| View previous topic :: View next topic |
| Author |
Message |
Kevin
Guest
IP: 85.214.*.*
|
 Posted: Thu Jul 13, 2006 1:41 am Post subject: How can I remove this? |
|
|
RKR shows me :
file : C:\\windows\\system32\\sdig.sys hide from windows api
registry key : HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\sdig hide from windows api
Icesword can\'t see either the key and file.
Scan with Mcaffe, nothing found..
here is GMER log:
/===========================================
GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-07-13 09:30:15
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.10 ----
SSDT E1AD6140 ZwConnectPort
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwSetSystemPowerState
INT 0x2D \\SystemRoot\\System32\\Drivers\\DbgMsg.SYS B229AB5C
---- Devices - GMER 1.0.10 ----
Device \\FileSystem\\Ntfs \\Ntfs IRP_MJ_WRITE 82F58B60
Device \\FileSystem\\Ntfs \\Ntfs
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_CREATE 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_CLOSEIRP_MJ_READ 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_WRITE 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_QUERY_INFORMATION 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SET_INFORMATION 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_QUERY_EA 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SET_EA 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_FLUSH_BUFFERS 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_DIRECTORY_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_DEVICE_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SHUTDOWN 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_LOCK_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_CLEANUP 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_CREATE_MAILSLOT 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_QUERY_SECURITY 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SET_SECURITY 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_POWER 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SYSTEM_CONTROL 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_DEVICE_CHANGE 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_QUERY_QUOTA 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_SET_QUOTA 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_PNP 82A41328
Device \\Driver\\Cdrom \\Device\\CdRom0 IRP_MJ_PNP_POWER 82A41328
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_CLOSEIRP_MJ_READ 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_PNP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP0T0L0-3 IRP_MJ_PNP_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_CREATE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_CLOSEIRP_MJ_READ 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_WRITE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_QUERY_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SET_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_QUERY_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SET_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_FLUSH_BUFFERS 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_DIRECTORY_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SHUTDOWN 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_LOCK_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_CLEANUP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_CREATE_MAILSLOT 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_QUERY_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SET_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_DEVICE_CHANGE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_QUERY_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_SET_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_PNP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort0 IRP_MJ_PNP_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_CREATE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_CLOSEIRP_MJ_READ 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_WRITE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_QUERY_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SET_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_QUERY_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SET_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_FLUSH_BUFFERS 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_DIRECTORY_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SHUTDOWN 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_LOCK_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_CLEANUP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_CREATE_MAILSLOT 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_QUERY_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SET_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_DEVICE_CHANGE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_QUERY_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_SET_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_PNP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdePort1 IRP_MJ_PNP_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_CREATE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_CREATE_NAMED_PIPE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_CLOSEIRP_MJ_READ 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_WRITE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_QUERY_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SET_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_QUERY_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SET_EA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_FLUSH_BUFFERS 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_QUERY_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SET_VOLUME_INFORMATION 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_DIRECTORY_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_FILE_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_INTERNAL_DEVICE_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SHUTDOWN 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_LOCK_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_CLEANUP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_CREATE_MAILSLOT 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_QUERY_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SET_SECURITY 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_POWER 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SYSTEM_CONTROL 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_DEVICE_CHANGE 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_QUERY_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_SET_QUOTA 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_PNP 82C41D08
Device \\Driver\\atapi \\Device\\Ide\\IdeDeviceP1T0L0-e IRP_MJ_PNP_POWER 82C41D08
---- Modules - GMER 1.0.10 ----
Module _________ F7402000
---- EOF - GMER 1.0.10 ----
HELP!
|
|
| Back to top |
|
 |
AbuIbrahim
Security Expert
Special Response Team
Joined: Jan 18, 2006
Posts: 1930
|
| Posted: Thu Jul 13, 2006 10:41 am Post subject: |
|
|
Hello Kevin,
Welcom to Castlecops. You do indeed have a rootkit on your system. Please download and unzip the attached file into your desktop.
Then restart your computer into 'safe mode with command prompt'.
How to go to safe made:
Turn on the computer.
Immediately begin tapping the F8 key.
Use the arrow keys to highlight 'Safe Mode with Command Prompt' and press the Enter key.
make sure you logon into the same user account as when starting normaly.
Type in the each of the following command followed by an enter key.
Once done cleaning a log file will be created in the c: drive. Restart your PC normaly. Do another rootkit revealer scan.
In your next reply, please post:
1. The contents of the c:\rootkitbackup.txt
2. the results of the RKR scan
| Description: |
|
Download |
| Filename: |
cleanrootkit.zip |
| Filesize: |
473 Bytes |
| Downloaded: |
64 Time(s) |
|
|
| Back to top |
|
|
negster22
Security Expert
Premium Member
Joined: Mar 10, 2004
Posts: 5394
|
| Posted: Thu Jul 13, 2006 5:53 pm Post subject: |
|
|
Hi Kevin,
It looks like you a rootkit that exlpoited this vulnerability - the SoftICE DbgMsg.sys Driver Denial of Service Vulnerability.
http://secunia.com/advisories/15522/
| Quote: | | DbgMsg.sys driver and can be exploited via a specially crafted "int 2dh" call with an invalid debug message pointer. |
The DbgMsg.sys driver can be exploited even when it is not running - bad!
Do you have SoftICE installed?
d347bus.sys is a driver related to Daemon Tools software. Did you install Daemon Tools?
_________________
Negster22 - MS MVP - Consumer Security 2006-2008 
|
|
| Back to top |
|
|
Kevin
Guest
IP: 85.214.*.*
|
| Posted: Fri Jul 14, 2006 2:26 am Post subject: |
|
|
Thanks all of you,
I have the batch file run,after it showed me \"Cleaning completed\",I still can\'t find the c:\\rootkitbackup.txt.
RKR gives me the same result again.
I am now getting start to learn driver development, so I installed DriverStudio for using |o|
|
|
| Back to top |
|
|
Kevin
Guest
IP: 85.214.*.*
|
| Posted: Fri Jul 14, 2006 5:19 am Post subject: |
|
|
Thanks again for all your help !
Thanks Mark for recommendation of tools!
I finally remove this junk using darkspy, it shows a red kernel driver \"sdig.sys\".
The file and registry can be observed and deleted.
Cheer!
|
|
| Back to top |
|
|
negster22
Security Expert
Premium Member
Joined: Mar 10, 2004
Posts: 5394
|
| Posted: Fri Jul 14, 2006 5:08 pm Post subject: |
|
|
H Kevin,
It's nice to know DarkSpy picks up the driver.
I was going to have you "Avenge" it. I wonder if DarkSpy makes backup copies because I would like to get a sample of:
C:\windows\system32\sdig.sys
if it does.
I'll have to research that.
You should follow up by scanning with an updated AV and anti-spyware programs to remove whatever the rootkit was hiding. That payload should be exposed now.
_________________
Negster22 - MS MVP - Consumer Security 2006-2008
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
