Symptoms

For a couple weeks, from time to time, the Windows XP SP3 PC is freezing and the user is being bumped out of programs.

From time to time, Symantec.cloud reports it has “Blocked” a “High-Risk Intrusion Detected” (Once on my bench, I figured out it was, twice, every time the user logs in.)

Task Manager shows a svchost.exe is leaking memory

First actions

Check Symantec Health, Update and Full Scan – No items found, analyze history

MSCONFIG – nothing unusual is listed

System Restore back a month– Did not help

Thoughts

The Symantec warning is really just reporting that it is doing its job. (Hmm, but inbound web traffic is always a response to an outbound request.) Plus, now it’s repeatable each time the user logs on. The memory leak could be one of a half dozen Windows issues, not to mention, an indication of a virus. The memory leak could be causing the performance issues… err. A couple weeks ago, Symantec reports that it found, blocked and removed “A program that was behaving suspiciously.” OK. I am going to look for malware until that memory leak and inbound “Block” go away.

I will use all free utilities and software, here…

My approach

Process Explorer – short of the leak, all looks normal

Hijackthis – looks ok

Internet Explorer – Restore Default settings and Delete all personal settings and data. Empty recycle bin

Run Disk Cleanup – select all options. helps to increase speed of scans

Eset Online Scan – would not run

TrendMicro HouseCall – 2 items removed. issue continues

Malwarebytes – 55 items removed. issue continues

SpyBot – 1 item removed. issue continues

Windows Update fails

More thoughts

OK. I am pretty sure this is a virus, but nothing is detecting/killing it. I am about four hours in and know I could just Format, reinstall everything and configure in less than eight. Other than the memory leak, the system is pretty stable. And Windows hasn’t really been “broken”. If stuff like System Restore, Task Manager and Control Panel were not working, I would Format… But what the heck, I think I can fix this. I will look for another couple hours.

Next actions

Created a new Local Admin and logged in to see if bad guy was associated with user’s profile – No help

GMER – identified Rootkit TLD4 Gotcha, sucka!

Use Symantec Backdoor.Tidserv Removal Tool (FixTDSS.exe) to remove rootkit – Successful! Run again, and it is gone! No more memory leak! No more Symantec alerts!

System Restore – Disable System Restore, then re-enable to clean out any possibility of anyone else restoring the malware

Windows Updates installed. And Updates and Updates until there are no more…

System File Checker – Go to Start, then to Run, and type in “SFC.EXE /SCANNOW”

Run Windows Update again – no new items found

Ccleaner Free – re-run until no items found

Ad-Aware Free – no items found. Remove Ad Aware

Run catchme.exe – no items found

Run mbr.exe – no items found

Run Power Eraser within Symantec Endpoint Protection Support Tool – no probs

Check the health of Symantec software with Symantec Endpoint Protection Support Tool – all good

System Restore – Create a good restore point

Run Hijackthis and compare – rootkit doesn’t appear before or after…

Deliver to user

Have her change her system password and any other passwords she has used in her recent web travels on this machine!

Rootkit Defined -from Wikipedia

A rootkit is a stealthy type of malicious software (malware) designed to hide the existence of certain processes or programs from normal methods of detection and enables continued privileged access to a computer.

Typically, an attacker installs a rootkit on a computer after first obtaining root-level access by exploiting a known vulnerability. Once a rootkit is installed, it allows an attacker to mask the ongoing intrusion and maintain privileged access to the computer by circumventing normal authentication and authorization mechanisms. Although rootkits can serve a variety of ends, they have gained notoriety primarily as malware, hiding applications that misappropriate computing resources or steal passwords without the knowledge of administrators and users of affected systems. Rootkits can target firmware, a hypervisor, the kernel, or—most commonly—user-mode applications.

Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. Detection methods include using an alternative, trusted operating system; behavioral-based methods; signature scanning; difference scanning; and memory dump analysis. Removal can be complicated or practically impossible, especially in cases where the rootkit resides in the kernel; reinstallation of the operating system may be the only available solution to the problem.

Rootkit, kicked your ass!

I really like the Right Click menu additions:

And handles lots of format choices.

Download 7-Zip Free ZIP Utility

If you have a lost partition or strange problem with your hard disk partitions, run TestDisk to recover your data. TestDisk can also undelete files from FAT, NTFS, exFAT and ext2 filesystem.To recover your lost digital pictures or lost files, try PhotoRec.

Password recovery

BIOS setup can be password protected. You can get back your password with CmosPwd.
(Personally, I would go for the password reset jumper.)

Thank you www.cgsecurity.org

thank you MaximumPC

RIP Steve Jobs

After you install MS11-021 and the Office File Validation (OFV) Add-in for Office 2003 (KB 2501584), workbooks stored in a network location open slower over the network in Excel 2003 than they did without the OFV installed. The decrease in performance depends on the size of the workbook and bandwidth of the network and in some scenarios can seem to hang Excel.

Fix is here: http://support.microsoft.com/kb/2570623

I actually ran the above fix, then I got an error that the OFV.msi had to be found. So I had to complete the installation with OFV.exe, then run the OFV Add-in Fix again. All better now!

ChronoPay Co-Founder Vrublevsky

By Ed Bott | August 29, 2011

Summary: The fake-antivirus business was a big money-maker in the first half of this year. Then, at the end of June, fake-AV products practically disappeared from the web. Was it technology, or does traditional law enforcement deserve the credit?

The fake-antivirus business went from boom to bust in record time. [more]

Well known issue with these. The Upper Intake Manifold Gasket melts in close proximity to the EGR stove pipe allowing coolant and oil to get in bad places. My upper was leaking, but the Lower Intake Manifold Gaskets were a mess!

Click on pic to get a closer look. Yikes!

For about a month, it was eating antifreeze. I kept topping it off, until the inevitable, it overheated. Water started pouring from broken Upper and Lower Heater Bypass Pipes (Video) and oil mixed with the antifreeze through the intake gaskets. For the first time, it was now running rough. Feared the worst.

After a good compression check, I replaced all the gaskets from the lower intake manifold on up, the water pump, plugs and wires. Fired right up! All good! AHOO!

Parts:
Redesigned Lower Intake Gasket Set from GM 89017816 ($65 dealer)

Improved Design Upper Intake Manifold and Gaskets from Dorman 615-180 ($130 autozone)
Dorman Heater Pipes 47065 ($5 autozone)
Heater Adapter O-Rings 24502375 ($10 dealer)

Redesigned gasket is now aluminum with molded seal

Tips:
Disconnect the wire harness from the ICM before running a compression check!
To replace the water pump, you must remove the power steering pump. Not the PS pulley! (Video)
Do not use Carburator Cleaner on the throttle body and Emission Sensors! They make special cleaners for throttle body and MAF Sensor.
Wish I had used a little Permatex on the Heater Pipe O-Rings. They weep a little.
The upper and lower gaskets go on without dressing! Just a dab of Gasket maker in the corners of the lower (above and below).
The UIM comes with a new vacuum port and o-ring, but it felt loose to me. I added the old o-ring to the upper shoulder to snug it up to the manifold.
Step by Step help at www.AllDataDIY.com

Very happy with this fix. About 75 people read this post every day. Give me some feed back! Did I help?