, 08:46:27 AM »
I used rootrepeal but it keeps giving me an error code. Suggestions?

Offline Tarq57

  • avast! Evangelist
  • Massive Poster
  • ***
  • Posts: 3696
  • Gender: Male
  • If at first you don’t succeed; call it version 1.0
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #6 on: October 05, 2009, 08:49:13 AM »
Quote
C:\\Windows\System32\gasfkyphtttxw.dll
actually contains the path information (C, windows, system etc...it's the route to the folder) and this is indeed a nasty infection.
The dll will be likely recreated and renamed each time it's removed.
Haven't got time myself to help right now, a forum search- plus looking at YoKenny's links -could give you some more info. (Unfortunately that info is not likely to be totally reassuring.)
Anyway, we'll do what's possible.
If you have any important data that isn't backed up yet, I'd back it up now, just in case.
WindowsXP Home SP3,Avast Free 5.1.889,Windows Firewall, Autorun Eater,Firefox w/Noscript+ /Adblock+/Better Privacy, IE8 all zones except MS Update set to "untrusted" settings,MVPS Host file.SecuniaPSI.

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #7 on: October 05, 2009, 04:09:24 PM »
I just noticed that I put this on the wrong forum, sorry about that. I'll post the question again in the correct area later.

Offline DavidR

  • avast! Überevangelist
  • Certainly Bot
  • *****
  • Posts: 69208
  • Gender: Male
  • No support PMs thanks
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #8 on: October 05, 2009, 04:31:22 PM »
Just leave it where it is as this would just generate more posts responding to what has already been said. Try the boot-time scan as suggested first and report the findings.

Also read the other related topics that were given.
« Last Edit: October 05, 2009, 04:41:11 PM by DavidR »
Core2Duo E8300/ 4GB Ram/ WinXP ProSP3/ avast! free 2014 9.0.2018/ Outpost Firewall Pro9.1/ Firefox 28.0, NoScript, RequestPolicy/ MailWasher Pro/ DropMyRights/ MalwareBytes AntiMalware Premium 2.0.1/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #9 on: October 05, 2009, 09:16:39 PM »
I've done multiple scans with a few of the suggested programs in other posts but it hasn't worked. They have either been inefective or haven't even found the rootkit. On the plus side I've managed to get a lot of other types of malware off my computer. I have my computer backed up so if worst comes to worst I can reformat it if I need to.
Again I apologize for posting this in the wrong area.

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #10 on: October 06, 2009, 02:04:41 AM »
I did a safe boot and tried a virus scan then. When I attempted to move the rootkit to the chest I got the message "The maximum number of secrets that may be stored in a single system has been exceded". What does that mean?

Offline XTCHost

  • Newbie
  • *
  • Posts: 1
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #11 on: October 06, 2009, 02:53:49 PM »
First can I just say what a great program Avast is and a big thank you toeveryone on the team - I promote it to everyone I know and have used it for 7 yrs now and have cleaned lots of pc's that have other antivirus software on that failed to clean.

Bootscan rocks... Or did untill the below

Root kit problem

I encountered this problem on a friends system that did not have protection: On loading Avast it detected a virus when testing the memory, this is not something I have ever encountered. Avast let me down on this instance, it would nt detect it usingthe boot scan nor could it delet it when it detected it on the memory test the problem was called gasfkykwvtyaqf

After about 6 hrs of frustration I found an article on bleepingcomputer.com

Please download Sophos Anti-rootkit & save it to your desktop.

