ZeroAccess rootkit found

linuxpowers · Dec 4, 2013

I was given this Dell laptop (windows 7 premium SP1) to work on because the owner couldn't even get windows to start. While playing around with it, I found that it wouldn't even start up in safe mode. So, I finally got it to boot up with an earlier restore point and man this thing is messed up. I noticed right off that the desktop was littered with the users icons including pdf files, shortcuts and leftovers from install packages. The first windows problem I noticed was that the mousepad lost it's buttons abilities. No drag and drop/resize with left button, no right click for anything else. I also noticed no ability to do a windows update, for which an error message stated the service not started. I looked at windows services and update wasn't even available. I compared windows services with those at Black Viper and saw that many would not start or were not even listed. Very few programs would load up, no firefox or chrome browser working and mcafee seemed to be getting in the way of everything. Everything I tried issued a popup of some sort with an error.

I got IE to run and logged into majorgeeks but any download was deemed a virus and deleted! Upon further investigation, I found this to be a characteristic of the ZeroAccess rootkit so I renamed the windows defender folder to defender_old and headed over here to run the "Read & Run Me". I'm posting the log files from the scans but you must keep in mind, without the use of the mousepad buttons, I couldn't run these scans by right-clicking and running as administrator. I assumed that since this is the only user account on this computer and the owner set this account up as an administrator type, just double-clicking would accomplish the same thing.

Everything seemed to run just fine with one exception....when I ran MGTools, I received a pop-up window towards the end of the scanning process while running, "processdll.exe" which stated, "Äpplication has generated an exception that could not be handled." I could click Ok to continue or Close to debug...I chose Ok and completed the process! Other than that, no issues, all scans completed.

BTW, since TDSSKiller generated two logs, I'm sending MGLogs.zip in another post after this one.

linuxpowers · Dec 4, 2013

...and here's MGlogs.zip!

Kestrel13! · Dec 4, 2013

Hmm, it's quite a mess but should soon be sorted out.

UnfriendApp <<< Uninstall this.

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\Mel\AppData\Local\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\?��?��?��\?��?��?��\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" >) -> FOUND

[RUN][SUSP PATH] HKCU\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\Mel\AppData\Local\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\?��?��?��\?��?��?��\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" >) -> FOUND

[RUN][SUSP PATH] HKUS\.DEFAULT\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-19\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-20\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][ZeroAccess] HKUS\S-1-5-21-1397664649-306976850-4195742780-1000\[...]\Run : Google Update ("C:\Users\Mel\AppData\Local\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\?��?��?��\?��?��?��\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" >) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-21-1397664649-306976850-4195742780-1000\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][ZeroAccess] HKUS\S-1-5-21-1397664649-306976850-4195742780-1000\[...]\Run : Google Update ("C:\Users\Mel\AppData\Local\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\?��?��?��\?��?��?��\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" >) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-18\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : AS2014 (C:\ProgramData\3pgn373p\3pgn373p.exe [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CCSet\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\ \...\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" < [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CS001\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\ \...\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" < [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CS002\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\ \...\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" < [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CS003\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\ \...\???ﯹ๛\{aa0a619d-2039-41d1-74c2-3ab3af4c8161}\GoogleUpdate.exe" < [x]) -> FOUND

[V1][SUSP PATH] Dealply.job : C:\Users\Mel\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE - /Check [x] -> FOUND

[V2][SUSP PATH] Dealply : C:\Users\Mel\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE - /Check [x] -> FOUND

[V2][SUSP PATH] Updater19866.exe : C:\Users\Mel\AppData\Local\Updater19866\Updater19866.exe - /extensionid=19866 /extensionname="Deal Vault" /chromeid=mifpbickojhbejhppcfgifjbmiinpjap [x][x] -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

.....and the same for items on the file/folder tab please.

