Please help, Rootkit.zeroaccess won't go away

Hi guys, I know there are quite a few threads on this topic but I was told to post a new one as each individuals problem requires a different solution so, here I am.

I recently un-installed my avast internet security and rebooted my laptop. My internet then stopped working. At first it just looped on acquiring network address but then I managed to sort it out and have got it to work again.

I wanted to check the health of my system after this occured to make sure that there was nothing unfriendly left on my laptop. My system also started to take a lot of time in loading up programs and general start-up and opening folders, so I followed the Majorgeeks malware removal guide. Everything was going fine until I ran combofix. As soon as I ran the program it popped up saying that I had a rootkit.zeroaccess problem and that it would take some time to remove. It then said that I needed to reboot my laptop which I did and it finished the process.

For some reason my computer was still running as it was prior to any attempt at malware removal and so I tried combofix again but I got the same error saying that I had a rootkit.zeroaccess problem.

I would really appreciate it someone could help me with this issue. I have attached the logs of malwarebytes, superantispyware, Rootrepeal, mgtools and combofix.

I appreciate any feedback given and would like to say thanks in advanced to any one willing to help

 

Sorry for the double post but I could only attach four files. I have attached the rootrepeal log also now in this post.

 

Thank you Kestrel13! for helping me out, I greatly appreciate it.
I have attached the log as you requested.

 

Thanks for your advice my friend. I followed everything that you said. However, I could not find the following entry in the MGtools analsyse.exe:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

The other three were there and I selected fix.
I then ran combofix as you said and have attached both the MGtools.zip and the combofix logs as requested. The laptop seems to still be running rather sluggish as well as when I select any explorer window (MyComputer, MyDocuments etc.) it takes at least 15 to 20 seconds to load up.
I retried combofix to see whether it still detected a rootkit.zeroaccess error and unfortunately it did.

 

Hi Kestrel13! ,

Sorry for the questions but do you want me to select all the parameters in TDSSKiller or just the deafault ones, and do you want me to delete or skip the action :

\Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Also, do you want me to re-run TDSSKiller and attach its report/log?

Thanks

 

Hi again,

I was able to do exactly what you instructed me to do and have attached the logs as requested.

I also checked combofix again and unfortunately it still says that there is a rootkit.zeroaccess present. The laptop appears to be running slightly better but still freezes from time to time when loading a explorer page (e.g MyComputer).

Once again I really appreciate your assistance my friend and cannot thank you enough for your help.

 

Hello alonso,

Please download aswMBR to your desktop.

• Double-click aswMBR.exe to run (Vista/7 right-click and select Run as Administrator)
• Select Yes when asked "Would you like to download latest Avast! virus definitions?"
• Click the [Scan] button.
• On completion of the scan click [Save log], save it to your desktop and attach this log to your next message. (How to attach)

Please download OTL by OldTimer.

• Save it to your desktop.
• Double click on the OTL icon on your desktop.
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the text-field.
  
  Code:

  activex
  netsvcs
  /md5start
  afd.sys
  i8042prt.sys
  ipsec.sys
  netbt.sys
  svchost.exe
  tcpip.sys
  /md5stop
  %windir%\$ntuninstallkb*. /30
  %windir%\system32\drivers\*.sys /lockedfiles
  

• Now click the button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

 

Hi Thisisu,

thanks also for your help along with Kestrel13! I really really appreciate it.
I have attached the log's as you requested.

