Troj/Rustok-N Browser Redirecting and Crashing/Sites Unacces

[Realtalkrobert]

I couldn't find this option "Check Show the contents of system directories" But I did everything else and couldn't find the files.

GMER LOG:

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-30 23:44:29
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.14 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x8CAE6AD8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcConnectPort [0x8CAE7982]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcCreatePort [0x8CAE6F0C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0x8CAE5E8E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0x8CAE6694]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0x8CAE5BE8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0x8CAE64EA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x8CAE6CBE]
SSDT 92AEE40C ZwCreateThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwDuplicateObject [0x8CAE5520]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0x8CAE7604]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0x8CAE60D4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0x8CAE68CC]
SSDT 92AEE3F8 ZwOpenProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0x8CAE6364]
SSDT 92AEE3FD ZwOpenThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x8CAE5D06]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0x8CAE73BC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0x8CAE77B2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0x8CAE606E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0x8CAE6258]
SSDT 92AEE407 ZwTerminateProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0x8CAE5980]
SSDT 92AEE402 ZwWriteVirtualMemory
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThreadEx [0x8CAE7018]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateUserProcess [0x8CAE7C12]

---- Kernel code sections - GMER 1.0.14 ----

.text ntkrnlpa.exe!KeSetTimerEx + 34C 81CBE910 4 Bytes [ D8, 6A, AE, 8C ]
.text ntkrnlpa.exe!KeSetTimerEx + 370 81CBE934 8 Bytes [ 82, 79, AE, 8C, 0C, 6F, AE, ... ]
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 81CBE9B8 4 Bytes [ 8E, 5E, AE, 8C ]
.text ntkrnlpa.exe!KeSetTimerEx + 40C 81CBE9D0 4 Bytes [ 94, 66, AE, 8C ]
.text ntkrnlpa.exe!KeSetTimerEx + 438 81CBE9FC 4 Bytes CALL 4358985C
.text ...

---- Devices - GMER 1.0.14 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\tdx \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

---- EOF - GMER 1.0.14 ----




Hijack This:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:08 PM, on 1/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... io&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... io&pf=cnnb
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 3080 bytes




Uninstall List:



2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Activation Assistant for the 2007 Microsoft Office suites
Adobe AIR
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 8.1.3
Adobe Shockwave Player
Atheros Driver Installation Program
Avira AntiVir Personal - Free Antivirus
CCleaner (remove only)
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
COMODO Internet Security
COMODO SafeSurf
Compatibility Pack for the 2007 Office system
Conexant HD Audio
CyberLink DVD Suite
ESU for Microsoft Vista
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.7
HP Help and Support
HP Photosmart Essential 2.5
HP Quick Launch Buttons 6.40 F1
HP Smart Web Printing
HP Total Care Advisor
HP Update
HP User Guides 0121
HP Wireless Assistant
HPNetworkAssistant
HPTCSSetup
HyperCam 2
Intel(R) Graphics Media Accelerator Driver
Java(TM) 6 Update 11
Java(TM) 6 Update 5
LabelPrint
Malwarebytes' Anti-Malware
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual Basic 6.0 Professional Edition
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.53
Microsoft Works
Mozilla Firefox (3.0.5)
MSDN Library - Visual Studio 6.0a
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 6.1
My HP Games
NetWaiting
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.6
Realtek 8169 8168 8101E 8102E Ethernet Driver
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Skype™ 3.8
Synaptics Pointing Device Driver
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Office 2007 (KB946691)
Viewpoint Media Player
Windows Live Sign-in Assistant
Windows Media Player Firefox Plugin
WinRAR archiver



Kaspersky Log:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, January 31, 2009
Operating System: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, January 31, 2009 15:15:50
Records in database: 1732709
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 119610
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:10:37

No malware has been detected. The scan area is clean.

The selected area was scanned.

[Odd dude]

This looks great - The Avenger cleaned up everything, including the rootkit!

Now let's see how bad the infection was.

Go to VirScan.org. This site is similar to Jotti's, except this can also scan password-protected archives. This is required, as The Avenger protects the backup zip with a password to prevent 'accidents'.

Click Browse (near the top of the page) and go here: C:\Avenger\backup.zip
Then click Upload

Copy and paste the results here.

Update your Adobe Reader
Your version of Adobe Reader is old and may contain security leaks. Please first uninstall the older version, then download and install the newest version from here.

Uninstall this as well: Java(TM) 6 Update 5
You already have the latest version

In your next post, copy and paste the results from VirScan.

[Realtalkrobert]

This is what I got when I tried to upload the file:

ERROR: Decompress file size is over 20Mb (system limit)

[Odd dude]

Sorry, I forgot the folder's contents would be in there as well.