http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Note: If using the vendor's download site you will be asked to register with MySophos so an email
containing an activation link can be sent to your email address.
Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes.
Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click
Accept.
Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
If the scan did not start automatically, make sure the following are checked:
Running processes
Windows Registry
Local Hard Drives
Click Start scan.
Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper
panel.
When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK
to continue.
Click on the suspicious file to display more information about it in the lower panel which also
includes whether the item is recommended for removal.
Files tagged as Removable: No are not marked for removal and cannot be removed.
Files tagged as Removable: Yes (clean up recommended) are marked for removal by
default.
Files tagged as Removable: Yes (but clean up not recommended) are not marked for
removal because Sophos did not recognize them. These files will require further
investigation.
Select only items recommended for removal, then click "Clean up checked items". You will be
asked to confirm, click Yes.
A pop up window will appear advising the cleanup will finish when you restart your computer.
Click Restart Now.
After reboot, a dialog box displays the files you selected for removal and the action taken.
Click Empty list and then click Continue to re-scan your computer a second time to ensure
everything was cleaned.
When done, go to   > Run..., then copy and paste this command into the open box:
%temp%\sarscan.log
This should open the log from the rootkit scan. Please post this log in your next reply. If you have
a problem, you can find sarscan.log in C:\Documents and Settings\<username>\Local
Settings\Temp\.
Important: Before performing an anti-rootkit (ARK) scan it is recommended to do the following to ensure
BleepingComputer.com > infected with gasfky, loo... http://www.bleepingcomputer.com/forums/lofiversi...
3 of 6 01/10/09 20:39andrewmrobbins
more accurate results and avoid common issues that may cause false detections.
Disconnect from the Internet or physically unplug you Internet cable connection.
Clean out your temporary files.
Close all open programs, scheduling/updating tasks and background processes that might activate
during the scan including the screensaver.
Temporarily disable your anti-virus and real-time anti-spyware protection.
After starting the scan, do not use the computer until the scan has completed.
When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to
the Internet.
Note: Not all hidden components detected by ARKs are malicious. It is normal for a Firewall, some
Anti-virus and Anti-malware software

I hope the above does not break any rules as I have only just joined and am just trying to help others with a problem that I managed to solve

I am not sure why Avast was unable to handle this problem but it has not put me off

Keep up the good work

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #12 on: October 06, 2009, 08:46:17 PM »
It didn't work, everything is either classified as non removeable or removeable but not suggested. I think that I'm just going to back up my music then do a complete system restore.
I appreciate everyone's help.

Offline Tarq57

  • avast! Evangelist
  • Massive Poster
  • ***
  • Posts: 3696
  • Gender: Male
  • If at first you don’t succeed; call it version 1.0
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #13 on: October 06, 2009, 10:04:57 PM »
Sorry, thistledown, I don't know exactly what "maximum secrets.." means in this context, a "secret" is defined as an encrypted piece of information, such as a password or username, and it sounds a likely type of behaviour for a rootkit file, which by nature can be hidden or encrypted, and/or buried in what's called the alternate data stream. (Which simply is a way of saying the file offers one reading for its visible part, but has hidden and unreadable components that differ in structure/size somewhere else.)

A system restore will not fix this infection, I'm afraid, only "proper" manual/specialist fixing (which I'm not qualified to confidently perform) or a full format and reinstall will get rid of it.

What were the other programs you attempted to run, and a brief description of the problem encountered by each one? It's possible there may be another program that can nail it. What's needed (which sounds like it should be simple but isn't always) is to find the executable that recreates its spawn, I believe it is the spawn (my description) that is being detected, but not the main "carrier". That is why it keeps coming back.
You might want to try the Sophos program mentioned above, too.

There are other programs, like Unlocker, that can sometimes allow an otherwise un-movable file to be deleted.
Thing is, how much trouble do you want to go to on this, when a backup (don't back up anything from the OS; just your own saved files) and then format/reinstall is a bit of a PITA, but at least you know what you're in for, and with some certainty about the end result.?
WindowsXP Home SP3,Avast Free 5.1.889,Windows Firewall, Autorun Eater,Firefox w/Noscript+ /Adblock+/Better Privacy, IE8 all zones except MS Update set to "untrusted" settings,MVPS Host file.SecuniaPSI.

Offline Thistledown

  • Newbie
  • *
  • Posts: 11
    • Personal Message (Offline)
Re: Rootkit removal
« Reply #14 on: October 06, 2009, 11:16:01 PM »
I've been asking on a few forums and doing some research so I've tried multiple systems. I have tried rootrepeal, which kept giving me errors, sophos, the results for which are on a previous post of mine, Avast (of course), superanti spyware which didn't even detect it, malware bytes which also didn't detect it and radix which again, didn't detect it.
The overall vibe has been that I'm screwed. I'm using a Toshiba computer running off of Vista and I was planning on using the recovey disc. Will that work or is it not drastic enough?

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now