KAVICHS streams attached to everything

Discussion in 'Trojan Defence Suite' started by controler, Dec 24, 2004.

Thread Status:
Not open for further replies.
Page 2 of 2
  1. controler

    controler Guest

    Paul

    I did try Unhackme trial. I only ran it ca couple times but when I tried to run it again it just comes up as trial expired. The version I was using is suppose to give 10 uses but guess I got cut short this time.
    Otherwise I sure would give it a try again. I did send one of the files. I sent the file in exe form and I RAR'ed it. LWM says if you use Winzip the stream doesn't get included with a file.

    Bruce
     
    controler, Dec 24, 2004
    #26
  2. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    The KAV streams only show up when KAV is uninstalled as they appear to be masked when kav is installed and running

    The mz.exe is NORMALLY an old dos based program that KAV does use for file integrity checking

    I'm not convinced you have any problems with the computer as Rootkit detector finds "hidden" drivers on my system as well and I KNOW that is clean it is just the way that it looks for the rootkits and i would rather have suspicious modules/drivers flagged than not
     
    dvk01, Dec 24, 2004
    #27
  3. controler

    controler Guest

    Yes I suppose so lol

    Thing is I have those same DLLS on another machine and RKDetector does not flag them as suspicious other then the same hooked DLLS.
    How does KAV mask the file while it is running?
    I have lpk,usp10 on both computers and only one has those dlls flagged as suspicious
    both show the hooked dlls the same.

    Why would KAV only tag one video file out of many before I uninstalled it?
    Does not make any sense.

    But instead of taking anymore of this thread I will just go ahead and reformat.



    *SUSPICIOUS MODULE!! c:\windows\system32\lpk.dll
    -------------------------------------------------------------------------------
    *SUSPICIOUS MODULE!! c:\windows\system32\usp10.dll
    -------------------------------------------------------------------------------
    *WARNING! MODULE c:\windows\system32\msvcrt.dll SEEMS TO BE HOOKED
    -------------------------------------------------------------------------------
    *SUSPICIOUS MODULE!! c:\program files\webroot\spy sweeper\sis.dll
    -------------------------------------------------------------------------------
    *WARNING! MODULE c:\windows\system32\oleaut32.dll SEEMS TO BE HOOKED
    -------------------------------------------------------------------------------
    *WARNING! MODULE c:\windows\system32\ole32.dll SEEMS TO BE HOOKED

    Bruce
     
    controler, Dec 24, 2004
    #28
  4. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    My idea as well.

    regards,

    paul
     
    Paul Wilders, Dec 24, 2004
    #29
  5. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    I'm not sure but when I uninstalled kav before installing the new version the streams show up, as soon as it is installed again then the streams don't show in either TDS or adsspy

    I know all they do is tag the file to inform KAV that it has been examined by the AV and it hasn't changed since last AV scan so no need to do a full examination of the file so speeding it up

    I assume that only KAV can read the streams as it must use a non standard stream and when it is uninstalled the streams then become visible to other programs looking for them as the non standard entry will be removed
     
    dvk01, Dec 24, 2004
    #30
  6. controler

    controler Guest

    Have you ever tried removing a million streams with Hijackthis?

    Um does anybody else think you need a select all button?

    Bruce
     
    controler, Dec 24, 2004
    #31
  7. Don Pelotas

    Don Pelotas Registered Member

    Joined:
    Jun 29, 2004
    Posts:
    2,257
    Hi Bruce

    An "easy" option is NTFS Streams Eraser from Excessive software, it's fast. :)
     
    Don Pelotas, Dec 24, 2004
    #32
  8. controler

    controler Guest

    Thanks everybody for helping me along with this problem.

    No wonder it takes KAV so long and KAV is a system hog lol
    Adding all those streams to every file on your hard drive has to take a while.

    Special thanks to DCS for TDS-3 and Don for the fast removal tool.

