Adlice forum

General Category => Malware removal help => Topic started by: Vediovis on January 13, 2015, 06:45:45 PM

Title: Account Hacked (Possible Rootkit); need help understanding report
Post by: Vediovis on January 13, 2015, 06:45:45 PM
So, one of my accounts got hacked. I was paranoid and I started scanning my laptop.
I ran Rogue Killer twice and both showed very different results (rebooted in between).
I am not sure what to make of it, can someone help me with it?

I have attached the logs as they were over 20000 characters and did not fit into this post.
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Curson on January 14, 2015, 11:54:44 PM
Hi Vediovis,

Welcome to Adlice.com Forum.

The first report was generated with the 32 bits version of RogueKiller, the second by the 64 bits version (the one you should be using).
Anyway, the tool wasn't able to load its driver.
Quote
¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x20]) ¤¤¤
Were any security programs running in the background when you launched RogueKiller ?

Regards.
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Vediovis on January 15, 2015, 03:17:15 PM
Hey Curson,

Thanks for the reply.
I use MalwareBytes' Anti Malware, MalwareBytes' Anti Exploit, and BitDefender.
I am not sure why the driver did not load since I had disabled all three of them.

What do you suggest?
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Curson on January 16, 2015, 03:37:25 PM
Hi Vediovis,

Please restart your computer and perform a new scan with Roguekiller.
Could you tell me if the following file is present :
Quote
C:/Windows/System32/Drivers/TrueSight.sys

Regards.
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Vediovis on January 17, 2015, 09:32:22 PM
Yes, the file is present but the restart did not help.
Any other suggestions?
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Curson on January 18, 2015, 04:42:41 PM
Hi Vediovis,

It seems that RogueKiller's driver cannot be initialized for some reasons.
The presence of a rootkit may be causing this behaviour.
Please post the contents of TDSSKiller.[Version]_[Date]_[Time]_log.txt found in your root directory (typically c:\)in your next reply.

Regards.
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Vediovis on January 19, 2015, 03:06:03 PM
The scan came out clean
I have attached the logs just in-case.

Please tell me how to proceed next?
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Curson on January 19, 2015, 04:31:34 PM
Hi Vediovis,

According to the last report your computer seems clean.
Howewer, we would like to investigate why RogueKiller's driver was unable to load.

Could you please manually delete the file TrueSight.sys and make a last try with RogueKiller ?

Regards.
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Vediovis on January 20, 2015, 10:55:42 PM
Seems like the driver loaded fine this time I have attached the log as there were other errors.

The anti-rootkit section showed some files (link to image) - http://i.imgur.com/E8hxjNX.png
Title: Re: Account Hacked (Possible Rootkit); need help understanding report
Post by: Curson on January 20, 2015, 11:16:07 PM
Hi Vediovis,

Yes, the driver managed to load and the tool reported no infection.
The lines which are highlighted in green in the Rootkit section are legit elements which should not be removed.
Your computer seems clean.

If you have any questions, feel free to ask.
Regards.