Rootkit.Agent found, but can't be removed

[eruddick]

I've read a few other posts where people had a similar problem.  I've run avast and malwarebytes.  Both find the infected file (C:\Windows\System32\drivers\yuangs.sys) but neither can remove it, even after reboot.  The other posts were for XP, but I'm on Windows 7.  Was wondering if I need different versions of the same tools.  It seems that the solution is unique each time.

Thanks for any help you can give.

[Pondus]

Follow this guide from Essexboy and post the log`s here
http://forum.avast.com/index.php?topic=53253.0

if the log`s are big, see down left corner: Additional Options > attach

[eruddick]

Ran MBAM again (3rd time) and got the same result.  It showed 1 file infected.  I selected the file and said to remove it.  It said the file was removed but a reboot was necessary.  Rebooted and the file was still there.  Attached are the MBAM logs and the OTL txt files.

Thanks for your help!

[mikaelrask]

if avast is detect it you could try a boot scan and see if avast can solve it that way.

http://www.techiecorner.com/166/avast-how-to-schedule-boot-time-scan-before-window-start/ for v 4.8

http://www.schmahl.net/avastbootscan.php for v 5

you could also try superantispyware.

http://filehippo.com/download_superantispyware/

good luck

[Pondus]

Have sendt a PM to Essexboy, so he will look at this when he enters the forum

[eruddick]

@pondus, thanks.  I'll wait for his reply.

@mikaelrask I did run a boot scan with avast.  It flagged the infected file but couldn't remove it.

[essexboy]

Hi I do not know if OTL will shift this as it is well rooted - so I will try to kill it first and immediately follow up with the big boy

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

Code: [Select]

:OTL
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
[2010/05/24 22:08:49 | 000,741,376 | ---- | M] () -- C:\windows\System32\drivers\yuangs.sys
[2010/05/22 16:19:34 | 000,000,120 | ---- | M] () -- C:\Users\Ed\AppData\Local\Hmuxeyeyogo.dat
[2010/05/22 09:04:38 | 000,000,000 | ---- | M] () -- C:\Users\Ed\AppData\Local\Wxaro.bin
[2010/05/19 22:43:05 | 000,000,020 | ---- | M] () -- C:\Users\Ed\AppData\Roaming\qvjsge.dat
[2010/05/24 22:20:51 | 000,741,376 | ---- | M] () Unable to obtain MD5 -- C:\windows\System32\drivers\yuangs.sys

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
  

ON REBOOT

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• Double click on ComboFix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.

[eruddick]

After OTL ran and rebooted the machine, it reran automatically on startup.  I've included that log, 05252010_142729.log.  Then I ran OTL and ran Quick Scan so I've attached the OTL.txt file from that.  Also attached is the ComboFix log file.

Thanks for all of your help.

[eruddick]

forgot to mention, though you probably can see it, C:\Windows\system32\drivers\yuangs.sys is still there

[essexboy]

Intriguing that Combofix did not see it

1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
• Follow the prompts and extract the avenger folder to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Code: [Select]

Begin copying here:
Drivers to delete:
yuangs

Files to delete:
C:\windows\System32\drivers\yuangs.sys
Note: the above code was created specifically for this user.  If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also click on this window and  press (Ctrl+V) to paste the contents of the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.
  

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions.  This log file will be located at  C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply

[eruddick]

Here are the contents of avenger.txt:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "yuangs" deleted successfully.
File "C:\windows\System32\drivers\yuangs.sys" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.


It looks like yuangs.sys is finally gone.

[essexboy]

Looks like it. However, could you now update and run MBAM again please   

[eruddick]

Updated and reran MBAM.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4143

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5/25/2010 3:51:04 PM
mbam-log-2010-05-25 (15-51-04).txt

Scan type: Quick scan
Objects scanned: 140569
Time elapsed: 4 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[essexboy]

Shall we call it gone then ? 

Let it run for 24 hours and if there are no further problems I will remove my tools.  Be aware the malware is in several quarantine folders so Avast may detect it and delete it - if it is a backup or quarantine folder with the same name as my tools or in system restore that is not a problem

[eruddick]

Let's hope we can call it gone.  Thank you SO much for all of your help.  I saw on another post or website somewhere that you had paypal button to accept donations.  Would love to send you something.  Could you steer me to a website, link, etc.?

Thanks again.