Lets chat about .... ROOTKITS !!

[WalkinTarget]

Got a customer PC over the weekend that they simply wanted Itunes installed on. Wow, an easy one I'm thinking. I start the install and it locks up the PC.

Skip forward to several scans using everything I've got, and I finally get around to scanning for a rootkit. OOPS ... well, there it is, hiding in the Windows/Temp folder with several $dgb3 or similar filenames in there, along with some perflibxx.dat files that appear to be prefetch data for the bad stuff stored elsewhere.

ComboFix found it and said it deleted it, but it was right back when I restarted. MalwareBytes the same thing. I tried a product from McAfee and Sophos with the same results.

My S.O.P. for these is nuke it from orbit, but the customer doesn't want to do that, so is there ANYTHING that you guys have used that can effectively deal with a rootkit ?? I doubt there is, but I have few options. I'm going to try and talk them into wiping it and I'll use the Easy Transfer wizard to back up what I can.

[{CLR} ObiTroy]

Wow, that sounds nasty. You've already tried malwarebytes so I don't have anything to recommend.

[K PhaNTOM]

One option, always, NUKE IT.

[WalkinTarget]

Ya, there is no option to safely guarantee its removal at this point. Gonna call the customer and convince him we NEED to nuke it.

I don't like even working on rootkitted PCs on my home network ... makes me very paranoid, but at least I'm smart enough to password any file shares or access, so it won't be spreading around.

Thumb drives tho .... that's another story altogether.

[mapes]

What about hijackthis and removing everything?

[WalkinTarget]

What about hijackthis and removing everything?

If MalwareBytes or ComboFix can't remove it permanently, HJT is not gonna do the trick. The thing has several hooks and hidden system calls to replace the .DLL files that I remove after a reboot, and in my experience this is wasted effort when I can run the Win7 Easy Transfer Wizard to back up their data, then blow away all partitions and format that b*tch.

[DougBob]

Honestly, you've done the appropriate level of effort.
I don't know who the customer is, but, your the knowledgeable one.
Explain to the customer the proper way to store important data they don't wish to lose (on removable/external media) due to such instances. Also elaborate on why it's so important in this day in technology due to how volatile computer data has become with the infection risk with today's computers.
Then create an image of the machine, ghost, etc.
Finally NUKE IT!!!!!!!!!!!!!!!!!!!

[{CLR} Cobalt]

Take notes boys. There are inerrant risks at downloading pron.

[Apache Warrior]

If he will not let you "Nuke It", give him back his computer and let someone else fight with him. Especially since you were only going to install Itunes.
Apache

[WalkinTarget]

OOPSIE, I did an oopsie ... is that redundant ?? I backed up the PC using Easy Transfer wizard and when I go to plug in the external drive and run it on the 'new' PC, it only lists it as the OLD PC.

I swear I have done this in the past ... back up an XP PC using this utility, then reload the profiles using the freshly loaded OS as the 'new' PC.

So now I hafta either set up a Vista box or Win7 box, load the savedata.mig file containing their 22+gb of data and then copy that (manually ?) onto the old WIN XP box ... this is turning into a total clusterf ....

[mapes]

If MalwareBytes or ComboFix can't remove it permanently, HJT is not gonna do the trick. The thing has several hooks and hidden system calls to replace the .DLL files that I remove after a reboot, and in my experience this is wasted effort when I can run the Win7 Easy Transfer Wizard to back up their data, then blow away all partitions and format that b*tch.

I ran into something like this. I timed the creation of the file and registry keys. I delete the file and registry keys and pulled the plug on the system. Worked for me.

[WalkinTarget]

Skipped the tedious migration onto a Vista/Win7 box and found a handy tool named MigrationRecovery from MS that extracts the .MIG file into its original directory structure.

Then its just a matter of adding accounts to the customer PC to match what was there and copying the relevant files/folders into each account on the PC once the migrecover.exe finishes its task.

So many other things I could be going with my free time !!

[Apache Warrior]

Your time should not be free.
Apache

[WalkinTarget]

Your time should not be free.
Apache

Ohh, trust me, I am getting paid for the work, but my rates are too low.Standard flat rate for malware removal is $40, and for an OS reload its $50. I should raise both at least $10 and it'd make it somewhat more worthwhile.