Use Windows Explorer to open this file: C:\Avenger\backup.zip (password: infected)

Drag these two files to your desktop:
gaopdxrslepfyb.sys
gaopdxtracvkux.dll
(The documentation on Avenger is a bit unclear on whether the files are stored just inside the zip or if they are inside a folder structure that resembles your drive. This means the files may also be inside a subfolder of the archive like c\windows\system32\drivers - as that was their original location)

Right click them and choose Send To > Compressed folder (zip)

Then delete them and empty recycle bin.

Upload the newly created zipfile to VirScan.

[Realtalkrobert]

Why do you keep stating that those files are in my system? Because I can never find them. You stated to open the C:\avenger\backup.zip with windows explorer but I don't really know what you meant by "windows explorer" so I thought you meant to say open it up with internet explorer so I did. Keep in mind the default program to open up zip files for me is winrar. Well I opened it up with internet explorer and the browser kept flashing on and off so I had to pull the plug on my computer. I'm sorry if I not computer savvy enough to understand what you're trying to make me do. Besides, when I tried to find those files in backup.zip, it didn't even require me to put in a password so I don't know what you're talking about.

[Odd dude]

I understand how complicated these steps are, and I am sorry for the unclarity, that is all my fault. By "Windows Explorer" I meant "My Computer" on your desktop.

I understand this is incredibly difficult, but I would like to give it one last shot.

We can also skip this whole thing, if you wish. The logs are clean and I can remove the tools and post prevention tips next, but without performing these steps we won't know how bad the infection you had was.

I'll try to describe as accurately as possible what needs to be done - I understand how hard these things are.

1.Double click My Computer on your desktop
2.Double click Local Disc (C:) (the name may be a bit different, look for C:)
3.Double click the folder named Avenger
4.Double click the file named backup.zip. WinRAR will open.
5.Now here comes the bad part: I don't know exactly where in the zip file the files we're looking for are located. The Avenger documentation is not clear on that. The files we need may just be sitting right in the zip file, but it is also a possibility they are in a directory structure inside the zip which resembles their previous location. This previous location was: \windows\system32\drivers.
Bottom line: poke around in the archive and see if you can find these:
gaopdxrslepfyb.sys
gaopdxtracvkux.dll
6.If you found them, drag them to your desktop. At this point, you should be prompted for the password - infected
7.Use WinRAR to put them in a zip file. (If you installed WinRAR with the default options you can select them one by one (click the first one, press the CTRL key and press the next one) and then right click them and choose Add to archive)
8.Upload the zip to VirScan.org

Alternatively, you may choose to just not do this. I understand this is very hard for you, and that it may be frustrating to keep looking for things you can't find. If you skip this steps, it won't affect the current state of your system, however we won't know how bad the infection has been. If you do any important stuff on this PC such as online banking it is important to know, because if this infection was an infostealer you'll need to take action.

[Realtalkrobert]

Is it possible that those files are not in that avenger folder? Maybe it was removed with another program? I've deeply searched that file many times and haven't found anything close to it. If it's a possibility that it's just not in there then I think I'll take the chance of not knowing how bad it was. I just want to know that I'm completely 100% clean. And I haven't been doing any online banking. I may have checked my balance but I never typed in any credit card info.

Plus, I think I hence a little sarcasm in your post so we should just let it ride. As I know you're tired of this also.

[Odd dude]

Is it possible that those files are not in that avenger folder? Maybe it was removed with another program? I've deeply searched that file many times and haven't found anything close to it. If it's a possibility that it's just not in there then I think I'll take the chance of not knowing how bad it was.

Well, if you can't find it after so many tries I think I'll have to allow the possibility that *something* happened and removed it. If you don't use the computer for anything sensitive, I too conclude that there is little point in continuing "chasing ghosts".

I'm pleased to inform you that the latest logs you posted all were clean!

Let's first clean up the tools we used - they're too powerful to be left around.

Uninstall ComboFix

• Disable all your antimalware programs like you did previously
• Click Start > Run and enter:
  

  Code: Select all

  ComboFix /u

• Click OK
• ComboFix will now uninstall itself, automatically reverting some settings we changed to what they are supposed to be

Click Start > Run and enter:

Code: Select all

gmer_uninstall

Then click OK.
That should uninstall GMER. The main executable will be left over, you can just delete it.

You can also delete the avenger executable and the C:\Avenger folder.

Next, tips to prevent you from reinfection:

• Turn on Automatic Updates if you have not done so. It is MANDATORY to keep your Windows updated, otherwise you are vulnerable to exploits! To turn on Automatic Updates: click Start > Control Panel > Security Centre > Automatic Updates.

Below are optional items. It's highly recommended to read them through, but decide for yourself how many of these recommendations (if any) you follow.

• Install WinPatrol from here. Instructions for use are here.
  
  
• Install SpywareBlaster to protect you from bad sites. Download - How to use it

Please reply to this thread once more so we know it can be archived

Happy surfing!!

[Realtalkrobert]

Archive it. Thank you.

[Odd dude]

Any time

[askey127]

RealTalkRobert, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.