Some sort of rootkit

[Joines]

So....

I Had a client yesterday request remote support to cleanup adware (she said she was getting random advertisements on her desktop). So I figured this would be an easy safe mode w/ networking job in which the viruses practically remove themselves. However, I was wrong.

When this client said advertisements were on her desktop, she actually meant they were playing over her speakers. At first, I didn't believe her. I was very cautious to ask if it was her TV in the background making the sounds (I could hear the ads, I never did ask if it was her TV). One of the ad's was for the Army, one was for a bathroom remodeling service, they were completely random.

So I decided to do my usually cleanup process, remove temp/history/temp internet files from the profiles, run ccleaner, run malwarebytes, remove unnecessary startup items, look over Autoruns for suspicious entries and temporarily uncheck them. However Malwarebytes only found a few adware items, there was little to go off of in Autoruns, and there was nothing active on the desktop when the computer was booted normally to even insinuate that there was an infection, of course until random ad's started playing over the speakers. I figured that the few adware items Malwarebytes found were just remnants of what was left over from something that the virus scanner maybe picked off. However after another reboot, it became clear that this wasn't the case.

At this point I decided to take pull out process explorer to take a deeper look. Process explorer revealed an iexplore running under a service host, which I found strange since there were no browsers open. I closed the iexplore process, and of course it quickly came back. At this point I was happy to find anything. After digging around process explorer for a little while I traced a .dat file within the iexplore process to C:\WINDOWS\system32\config\systemprofile\Local Settings\AntiPhishing\4254D-DSFSS-SDfSDf3-SDF.dat (not actual file name)

Admittedly this was the first time I've seen the documents and settings structure rebuilt within another folder (C:\windows\system32\config\systemprofile\) so I was a bit skeptical of the entire folder to begin with, however after researching I found that it is apparently legit and contains a standard profile for the local system. What caught my attention was what was inside the temporary internet files, hundreds and hundreds of .mp3, .gif, .swf, .fla, files. I immediately figured, okay so this is where the ad's are being stored, i'll just delete them all (500mb worth) in safe mode and then see if I get any program errors while booting to lead me to the next step.

So I rebooted into safe mode w/ networking once again. Out of curiosity I loaded process explorer and saw no iexplore process (and was happy) I then deleted the entire systemprofile file structure (after researching that this was possible). At this point process explorer was still open, only because I had forgotten to close it and my little iexplore buddy returned to greet me in safe mode. I went to check the systemprofile file structure, and remarkably the 500mb worth of temp files had returned. I should also mention that ESET NOD32 Antivirus also blocks a website from loading everytime the computer boots. These problems obviously all go away when you unplug the internet.

I have tried multiple live CD's including Kaspersky's, Avasts scans, UBCD4Win (forget what I did in here at this point), ERD Commander (to delete the files again, still came back), I had scanned with Gmer, Rootkit Revealer, Kaspersky's TDSSKiller. I have ran Combofix. I have pulled out some of my hair.

I have spent probably 4 hours on this PC, and only because I am stubborn and the customer didn't need it back right away.

Since this I have ghosted the drive and reformatted, however because of my stubbornness I am still troubleshooting the issue on the ghosted drive.

I had setup the drive as a slave and let Gmer scan it this way and found some interesting iexplore entries that previously were not shown (ieframe.dll I believe)

Things I haven't done today which I will tomorrow:
-uninstall and delete the sound driver with driversweeper
-slap computer with fish

Have any of you seen anything of this sort before?
Does anyone have any suggestions?

 

[NYJimbo]

Might be a new variant of the audio virus that came out about a year ago. I read about it but never saw it in action.

Aint this business nothing but fun ?

 

[Joines]

Might be a new variant of the audio virus that came out about a year ago. I read about it but never saw it in action.

Aint this business nothing but fun ?

I do enjoy chasing things like this, rogue AV's are getting really obnoxious. My grand mom is going to be able to remove them soon enough.

 

[14049752]

This sounds SO cool!

Just a couple of random thoughts that are just complete stabs in the dark.

First, check out which files have been created or modified in the past week or so (or whenever it started) and dig through them to see if anything seems off.

Second, try uninstalling flash player. Reboot then see if it still plays. (Oh, and I know this doesn't solve anything...I'm just curious)

Third, I have no idea but please let us know what you find!

