1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Zero Access Rootkit Removal

Discussion in 'Malware Removal' started by samwise753, Oct 24, 2011.

  1. samwise753

    samwise753 Private E-2

    Good afternoon,

    I have come to the conclusion that my desktop PC has been infected with a Zero Access Rootkit. I downloaded and ran ComboFix and it confirmed the presense of this rootkit. I have reviewed the other threads about removing the rootkit, and the only thing I am not capable of is discerning the problem entries in the ComboFix log, which I have attached. I know you are very busy, but I would very much appreciate your help in this matter.

    Also, I have already downloaded The Avenger and TDSSKiller. I refrained from downloaded Win32Diag.exe since I wasn't sure about the link provided by google. Please let me know if I need addtitional removal software. Thank you.

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I want you to run TDSSKiller so refer to the below for how to do so.

    TDSSkiller - How to run

    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

    Download and run Win32kDiag per the below instructions:
    • Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
    • Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log
    C:\win32kdiag.exe -f -r

    Now we need to scan the system with this special tool.
    • Please download Junction.zip and save it to your root folder (C:\Junction.zip)
    • Unzip it and put junction.exe in the root folder (C:\junction.exe)
    • Now click Start => Run... => Copy and paste the following command in the run box and click OK:
      cmd /c junction -s c:\ >C:\log.txt
    • A command prompt window opens and also a license agreement from SysInternals will appear.
    • Accept the license agreement and the scan will begin.
    • Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes). (How to attach items to your post)
    • NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.

    And one more scanning tool I want to use to collect more information is OTL per the below.

    Please download OTL by Old Timer to your desktop.
    See the download links under this icon: [​IMG]
    1. Double-click OTL.exe to run (Vista and Win7 right click and select Run as Administrator)
    2. When OTL opens, change the Output (at the top-right portion of the program) to Minimal Output.
    3. Put check-marks in LOP Check and Purity Check.
    4. Now click the [​IMG] button.
    • When the scan is complete, two logs entitled OTL.txt and Extras.txt will be created on your desktop.
    • Attach both of these logs to your next message as well as any other requested logs.

    Then you need to make sure that you complete as much as you can of the below.

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide

    and attach the requested logs when you finish these instructions.
    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
  3. samwise753

    samwise753 Private E-2


    I ran through the read and run me. Interestinly, SAS didn't report any viruses; didn't even report any cookies. Also, the ComboFix log I attached (CFlog102511) is the combofix log generated after running everything in read and run. My next post has the outputs from the other checks.

    Attached Files:

  4. samwise753

    samwise753 Private E-2

    More output.

    Attached Files:

  5. samwise753

    samwise753 Private E-2

    Last one.

    It seemed very odd to me that SAS, MBAM, and TDSSKiller did not show anything. After the first run of ComboFix, a window popped up stating that it detected a rootkit. After doing the read and run, the ComboFix I ran today did not end with a window about a detected rootkit. I don't how it would have been taken care of since yesterday.

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Please also attach the C:\MGlogs.zip. I need that too.
  7. samwise753

    samwise753 Private E-2

    Sorry about that; had it on hand, just forgot to add it.

    Attached Files:

  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    The logs look good. :) Describe to me how things are running please.

    I would also like you to uninstall the below:

    AVG 9.0
    <--- Outdated and could have been compromised.
    Java(TM) 6 Update 20 <--- Outdated.

    Reboot your machine and install the most current and up to date version of Java available here at the below link:

    Java Runtime 6

    You can get the current version of AVG HERE.
  9. samwise753

    samwise753 Private E-2

    Everythings seems to be running normal now. I uninstalled and reinstalled AVG 9.0 and Java. I feel like the boy who cried wolf, but my first combofix run said there was a rootkit. After the read and run, the next combofix run didn't mention it. It is not still lurking around hiding from detection? I guess that's one of the reasons y'all ask for the read and run. I really appreciate the help.

    How can I help support this website and the work y'all do?
  10. samwise753

    samwise753 Private E-2

    Just an addition here; I ran the reinstalled AVG, and it found and removed/healed the viruses listed in the attached document. I don't know why SAS and MBAM didn't find these, but, hopefully, that is the end of them. Thank you again for your help.

    Attached Files:

  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What AVG found in system, restore is not a problem, however it concerns me that it is nuking it's own files. :confused Hope it has not been compromised due to something still hiding.

    Run Combofix again and see what the result of that is, attach its log.

    Also run this please.

    Please download GMER and save it to your desktop:

    • Unzip (extract) it to your desktop.
    • Disconnect from Internet and close all running programs.
    • There is a small chance this application may crash your computer so save any work you have open.
    • Double-click gmer.exe to run it.
    • Let the gmer.sys driver to load if asked.
    • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan... click NO.
    • Click the Rootkit tab.
    • Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
    • Then click the Scan button. Wait for the scan to finish.
    • Once done, click the Copy button.
    • This will copy the results to the clipboard. Open Notepad and press CTRL + V to paste the log, and save it to your desktop. Attach this log to your next reply.

    NOTE: If you're having problems with running gmer.exe, try it in Safe Mode. This tool works in Safe Mode whereas many other rootkit revealers do not.
  12. samwise753

    samwise753 Private E-2

    I've attached those logs.

    You should know, the infected AVG files were from AVG 9.0, which was the full version on my computer prior to these problems, not the free version I downloaded yesterday, AVG 2012. I think those infected files were from the previous version; I'm not sure if uninstalling the previous version should have gotten rid of any infected files. I wasn't sure if you were saying the newly installed AVG was compromised.

    Attached Files:

  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required (If we renamed it please rename it back to Combofix.exe.
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:

Share This Page

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds