Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There is a rogue program on a computer that seems to launch as an alternative data stream. It shows up in Task Manager as number: number.exe, and can't be killed. I can delete the main file, but the program is still running. I have tried deleting the program in Linux as well, but the program keeps running. Any other ideas for removal?

It also seems to hook to the Operating System, and look at file names to delete ones it doesn't like, like Malwarebytes Anti-Malware (mbam.exe) and Microsoft Security Essentials

share|improve this question
1  
See my post here....superuser.com/questions/100360/… –  Moab Oct 7 '11 at 3:23
    
@Moab Sorry, but MSS didn't work. Going to try some other things in your post –  Canadian Luke Oct 7 '11 at 18:51
    
It found 12 things, and it looked like it pulled it out... But once I rebooted, about 30 seconds later it started acting up again :( –  Canadian Luke Oct 7 '11 at 21:25
    
Sorry everyone, but the time limit has been reached for our shop, so I had to reformat it. I appreciate all the help that you gave though, and up-voted accordingly –  Canadian Luke Oct 7 '11 at 22:35
    
Anyone have any other tips? –  Canadian Luke Dec 16 '11 at 18:07
show 5 more comments

3 Answers

I've also tried with MSS and no luck. The file was stil there.

However I've managed to solve it with ESET SysRescue CD. It found the resulting file (number:number.exe) and two others:

c:\windows\system32\c_15523.nl_
c:\windows\system32\drivers\mrxsmb.sys

After deleting these files, the problem went away. I still need to do some testing but hopefully it will stay this way.

share|improve this answer
    
I'm downloading eNod right not to try making a boot CD, then I'll scan and try. If it works, you get the extra reputation! –  Canadian Luke Oct 15 '11 at 22:55
    
Tried this, it found the virus but now Windows won't boot. BSOD with error 0x0000007e –  Canadian Luke Oct 17 '11 at 20:02
    
In which file did it find the virus? I had to put the missing file back from the backup from the recovery console. As specially mrxsmb.sys. –  Marko Oct 18 '11 at 17:52
    
The virus itself, and the cdrom.sys file. I tried replacing just that file, but the 7e still came up. I'm trying a Repair install right now, and will post results –  Canadian Luke Oct 18 '11 at 18:25
add comment

Thanks for posting all this knowledge people, I've been working in a PC shop for a few months and been working on computers since they began and never encountered such an annoying rootkit. If you start in safe mode, run TDSSkiller, then ComboFix, then TDSSkiller again upon restart, then Malwarebytes, then something conventional like AVG, you should be able to clean it once and for all. It really attaches itself to the registry and keeps recreating fake invisible 0k versions of itself in your C:\Windows directory, typically. I've seen probably 5-10 PC's come into our shop in the last two weeks and I've only successfully cleaned one; the other's all needed fresh Windows which fixed it.

It seems running the right antivirus in the right order can finish it off, but for the time and difficulty it takes, you might as well reinstall Wind. Anyway, thanks again for your info on the number:number.exe pain in the rear. I'll come back and reply if we ever track down a definite fix! -Seldomane

share|improve this answer
    
Thanks for the heads up. I encountered this nasty beast on a friends machine, and after a number of attempts to pull it out failed, TDSSkiller + ComboFix in safe mode & ComboFix again on reboot managed to fix it. –  robjb Nov 14 '11 at 15:19
add comment

Try booting into Safe Mode. Is it still there? Scan your computer with a clean copy of an antivirus software. (preferably downloaded from the internet while you are in Safe Mode).
If it detects it as a known malware, then it should take care of it. Otherwise, even if it doesn't detect it, try re-deleting the file and then restart and see if it is still running.

EDIT: never mind, if it hooks the OS even Safe Mode won't do anything. The only thing left to do is either use a rootkit scanning tool (such as Vice) or completely reimage with a clean copy of Windows.

Another thing you can try is to boot into a Live CD of one of the various versions of Linux to delete the file, because the reason that you can't delete it now is (most likely) because of OS hooks, so it can detect when it is deleted and restore itself.

share|improve this answer
    
Same effects in safe mode. I created a text file called mbam.exe and it immediately attached to it. It's definitely a rootkit and I'm going to try Microsoft System Sweeper tomorrow –  Canadian Luke Oct 7 '11 at 5:20
    
@Luke Do you have any other computers (preferably Linux)? If you do, you could attach the HD into that system and delete the files from there. Otherwise, (if SystemSweeper doesn't work) you could use a Live CD or floppy to boot another OS to erase the file. If even that doesn't work, it's time to reimage with a new copy of Windows. Good luck with the scanner! –  Nate Koppenhaver Oct 7 '11 at 20:13
    
MSS didn't fix it :( It removed 12 items, but the virus came back almost right away. I have scanned it on two other machines we use for virus scanning, adn they remove multiple things as well, but the virus is still there somewhere –  Canadian Luke Oct 7 '11 at 21:26
add comment

protected by Community Oct 13 '11 at 19:08

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.