 

[Galdorf]

I would have tried unhackme not much can hide from it and it is extremely fast,odd though dr web live cd usually finds stuff like this also comodo internet security in most cases with proper settings would have removed this using the tools that are built in thing is comodo is still rated number one for removing malware even hak5 tested against other , i use it all the time i spend less time cleaning and more time making money so far since switching to it i had never had to do a nuke and pave.
Also threatfire might have been able to clean this alone trick is use signature and behavioral based scanners since comodo internet security is both its an all in one solution but any av+threatfire is good too.
Also ASquared free seems to find this stuff using ubcd4win with updates it should remove most rootkits has a very high detection rate.

 

[TLE]

Hi Galdorf, out of interest which version of Comodo do you use? Do you have this installed on a works PC which you use slave a customers hard drives too, or is there a live CD version? I have been looking at Comodo but haven't got round to trying it yet.

Thanks

TLE

 

[Galdorf]

Hi Galdorf, out of interest which version of Comodo do you use? Do you have this installed on a works PC which you use slave a customers hard drives too, or is there a live CD version? I have been looking at Comodo but haven't got round to trying it yet.

Thanks

TLE

Comodo internet security its free for business and personal use there is no live cd it as hips,firewall,sandbox the sandbox feature was tested against sandboxie, ect and beat them in zero day malware protection.
Most times i just install it on customers machine change settings set parental mode with password and thats is it.
I use it for emergency virus/malware cleaning i just install as above and hand pc to customer it removes all malware and viruses on its own and customer sees no popups or notifications i have done this 30 times so far no problems.
The engine was redesigned to prevent the new tdss exploits and rootkits they do alot of upgrades only problem is you have to uninstall older versions.

 

[Joines]

I would have tried unhackme not much can hide from it and it is extremely fast,odd though dr web live cd usually finds stuff like this also comodo internet security in most cases with proper settings would have removed this using the tools that are built in thing is comodo is still rated number one for removing malware even hak5 tested against other , i use it all the time i spend less time cleaning and more time making money so far since switching to it i had never had to do a nuke and pave.
Also threatfire might have been able to clean this alone trick is use signature and behavioral based scanners since comodo internet security is both its an all in one solution but any av+threatfire is good too.
Also ASquared free seems to find this stuff using ubcd4win with updates it should remove most rootkits has a very high detection rate.

Why I don't trust Unhackme:

 

[iisjman07]

^^

I don't get it, what's the problem? The software is trying to be both easy for home users and powerful for techies.

 

[Joines]

^^

I don't get it, what's the problem? The software is trying to be both easy for home users and powerful for techies.

"Probably, you are infected by a virus"


That in no way sounds weird to you?

Interesting..


Btw an update on this..

I've converted the ghosted drive to a virtual hd since it was only 23GB of data. I've been wanting to get a chance to look at it, however we had a bad storm rip through here yesterday and almost everyone was without internet for the day. Needless to say, some people don't understand that we can't fix the wires

 

[PcTek9]

I love Hitman Pro. That is AWESOME ware.

To scan a pc for bad stuff in 10 minutes is just amazing!

The way it uploads all the baddies to 'the cloud' for analysis is really cool!

I like it a lot.

 

[stevenamills]

How are you guys dealing with licensing Hitman Pro?

Thanks.....

 

[Larry Sabo]

It's a good free scanner that identifies threats. You can then use whatever to remove them, but not Hitman Pro without buying an individual license for $20 USD. Still useful.

Help Desk and Support organizations can use the Free Scan of Hitman Pro as a quick check for viruses and other malware. It can be run from USB or CD/DVD. No installation is required.

 

[Tekguy]

How are you guys dealing with licensing Hitman Pro?

Thanks.....

I emailed the creators of Hitman Pro a few months ago about getting a commercial license & never even got a response. Doesn't speak too well for their customer service.

 

[Galdorf]

At first it may seem hitman pro is a neat program but all the scanning engines are stolen from other vendors as well as using other vendor virus defs.
Basically what it does is toss the file into the cloud then servers grab file anaylse it and check for infections that is why it is so fast.
http://www.surfing-safe.com/spyware/hitmanpro.php

 

[PcTek9]

ok... i'm using internet explorer in a virtual machine on xp on linux mint next to os/2 warp. why? i dont know.

Anyway. I wanted to say that I love hitman pro. They are great awesome guys. There idea is wonderful. It STILL takes the total scan time from hours to a few minutes.

So let the cloud scan, let it scan all it wants, as long as I don't have to sit there forever. I absolutely LOVE hitman pro. I don't know why you guy's are complaining.

Anything that speeds up virus removal this much, is in my book GLORIOUS.