Author Topic: Tr.gootkit + Proc.svchost  (Read 10247 times)

0 Members and 2 Guests are viewing this topic.

March 02, 2015, 10:46:30 am

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Tr.gootkit + Proc.svchost
« on: March 02, 2015, 10:46:30 am »
Hello,
I just cannot get rid of Tr.gootkit and Proc.svchost on a customer's server. I have been working on it for weeks. Roguekiller removes it fine, but after a couple of hours it is already back and detected again.  :-\
- Server Windows 2003 + SP2 with Terminal Services installed.
- Symantec Endpoint Protection v12 installed as a client. A full scan does not detect anything wrong (fileless infection).
- attached: roguekiller last reports (this morning and last friday)

I tried to follow these instructions:
http://malwaretips.com/blogs/svchost-exe-virus-removal/
- Eset find and removes the infection, but it keeps on coming back (same as roguekiller)
- MalwareBytes hangs during pre-scan ("SDKDatabaseLoadDefaults failed with code: 2")

There are actually about 15 users working daily on this server, so re-installing the OS would be my last choice indeed.
Is there anything I can do to prevent this infection from coming back, and finaly solve this problem?
Please let me know if you need any futrher information.

Thanks for your help

Reply #1March 02, 2015, 06:53:32 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #1 on: March 02, 2015, 06:53:32 pm »
Hi mist63,

Please follow the following process as close as possible.

1. Suspicious files uploading

Could you please upload the following files on a cloud (Google Drive, Dropbox, ...)
Quote
C:\windows\reboot1.bat
C:\windows\reboot2.bat
C:\windows\reboot3.bat
C:\windows\reboot4.bat
C:\windows\reboot5.bat
C:\WINDOWS\DelTemp.bat
Make sure it's public and paste the link in your next reply.

2. TDSSKiller
  • Please download TDSSKiller and save it to your Desktop.
  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.



  • Check Loaded Modules and Detect TDLFS file system
  • If you are asked to reboot because an "Extended Monitoring Driver is required" please click Reboot now.



  • Click Start Scan and allow the scan process to run.
    If threats are detected select Skip for all of them unless I instruct you otherwise.
  • Click Continue



  • Click Reboot computer
Please post the contents of TDSSKiller.[Version]_[Date]_[Time]_log.txt found in your root directory (typically C:\) in your next reply.

Regards.

Reply #2March 03, 2015, 06:21:35 pm

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #2 on: March 03, 2015, 06:21:35 pm »
Hi Curson,

Thanks for your reply.
1. These 6 bat files were all created by myself...
- reboot1.bat to reboot5.bat are running NTBackup.exe in order to backup the server datas every day (from monday to friday).
- deltemp.bat runs icsweep utility in order to clean the users TEMP and temporary internet files folders every night.
I use these 6 files as scheduled tasks. Is there still any need to upload them?

2. TDSSKILLER
I ran it and followed your process but it did not find any threat.
Please find attached the log file.

Best regards

Reply #3March 03, 2015, 06:42:46 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #3 on: March 03, 2015, 06:42:46 pm »
Hi mist63,

No, since you created them yourself, you don't have to upload the scripts.
Could you please download RogueKiller latest version (currently 10.5.0), scan the server with option -nokill and copy/paste the report obtained in your next reply ?

EDIT : Is the OS up-to-date ?

Best regards.
« Last Edit: March 03, 2015, 06:44:58 pm by Curson »

Reply #4March 04, 2015, 09:33:58 am

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #4 on: March 04, 2015, 09:33:58 am »
Hi Curson,

Yes the OS is Up to Date, I checked Microsoft Update this morning.

Please find attached the last RK 10.5 report. It seems fine to me, what do you think?
Except Symantec false positive submitted already. But no more traces of tr.gootkit or proc.svchost... I hope it will not come back.

Regards

Reply #5March 04, 2015, 09:20:52 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #5 on: March 04, 2015, 09:20:52 pm »
Hi mist63,

Indeed, the infection seems to be no longer present on your system.
I suggest you to wait some days to see if the infection is present again.

Regards.

Reply #6March 05, 2015, 09:38:41 am

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #6 on: March 05, 2015, 09:38:41 am »
Hi Curson,

FYI I had a look this morning and ran a roguekiller -nokill scan: it is still clean.
I will wait some days as you say to make sure it does not come back.

Thanks a lot for your help
Have a nice day

Reply #7March 05, 2015, 06:18:40 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #7 on: March 05, 2015, 06:18:40 pm »
Hi mist63,

I'm glad to hear this good new.  :)
Keep me informed.

Regards.

Reply #8March 16, 2015, 03:43:50 pm

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #8 on: March 16, 2015, 03:43:50 pm »
Hello,

I'm afraid it's back again. The customer told me this morning they have some trouble for a few days. They just "forgot" to tell me about it...

I ran roguekiller and eset poweliks: still the same problem. When  I run TDSSkiller with "loaded modules" option checked, I have to restart the server. Once it's restarted I got the attached message at startup when I log in.
Tried that this morning, seemed fine for a moment, but it was back in the afternoon.  :(

Any clue to get rid of this for good?
Thanks

« Last Edit: March 16, 2015, 04:07:47 pm by mist63 »

Reply #9March 16, 2015, 07:16:43 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #9 on: March 16, 2015, 07:16:43 pm »
Hi mist63,

TDSSKiller didn't detect anything.
Gootkit propagation is made possible by interaction with Exploit Kits. I believe there is an out-of-date software running on the server which is used to reinstall the infection as soon we remove it.

Moreover, Windows firewall is disabled which render useless any network monitoring.
Quote
08:30:19.0609 0x1484  Win FW state via NFM: disabled

I suggest you to disconnect the server off the network, remove the infection with RogueKiller and review all the softwares installed on the server to found the culprit.
Another way is to install and configure Enhanced Mitigation Experience Toolkit (EMET) and hope it helps mitigating the vulnerability used to infect the server again and again.

Please keep me informed.

Regards.

Reply #10April 17, 2015, 09:37:36 am

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #10 on: April 17, 2015, 09:37:36 am »
Hi Curson,

Thanks for your help and sorry not coming back to you earlier. I was stuck with other matters.
I'm afraid the problem is still there. I could not find the culprit, neither could I disconnect the server off the network, because I'm not at the place where the server is (remote connexion).
I tried to install EMET, but it asks me for .NET Framework 4.0 and I cannot download it (white screen in IE or Firefox when I try). I cannot run Microsoft Update either: white screen.

Maybe Windows 2003 IS the culprit?  :-\
Probably the best solution would be to reinstall this server, though I have no time for this at the moment.

I'll have another try and I'll let you know.

Regards

Reply #11April 17, 2015, 12:13:20 pm

mist63

  • Newbie

  • Offline
  • *

  • 12
  • Reputation:
    0
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #11 on: April 17, 2015, 12:13:20 pm »
I ran roguekiller without "nokill" option, and then I could use Windows update again. I installed .net Framework 4.0 whitout any trouble. Then it found and installed 27 updates... Maybe this will be helpful to prevent the virus coming back? I'll let you know... need to restart the server 1st.

Reply #12April 21, 2015, 10:37:31 pm

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2580
  • Reputation:
    97
    • View Profile
Re: Tr.gootkit + Proc.svchost
« Reply #12 on: April 21, 2015, 10:37:31 pm »
Hi mist63,

Could you please download RogueKiller latest version and do a fresh scan ?
Anyway, since Windows Server 2003 EOL date is July 14, 2015, I suggests you to take time to plan a migration to a more recent of Windows as early as possible.  ;)

Regards.