    I dought I will ever tough a Kaspersky product again ;)


    Bruce
     
    controler, Dec 24, 2004
    #33
  9. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,720
    Location:
    USA
    Wow....i THINK i like it .....can not get this site to load Smilies...that may change with reboot.....that scanner has been running for 15 mins now........ok...i should have waited to post, but i was so happy watching it eat Kav and being Christmas Eve and being well along with some fine beer......well you understand...
    :) so i will go out on that limb a bit and say thank you Don for a super Christmas present......................and a HUGE MERRY CHRISTMAS TO ALL AND TO ALL A GOODNIGHT :) :) :)
     
    Rainwalker, Dec 25, 2004
    #34
  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    But KProcCheck can at least show show you a bit more than most. This was done during PG beta test requested by Jason

    C:\Documents and Settings\*\Desktop\kproccheck\KProcCheck>kproccheck -t
    KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2

    Checks SDT for Hooked Native APIs

    KeServiceDescriptorTable 80559B80
    KeServiceDescriptorTable.ServiceTable E17A0B58
    KeServiceDescriptorTable.ServiceLimit 297

    ZwClose 19 \SystemRoot\System32\drivers\klif.sys [F6EA6C00]
    ZwCreateFile 25 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    C8E]
    ZwCreateKey 29 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB7
    768]
    ZwCreateProcess 2F \SystemRoot\System32\drivers\klif.sys [F6EA6920]
    ZwCreateProcessEx 30 \SystemRoot\System32\drivers\klif.sys [F6EA6A90]
    ZwCreateSection 32 \SystemRoot\System32\drivers\klif.sys [F6EA6D40]
    ZwCreateSymbolicLinkObject 34 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB
    836C]
    ZwCreateThread 35 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    6DC]
    ZwFsControlFile 54 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    DD8]
    ZwOpenFile 74 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    AD6]
    ZwOpenKey 77 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB7
    6BE]
    ZwOpenProcess 7A \SystemRoot\System32\drivers\klif.sys [F6EA6720]
    ZwOpenSection 7D \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    1A6]
    ZwProtectVirtualMemory 89 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    140]
    ZwQueryInformationFile 97 \SystemRoot\System32\drivers\klif.sys [F6EA722E]
    ZwReadVirtualMemory BA \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    10C]
    ZwRequestWaitReplyPort C8 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB5
    CAA]
    ZwSetContextThread D5 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    9DC]
    ZwSetInformationProcess E4 \SystemRoot\System32\drivers\klif.sys [F6EA8DF0]
    ZwSetSystemInformation F0 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB9
    7A0]
    ZwSetValueKey F7 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB7
    AFA]
    ZwSuspendThread FE \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    A30]
    ZwTerminateProcess 101 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    0E2]
    ZwTerminateThread 102 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    A06]
    ZwWriteVirtualMemory 115 \??\C:\WINNT\system32\drivers\procguard.sys [F8AB8
    006]
    Unknown API 11C \SystemRoot\System32\drivers\klif.sys [F6EA5C50]
    Unknown API 11D \SystemRoot\System32\drivers\klif.sys [F6EA5C60]
    Unknown API 11E \SystemRoot\System32\drivers\klif.sys [F6EA5C70]
    Unknown API 11F \SystemRoot\System32\drivers\klif.sys [F6EA5C90]
    Unknown API 120 \SystemRoot\System32\drivers\klif.sys [F6EA5CB0]
    Unknown API 121 \SystemRoot\System32\drivers\klif.sys [F6EA5CE0]
    Unknown API 122 \SystemRoot\System32\drivers\klif.sys [F6EA5CF0]
    Unknown API 123 \SystemRoot\System32\drivers\klif.sys [F6EA5D10]
    Unknown API 124 \SystemRoot\System32\drivers\klif.sys [F6EA5D20]
    Unknown API 125 \SystemRoot\System32\drivers\klif.sys [F6EA5D40]
    Unknown API 126 \SystemRoot\System32\drivers\klif.sys [F6EA5D60]
    Unknown API 127 \SystemRoot\System32\drivers\klif.sys [F6EA5DA0]
    Unknown API 128 \SystemRoot\System32\drivers\klif.sys [F6EA5DE0]

    WARNING: KiServiceTable is located outside ntoskrnl.exe

    Number of Service Table entries hooked = 38
     
    Pilli, Dec 25, 2004
    #35
  11. controler

    controler Guest

    Thank you pilli

    ANother Christmas Present. :D

    I wish I had one to give in return.

