Rootkit.Agent: ntndis.sys & ipsecndis.sys (page 2)

TAGScorpioN · 2010-08-07T07:23:24+00:00

Malwarebytes found two rootkit agents on my computer which it can't remove: C:\WINDOWS\system32\ipsecndis.sys and C:\WINDOWS\system32\Drivers\ntndis.sys Below are the the hijackthis.log and the uninstall_list.txt Below that is a third log from combofix I had run before, a moderator closed my old topic for using this and told me to make this new post but to include the combofix log as well. Please help! HijackThis log: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 09:11:28, on 8/7/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20583) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Avast\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4.exe E:\ASUS\AI Suite\AiNap\AiNap.exe C:\WINDOWS\system32\ct

August 14, 2010, 4:07 PM UTC

Thank you very much for your reply. Thanks to your instructions on the Java update I noticed I three(!!) redundant versions installed gobbling up valuable space on my c:\ drive. Feels like my PC is getting a complete overhaul ;-)

Here's the OTL log:

========== FILES ==========
File\Folder F:\Games\PC\F.E.A.R\update\crack\FEAR.exe moved successfully.
F:\Programs\BSPlayer Pro v2.28.964 Multilanguage - Incl. Key\BS.Player.Pro.v2.28.964.exe moved successfully.
F:\Programs\BSPlayer Pro v2.28.964 Multilanguage - Incl. Key\BSPlayer Pro v2.28.964 Multilanguage - Incl. Key.rar moved successfully.
F:\Programs\daemon408-x86.exe moved successfully.
F:\Programs\rexbackup file system settings\BR-070721-00\BR-070721-00.exe moved successfully.
F:\Schijf dump\laptop\Software Download\Programs\CleanMyPC_Registry_Cleaner_v2[1].16.zip moved successfully.
F:\Schijf dump\laptop\Software Download\Programs\daemon408-x86.exe moved successfully.
F:\Schijf dump\laptop\Software Download\Programs\FlashFXP.3.0.Cracked-EQUiNOX.(Zekond-Torrent).zip moved successfully.
G:\CFA\ExamForce.CFA.Institute.CFA.2006.Level.I.CramMaster.v1.6-RBS.zip moved successfully.
G:\CFA\Exams\ExamForce.CFA.Institute.CFA.2007.Level.I.CramMaster.v1.4-RBS.zip moved successfully.

OTL by OldTimer - Version 3.2.9.1 log created on 08142010_170956

August 14, 2010, 4:13 PM UTC

Hi TAGScorpioN,

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure

Remove GMER

Delete the GMER icon from your desktop, it will be named cnklsmcv.exe

Uninstall ComboFix

Click START then RUN
Now type Combofix /Uninstall in the runbox and click OK

Clean up with OTL

Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CleanUp! button
Say Yes to the prompt and then allow the program to reboot your computer.

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!