How to Remove H8SRT Trojan / Rootkit TDSS

February 11, 2010February 9, 2010 Wayne Zimmerman Leave a comment

The H8SRT Rootkit is a modification to the TDSS Trojan that installs a driver to hide itself, hijacks Internet Explorer, gives fake security and virus warnings, redirects search queries and major site access, as well as disables Task Manager, Registry Editor and blocks most anti-spyware applications. Not only does it disrupt normal use of the computer but also does a good job at trying to keep you from removing it by disabling the tools you would need.

I’m not sure how I got this little bug but it was one of the most stubborn apps that I had seen in quite a while. The hardest part about this is that it won’t let you download or execute applications that are used to remove it or identify what malware I had on my system. When I come across malware I typically go download MalwareBytes Anti-malware (MBAM) and run it and problem solved, however this time it wouldn’t download the application until I renamed it to just a generic “Setup.exe” and saved it. After it was installed I then was unable to execute it as “mbam.exe” I had to rename it to “notepad.exe” which then allowed me to execute it. Once I got it to run it removed some of the fake AV items, but after a few reboots and even safe mode the H8SRT Trojan was still on my computer. I did a bit of internet research and found out that Kaspersky has created a removal tool for TDSS.Rootkit which the H8SRT Rootkit is based. Once I downloaded and ran the Kaspersky tool: TDSSKiller, I follow up with another round of MBAM and now my system is clean.

Download TDSS Killer: http://support.kaspersky.com/downloads/utils/tdsskiller.zip
Kaspersky Documentation on TDSS Killer: http://support.kaspersky.com/viruses/solutions?qid=208280684
Kaspersky Free Virus Removal Tools: http://www.kaspersky.com/removaltools
Download MBAM: http://www.malwarebytes.org/mbam-download.php

How to Set Permission on a Service Using Subinacl

February 9, 2010February 9, 2010 Wayne Zimmerman 5 Comments

A couple of months back I was installed some communication software that made a VPN connection to the main server. It used OpenVPN to establish the connection and worked fine as long as your were an administrator on the PC. As I researched it further it installed a service and required that service to run on demand when the user launch the program. Since your standard limited user does not have privileges to start and stop services the application would fail to connect to the server.

So now the question becomes, how do you add permissions to a service?

Microsoft has an answer with a little known command line application called subinacl. This application allows you to view and edit security information for files, registry keys, and services. This can be handy if you are writing a script to change permissions on registry keys or files but the real power lies within the ability to edit the security information on services.

The syntax for subinacl: SUBINACL /SERVICE \\MachineName\ServiceName /GRANT=[DomainName\]UserName[=Access]

The Access parameter is broken down like this:
F : Full Control R : Generic Read W : Generic Write X : Generic eXecute L : Read controL Q : Query Service Configuration S : Query Service Status E : Enumerate Dependent Services C : Service Change Configuration T : Start Service O : Stop Service P : Pause/Continue Service I : Interrogate Service U : Service User-Defined Control Commands
For my example I just needed to allow the Domain Users group access to run the OpenVPN service.

subinacl /service OpenVPN /GRANT=DOMAIN\Domain Users=TO

You may need to execute this from the folder where subinacl.exe is located. Also if it is running the command on a local system you can just type the name of the service and not the UNC path to the service.

Download subinacl.exe from Microsoft
For more information about this command please visit: http://support.microsoft.com/kb/288129