    I am going to give this one a try

    Bruce
     
    controler, Dec 25, 2004
    #36
  12. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Glad to have helped Controller. :)

    The link for others that may be interested is here:
    http://www.security.org.sg/code/kproccheck.html

    Be aware that this is BETA software so all normal back up precautions should be taken. :eek: Please read the on site help file before using this utility.

    Cheers. Pilli
     
    Pilli, Dec 25, 2004
    #37
  13. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,720
    Location:
    USA
    Just an update........so far so good....everything seems ok and TDS no longer finds streams.............not sure how this will affect things like pics.....anyone with any thoughts on this :doubt:
     
    Rainwalker, Dec 25, 2004
    #38
  14. jwcca

    jwcca Registered Member

    Joined:
    Dec 6, 2003
    Posts:
    772
    Location:
    Toronto
    I have to say thanks as well, to Don for the link and Excessive-software for the NTFS Eraser. My story is that I tried the Kaspersky 'Online' scanner, ran it only once then left it installed. I then purchased Raxco's First Defense and found that about 55 jpg, gif and png files "were in use". I used TDS to scan, not specifically for the ADS, but the same number popped up, same names. I tried to clean the files with TDS3 but they became 'defaced' again shortly thereafter. After trying to clean these numerous times, I tried 'multiple cleans' with TDS and was successfull with some files (no reappearance of streams) but others seemed uncleanble. I just used the NTFS eraser, scanned with TDS and everything is gone. First Defense now reports no errors when backing up. What a relief. (This may be because MTFS Eraser cleaned the files in FD's $ISR\1 and \2 and \3, not just the active snapshot.
    One last thing, NTFS Eraser showd MULTIPLE streams on some files, which TDS didn't.
    Plus I'll tell Raxco in case anyone else has this problem.
    Thanks, thanks, thanks!
    Jim
     
    jwcca, Dec 25, 2004
    #39
  15. S!x

    S!x Registered Member

    Joined:
    Jan 1, 2005
    Posts:
    51
    Location:
    Ohio, USA
    I don't understand why that program flags something based on hooks alone?
    There are alot of legit programs that create "Global Hooks" and need to in order to function properly ... correct?
     
    Last edited: Jan 1, 2005
    S!x, Jan 1, 2005
    #40
  16. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi S!x, KAV 5 personal does create streams, it has nothing to do with cracked versions. :)

    Pilli
     
    Pilli, Jan 1, 2005
    #41
  17. S!x

    S!x Registered Member

    Joined:
    Jan 1, 2005
    Posts:
    51
    Location:
    Ohio, USA
    Edited for stupidity ... wasnt anything left after that :D
     
    Last edited: Jan 1, 2005
    S!x, Jan 1, 2005
    #42
  18. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi S!x, No need for a link, unfortunately those warez sites are all to easy to find :)
     
    Pilli, Jan 1, 2005
    #43
  19. MrC

    MrC Guest

    MrC, Jan 24, 2005
    #44
  20. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Nice one MrC Thank you :)

    Important: you need to make sure Kaspersky Anti-Virus is uninstalled prior to running of the utility

    Pilli
     
    Pilli, Jan 24, 2005
    #45
  21. marcelg

    marcelg Registered Member

    Joined:
    Mar 31, 2005
    Posts:
    1
    marcelg, Mar 31, 2005
    #46
  22. zer((0))bytee

    zer((0))bytee Guest

    zer((0))bytee, Jun 27, 2005
    #47
  23. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,934
    Location:
    SW. Oklahoma
    The one thing that really cracks me up with people that think they know all about ADS streams is they think Kav put the streams there.. Kav does not put them there they just use the ones that windows already has there. They just put a check sum in the streams to check if anything has been changed. the info Kav puts there can be removed in a matter of minutes with NTFS streams eraser
     
    Last edited: Jun 27, 2005
    bigc73542, Jun 27, 2005
    #48
Page 2 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...