March 16th, 2010, 06:15 AM
#1
Hijacked...
Customers computer is hijacked by what I think is an undetectable rootkit. I've run a plethora of programs, none of which have come up with anything significant.
March 16th, 2010, 06:46 AM
#2
March 16th, 2010, 06:06 PM
#3
Snapshot omitted....
March 16th, 2010, 06:06 PM
#4
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))www.google.com http://www.gmer.net
March 16th, 2010, 06:20 PM
#5
1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box. copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\docume~1\User\LOCALS~1\Temp\EJGRU.exe
c:\docume~1\User\LOCALS~1\Temp\IXWDHO.exe
c:\windows\system32\291.tmp
c:\docume~1\User\LOCALS~1\Temp\SIGPMIERHR.exe
c:\docume~1\User\LOCALS~1\Temp\NQNTZTTNNMVOO.exe
Folder::
Driver::
EJGRU
IXWDHO
MEMSWEEP2
SIGPMIERHR
NQNTZTTNNMVOO
Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
RegLockDel::
Save the above as CFScript.txt drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.Combofix.txt A new HijackThis log .
March 17th, 2010, 03:21 AM
#6
Update...
March 17th, 2010, 04:34 AM
#7
Combofix log after running the scriptwww.google.com http://www.gmer.net
March 17th, 2010, 04:36 AM
#8
HJThttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://upload.facebook.com/controls/...oUploader5.cab http://xtraz.icq.com/xtraz/products/...essContact.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab https://www.plaxo.com/activex/plx_upldr-2k-xp.cab
March 17th, 2010, 07:38 PM
#9
Combofix log looks good Combofix :Start > Run [Vista users, go Start>"Start search"]Combofix /Uninstall Note the space between the "Combofix" and the "/Uninstall" HijackThis :http://www.trendsecure.com/portal/en...kthis/download Installer under Version 2.0.2 Print these instructions out. NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe scanner.exe ***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***STEP 1. Malwarebytes' Anti-Malware : http://www.malwarebytes.org/mbam.php to your desktop.(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes) mbam-setup.exe and follow the prompts to install the program.Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish .Perform Quick Scan , then click Scan .Show Results to view the results.Remove Selected .Post the log back here .log-date.txt log-date.txt RESTART COMPUTER! STEP 2. Post fresh HijackThis log. NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
March 17th, 2010, 07:42 PM
#10
Hi Broni, since my last post, I had to return the computer to the customer. I couldn't keep it another day. I did run Malwarebytes after running combofix and it came up 100% clean.
March 17th, 2010, 09:00 PM
#11
You're welcome
March 17th, 2010, 09:06 PM
#12
He's a mechanic. He knows as little about computers as I know about cars. There's no way he'll ever use system restore.
Last edited by usil; March 17th, 2010 at 09:45 PM .
March 17th, 2010, 09:10 PM
#13
I have my doubts though that restoring the system will bring a virus back.
You have my 100% assurance, it will. With most infections, restore points got compromised.
March 17th, 2010, 09:15 PM
#14
With the anti-virus updated, it will catch the virus during restoration.
March 17th, 2010, 09:18 PM
#15
You have to remember, there is no bullet-proof AV program.
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
Forum Rules
Reply With Quote