 

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

Code:

[COLOR="DarkRed"]:otl[/COLOR]
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\usprserv.dll -- (MaVctrl)
SRV - [2006/12/19 16:53:46 | 000,024,072 | ---- | M] (TuneUp Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\w39n51.sys -- (w39n51) Intel(R)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Simbad)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\RTL8187.sys -- (RTLWUSB)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\nielprt.sys -- (nielprt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\nielgfx.sys -- (NielGfx)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Arun\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Atdisk)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswMBR.sys -- (aswMBR)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Abiosdsk)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.pcservicecall.co.uk
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.pcservicecall.co.uk
IE - HKU\S-1-5-21-1379025819-1671851373-2310334279-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;
IE - HKU\S-1-5-21-1379025819-1671851373-2310334279-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.pcservicecall.co.uk
O3 - HKU\S-1-5-21-1379025819-1671851373-2310334279-1006\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1379025819-1671851373-2310334279-1006\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
[2012/05/20 16:37:12 | 000,024,072 | ---- | C] (TuneUp Software GmbH) -- C:\WINDOWS\System32\uxtuneup.dll
[COLOR="DarkRed"]:files[/COLOR]
dir /s "C:\Documents and Settings\All Users\Application Data\{32364CEA-7855-4A3C-B674-53D8E9B97936}" /c
dir /s C:\windows\installer\{32364CEA-7855-4A3C-B674-53D8E9B97936} /c
ipconfig /flushdns /c
netsh int ip reset resetlog.txt /c
netsh winsock reset /c
[COLOR="DarkRed"]:commands[/COLOR]
[purity]
[clearallrestorepoints]
[emptytemp]
[resethosts]

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

Run ComboFix and let me know if ZeroAccess is still detected.
Then attach the latest ComboFix.txt for review. (How to attach)

 

Hi Thisisu,

I did as you asked and have attached the logs. My internet stopped working but I then just told windows to configure my wireless network and it started to work again (I was using intel wireless assistant but that got removed once I ran combofix for some reason).

I ran combofix again and unfortunately it still detects a rootkit.zeroaccess problem

 

Ok, we're going to dig even deeper.

Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]DirLook::[/COLOR]
C:\30b8aef5bea66c2343
C:\WINDOWS\$NtUninstallKB2620712$
C:\WINDOWS\$NtUninstallKB2686509$
C:\WINDOWS\$NtUninstallKB2631813$
C:\WINDOWS\$NtUninstallKB2661637$
C:\WINDOWS\$NtUninstallKB2647518$
C:\WINDOWS\$NtUninstallKB2621440$
C:\WINDOWS\$NtUninstallKB2646524$
C:\WINDOWS\$NtUninstallKB2604042$
C:\WINDOWS\$NtUninstallKB2641653$
C:\WINDOWS\$NtUninstallKB2633952$
C:\WINDOWS\$NtUninstallKB2585542$
C:\WINDOWS\$NtUninstallKB2584146$
C:\WINDOWS\$NtUninstallKB2660465$
C:\WINDOWS\$NtUninstallKB2653956$
C:\WINDOWS\$NtUninstallKB2639417$
C:\WINDOWS\$NtUninstallKB2633171$
C:\WINDOWS\$NtUninstallKB2618451$
C:\WINDOWS\$NtUninstallKB2676562$
C:\WINDOWS\$NtUninstallKB2628259$
C:\WINDOWS\$NtUninstallKB2624667$
C:\WINDOWS\$NtUninstallKB2619340$
C:\WINDOWS\$NtUninstallKB2695962$
C:\WINDOWS\$NtUninstallKB2598479$
C:\WINDOWS\$NtUninstallKB2659262$
C:\WINDOWS\$NtUninstallKB2603381$
C:\WINDOWS\$NtUninstallKB2656378$
c:\documents and settings\Arun\Application Data\Jaksta
c:\documents and settings\Arun\Application Data\DMCache
[COLOR="DarkRed"]Domains::[/COLOR]
[COLOR="DarkRed"]FireFox::[/COLOR]
FF - ProfilePath - c:\documents and settings\Arun\Application Data\Mozilla\Firefox\Profiles\vic1cv4u.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.gopher - 
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
[COLOR="DarkRed"]Folder::[/COLOR]
c:\documents and settings\All Users\Application Data\TuneUp Software
[COLOR="DarkRed"]NetSvc::[/COLOR]
mavctrl
[COLOR="DarkRed"]Registry::[/COLOR]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AvgUninstallURL]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.

