Expert: Brian Benosky - 9/1/2008

Question
Hi Brian
Please could you help me in the below problem?
My ESET smart security warn for and is unable to remove at operating memory the Win32/Mebroot.

Thank you
Alex

Below is the GMER & HijackThis log

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-09-01 16:03:22
Windows 5.1.2600 Service Pack 2


---- Disk sectors - GMER 1.0.14 ----

Disk            \Device\Harddisk0\DR0               sector 00: rootkit-like behavior; MBR rootkit code detected                      <-- ROOTKIT !!!
Disk            \Device\Harddisk0\DR0               sector 32: rootkit-like behavior;
Disk            \Device\Harddisk0\DR0               sector 33: rootkit-like behavior;
Disk            \Device\Harddisk0\DR0               sector 60: rootkit-like behavior;
Disk            \Device\Harddisk0\DR0               sector 61: rootkit-like behavior; malicious code @ sector 0x995c69a size 0x1a8
Disk            \Device\Harddisk0\DR0               sector 62: rootkit-like behavior; copy of MBR

---- System - GMER 1.0.14 ----

SSDT            d347bus.sys (PnP BIOS Extension/ )  ZwEnumerateKey [0xF86312A8]
SSDT            d347bus.sys (PnP BIOS Extension/ )  ZwEnumerateValueKey [0xF863C910]

---- Devices - GMER 1.0.14 ----

Device          \FileSystem\Ntfs \Ntfs              83388948

AttachedDevice  \FileSystem\Ntfs \Ntfs              InCDrec.SYS (InCD File System Recognizer/Nero AG)
AttachedDevice  \FileSystem\Ntfs \Ntfs              82A2ECF0
AttachedDevice  \FileSystem\Ntfs \Ntfs              eamon.sys (Amon monitor/ESET)

Device          \FileSystem\Fastfat \Fat            831EACD0

AttachedDevice  \FileSystem\Fastfat \Fat            InCDrec.SYS (InCD File System Recognizer/Nero AG)
AttachedDevice  \FileSystem\Fastfat \Fat            82A2ECF0
AttachedDevice  \FileSystem\Fastfat \Fat            eamon.sys (Amon monitor/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\Ip            epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp           epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Udp           epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\RawIp         epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

---- Modules - GMER 1.0.14 ----

Module          _________                           F8593000-F85AB000 (98304 bytes)

---- Threads - GMER 1.0.14 ----

Thread          4:1348                              827E133C
Thread          4:1384                              827E376C
Thread          4:1388                              827DC860
Thread          4:1392                              827E168A
Thread          4:1404                              82813CC0
Thread          4:1408                              82800DC0
Thread          4:1424                              828375A0
Thread          4:1436                              827ECE40
Thread          4:1552                              827E146E
Thread          4:1592                              827DC3C4
Thread          4:1652                              827DC3C4
Thread          4:1900                              82813CC0
Thread          4:1904                              82800DC0
Thread          4:1916                              828375A0
Thread          4:1920                              827ECE40

---- EOF - GMER 1.0.14 ----

*****************************************************


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:07 μμ, on 1/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Documents and Settings\Sousana\Desktop\utorrent.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\WinFax\WFXSWTCH.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www-proxy.spidernet.net:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*.*;www.i-choice.com.cy;www.spideradsl.com;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - C:\Program Files\Systran\4_0\Premium\IEPlugIn.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVGOA1~1\TVGOA1~1\TVTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O4 - HKCU\..\Run: [µTorrent] "C:\Documents and Settings\Sousana\Desktop\utorrent.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Controller.LNK = C:\Program Files\WinFax\WFXCTL32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_...
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://81.186.166.196/activex/AMC.cab
O20 - Winlogon Notify: routew - C:\WINDOWS\
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

--
End of file - 6351 bytes


Answer
Hi Alex

You will need to repair the MBR using Windows Recovery Console.  For information on how to use it, please see the link below:

http://support.microsoft.com/kb/314058

Once inside the console, use the command fixmbr.  After completion, use the command fixboot.
After rebooting normally, run another ESET scan and let me know the results.

Brian