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_32\Desktop.ini [-] --> FOUND

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_64\Desktop.ini [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Users\Mel\AppData\Local\Google\Desktop\Install [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Program Files (x86)\Google\Desktop\Install [-] --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run Hitman Pro and have it delete all of the "Malware" "Malware Remnants" and "Potential Unwanted Programs"

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O4 - HKLM\..\Run: [AS2014] C:\ProgramData\3pgn373p\3pgn373p.exe

O4 - HKCU\..\Run: [APN] rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer

O4 - HKUS\S-1-5-19\..\Run: [APN] rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [APN] rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [APN] rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer (User 'Default user')

O20 - AppInit_DLLs: c:\progra~3\browse~1\261070~1.41\{c16c1~1\browse~1.dll

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix exit HJT.

Delete these if they show:

C:\ProgramData\3pgn3733

C:\ProgramData\3pgn373p

C:\Program Files (x86)\Deal Vault

C:\Program Files (x86)\DealPly

C:\Program Files (x86)\FreePriceAlerts

C:\Program Files (x86)\MyPC Backup

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Re run RogueKiller again, (just a scan) and attach the new log.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

linuxpowers · Dec 5, 2013

I used iobituninstaller to remove UnfriendApp.

I then started RogueKiller. During the "prescan" process, I received a pop-up window stating, "error - this version is outdated, would you like to download a newer one?" I clicked on NO and the prescan continued to complete. I then clicked on the "scan" button and allowed the scan to complete.

Now when I look in the registry tab, I see some of the lines that you listed from the first scan but, some of the lines are not exact! I also noticed that none of the lines in the new scan mention [ZeroAccess]. I'm wondering if ZeroAccess is changing things? I didn't want to delete anything until I sent you another scan log. I did see the folders in the file/folder tab that you mentioned but decided to wait until I got back with you on this issue first. I shut down RogueKiller and went over the new log against the first one that I posted...their definitely different. There seems to be too many variations going on here. Not sure what to do!

New log attached!

Kestrel13! · Dec 5, 2013

All these need fixing as per the latest log:

[RUN][SUSP PATH] HKCU\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKCU\[...]\Run : Google Update (regsvr32.exe C:\Users\Mel\AppData\Local\Google\MSRD3X40.dll [x][-]) -> FOUND

[RUN][SUSP PATH] HKUS\.DEFAULT\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-19\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-20\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-21-1397664649-306976850-4195742780-1000\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-21-1397664649-306976850-4195742780-1000\[...]\Run : Google Update (regsvr32.exe C:\Users\Mel\AppData\Local\Google\MSRD3X40.dll [x][-]) -> FOUND

[RUN][SUSP PATH] HKUS\S-1-5-18\[...]\Run : APN (rundll32 "C:\Users\Mel\AppData\Local\Conexant\APN\mochdila.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : AS2014 (C:\ProgramData\3pgn373p\3pgn373p.exe [x]) -> FOUND

[V1][SUSP PATH] Dealply.job : C:\Users\Mel\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE - /Check [x] -> FOUND

[V2][SUSP PATH] Dealply : C:\Users\Mel\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE - /Check [x] -> FOUND

[V2][SUSP PATH] Updater19866.exe : C:\Users\Mel\AppData\Local\Updater19866\Updater19866.exe - /extensionid=19866 /extensionname="Deal Vault" /chromeid=mifpbickojhbejhppcfgifjbmiinpjap [x][x] -> FOUND

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_32\Desktop.ini [-] --> FOUND

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_64\Desktop.ini [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Users\Mel\AppData\Local\Google\Desktop\Install [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Program Files (x86)\Google\Desktop\Install [-] --> FOUND

linuxpowers · Dec 5, 2013

OK, I'm sending you the copy of the latest log file. If everything looks good to you, should I continue with your instructions from your first reply?