This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

Please download Microsoft Fix it 50203 to your desktop.

• Double-click it to run.
• Reboot when asked to.

Download SystemLook from one of the links below and save it to your desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy and Paste the content of the following code box into the main text-field:

Code:

[COLOR="DarkRed"]:regfind[/COLOR]
A109A-K13-3ZXD-BAP5-TE
SerialNumber

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan and a file entitled SystemLook.txt will be created on your desktop.
• Attach that file to your next message. (How to attach)

Please download MiniToolBox and save it to your desktop and run it.

Checkmark following checkboxes:

• Flush DNS
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log

Press Go and attach the result (Result.txt) that pops up. A copy of Result.txt will be saved in the same directory the tool is run.

Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

Hi Thisisu,

I did what you asked but had some problems. When I ran MicrosoftFixit it says that the helper dll could not be located. I then ran the SystemLook program with the code you gave and it just keeps scanning but does nothing. I have been scanning for over two hours and it just doesn't seem to be doing anything so I quit the program. I have attached the ComboFix and MiniToolBox logs as requested. The SystemLook.txt just says searching for "A109A-K13-3ZXD-BAP5-TE" but I attached it anyway. Let me know if I have done something wrong and thanks for your continued help in advance.

 

No problem. We are going to try to completely rebuild the TCP/IP stack.

I would like you try the below.

Click Start, and then click Run.
In the Open box, type regedit, and then click OK.
In Registry Editor, locate the following keys, right-click each key, and then click Delete:

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

When you are prompted to confirm the deletion, click Yes.
Close the Registry Editor.

Locate the Nettcpip.inf file in C:\WINDOWS\inf and then open the file in Notepad.
Locate the [MS_TCPIP.PrimaryInstall] section. Change the Characteristics = 0xA0 entry by replacing 0xA0 with 0x80. Save the file. Exit Notepad.
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK. It will report as unsigned, this is the one we want! Do not choose Microsoft TCP/IP v6!

Note This step returns you to the Local Area Connection Properties screen. However, the Uninstall button is now available.
Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
You will be asked to reboot your PC for the changes to take affect, go ahead and do this now.

Once you have rebooted...
In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
On the General tab, click Install, select Protocol, and then click Add.
In the Select Network Protocols window, click Have Disk.
In the Copy Manufacturer's files from text box, type C:\WINDOWS\inf, and then click OK.
Select Internet Protocol (TCP/IP), and then click OK.
Restart your computer.

Now download a new copy of ComboFix, run it, attach latest log.

Let me know how the system is running. Are you actually experiencing symptoms of malware?

 

Hi Thisisu,

I was able to scan with SystemLook after all, I just had to wait a while for the scan to complete. I have attached the log in a zip file as it was to big otherwise (2 mb).

I also reset the tcp/ip stack like you said and then ran ComboFix. It still said that there was a rootkit.zeroaccess problem present. My computer is running more smoothly now. However, it still freezes when trying to open some explorer windows (MyComputer, MyDocuments etc.). They do eventually appear, but it sometimes takes a while. I have also attached the MGlogs as well.

 

Your logs are clean, and have been for a while.
I am not sure why ComboFix is still reporting ZeroAccess especially after we completely rebuilt the TCP/IP stack.
Going to declare this a false alarm on ComboFix's behalf.

Please note:

Code:

Processor	x86 Family 6 Model 15 Stepping 6 GenuineIntel ~1828 Mhz	
Total Physical Memory	1,024.00 MB	
Available Physical Memory	308.32 MB

These are low end system specifications compared to today's standards.

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

 

Thanks for all of your help Thisisu and Kestrel13! My laptop is working fine now and I just think that it freezes from time to time due to its age like you said. Once again I cannot thank you enough for your help and i really really really appreciate all of your assistance. Thank you

 

You are very welcome, alonso
Be safe.