Kestrel13! · Dec 6, 2013

Yes, just place checkmarks against entries that I have told you to delete, that is of course if they show, if not just checkmark what you can of what I asked and continue on.

linuxpowers · Dec 7, 2013

OK...Ran "Windows Repair", let it do it's thing and auto reboot. (No issues here)

After windows started back up, got a pop-up saying, "Windows Security Alert" telling me that firewall is blocking some features from certain programs. Assumed at that point that Firewall was running but verified it through control panel as well.

RogueKiller log attached. (No issues here)

New MGlogs.zip file attached. (Received the same pop-up while running "processdll.exe". no other issues)

Windows Updater is now up and running....with 34 updates available.

Windows Services shows services listed in Standard tab but blank in Extended tab.

Other than a glitchy mouse and keyboard, everything now seems to be available and runable!

linuxpowers · Dec 8, 2013

Just noticed, after a bit of surfing, it looks like firefox is being redirected on all web pages. I just typed in a search for startpage, clicked on the link in the listing and ended up looking at an advertisement for "Dell" computers! Seems I can only get to pages by entering URL directly.

chaslang · Dec 8, 2013

linuxpowers said: ↑

it looks like firefox is being redirected on all web pages.
Click to expand...

Please follow the instructions in the below and see if it helps.

Reset Firefox to Defaults

linuxpowers · Dec 8, 2013

Thanks chaslang, that did the trick with firefox. Guess I should have went to mozilla first on that one....I was thinking it was all malware related". Sometimes I get tunnel vision and can't see anything öutside of the box!

Kestrel13! · Dec 8, 2013

Latest RogueKiller log still shows:

[ZeroAccess][Folder] Install : C:\Program Files (x86)\Google\Desktop\Install [-] --> FOUND

That needs deleting, then you need to rescan again (just a scan) and attach another newer log.

linuxpowers · Dec 8, 2013

New Scan...New Log!

Getting clean huh?

Kestrel13! · Dec 8, 2013

Indeed. How are things running currently? The logs look good.

linuxpowers · Dec 8, 2013

Things are looking real good!

Windows update checked automatically, downloaded and installed all outstanding updates...then rebooted. Working!!!

Not sure about windows services though. Still won't display a list of services for me with the "Ëxtended" tab, only with the "Standard" tab checked. Looked at checkbox in msconfig...it's clear, so services are not being hidden. I'll keep digging into that issue.

I think I'm ready to enable UAC and reset a restore point at this point? What do you think?

Kestrel13, on a side note....I'm sure this stuff has to get old for you. I scan the support forum threads quite a bit and always see your name. Your always dealing with other peoples bad computer habits, and sometimes even bad tempers! But, I can't come close in expressing how much I appreciate your time and efforts. I only wish I could offer some assistance the way you do, and I know it would certainly take some of the load off the backs of people like yourself. I would certainly be more than willing to try, but my knowledge is limited to what I can find online and years of trial and errors....more errors than anything! Thanks so much for all you do!!!

Let me know if you think I'm finished here!

Kestrel13! · Dec 8, 2013

Would you like to learn how to fight malware?

Take a look at this if you are interested. Becoming a Malware Forum Helper.

Out of all those I would probably go with BleepingComputer.

Yes, I think we are done here. Final steps are posted below.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

ZeroAccess rootkit found

linuxpowers Corporal

Attached Files:

RKreport[0]_S_12032013_063803.txt

mbam-log-2013-12-03 (06-52-59).txt

TDSSKiller.3.0.0.19_03.12.2013_07.09.09_log.txt

TDSSKiller.3.0.0.19_03.12.2013_07.14.12_log.txt

HitmanPro_20131203_0747.log

linuxpowers Corporal

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

RKreport[0]_S_12052013_063839.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

RKreport[0]_D_12052013_155717.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

RKreport[0]_S_12072013_125353.txt

MGlogs.zip

linuxpowers Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

linuxpowers Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

RKreport[0]_S_12082013_101619.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ZeroAccess rootkit found

linuxpowers Corporal

Attached Files:

linuxpowers Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

linuxpowers Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

linuxpowers Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

linuxpowers Corporal

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches