MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 04-14-12, 08:24
chipndale chipndale is offline
Private E-2
 
Join Date: Apr 2012
Posts: 5
Thanks: 1
Thanked 0 Times in 0 Posts
Default Rootkit:zeroaccess

I've tried all I know to remove this bugger. Time for help from the experts.
Zeroaccess has infected my ipstack and I can't get an ip address frpom DHCP.
Here are my logs:
Attached Files
File Type: log SAS.log (1.4 KB, 1 views)
File Type: txt mbam-log.txt (2.7 KB, 1 views)
File Type: txt ComboFix.txt (48.0 KB, 3 views)
File Type: txt RRLog.txt (690 Bytes, 0 views)
Reply With Quote
Sponsored links
  #2  
Old 04-14-12, 08:27
chipndale chipndale is offline
Private E-2
 
Join Date: Apr 2012
Posts: 5
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Rootkit:zeroaccess

Here is the mgtools log:
Attached Files
File Type: zip MGlogs.zip (353.7 KB, 1 views)
Reply With Quote
  #3  
Old 04-14-12, 15:59
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,718
Thanks: 61
Thanked 7,418 Times in 3,970 Posts
Default Re: Rootkit:zeroaccess

Welcome to Major Geeks!

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code:
    :regfind
    :filefind
    ipsec.sys
    tcpip.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. You can just close this notepad window since the log is already saved on your Desktop. Be patient! It may look like it is not doing anything, but it takes awhile for this to scan thru your whole system look for matches.
  • Please attach the SystemLook.txt log found on your Desktop to next reply.

Now please download OTL by OldTimer.
  • Save it to your desktop.
  • Double click on the OTL icon on your desktop. (If running Vista or Win7 right-click and select Run as Administrator)
  • Check the "Scan All Users" checkbox.
  • Check the "Standard Output".
  • Change the setting of "Drivers" and "Services" to "All"
  • Copy the text in the code box below and paste it into the Customs Scans/Fixes text-field.
    Code:
    netsvcs
    /md5start
    afd.sys
    atapi.sys
    csrss.exe
    dhcpcsvc.dll
    explorer.exe
    lsass.exe
    nsiproxy.sys
    regedit.exe
    services.exe
    svchost.exe
    tcpip.sys
    tdx.sys
    userinit.exe
    winlogon.exe
    /md5stop
    %systemdrive%\*.*
    %systemdrive%\MGtools\*.*
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.sys /90
    %systemroot%\system32\*.exe /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %windir%\assembly\GAC\*.ini
    %windir%\assembly\GAC_MSIL\*.ini
    %windir%\assembly\gac_32\*.ini
    %windir%\assembly\gac_64\*.ini
    %windir%\assembly\temp\*.ini
    %windir%\assembly\tmp\u /s
    %allusersprofile%\application data\*.exe
  • Now click the Run Scan button.
  • Two reports will be created:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
  • Attach both OTL.txt and Extras.txt to your next message. (See how to attach)
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #4  
Old 04-15-12, 15:44
chipndale chipndale is offline
Private E-2
 
Join Date: Apr 2012
Posts: 5
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Rootkit:zeroaccess

Here is the log from Systemlook. The OTL lg is 504kb which exceeds the upload limit. Apparently there is no extra.txt log as well.
Attached Files
File Type: txt SystemLook.txt (2.9 KB, 2 views)
Reply With Quote
  #5  
Old 04-15-12, 15:51
chipndale chipndale is offline
Private E-2
 
Join Date: Apr 2012
Posts: 5
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Rootkit:zeroaccess

I broke the OTL log into 2 parts and uploaded them.
Attached Files
File Type: txt OTL part1.txt (294.0 KB, 2 views)
File Type: txt OTL part2.txt (105.5 KB, 1 views)
Reply With Quote
Sponsored links
  #6  
Old 04-15-12, 22:41
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,718
Thanks: 61
Thanked 7,418 Times in 3,970 Posts
Default Re: Rootkit:zeroaccess

  1. Go to Start ==> Run (or Windows key+R)
    • Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
      (note that there is space after notepad)
    • The above file will open in the notepad.
    • Under TCP/IP Primary Install section find the following: Characteristics = 0xA0
    • Edit 0xA0 and replace it with 0x80 (replace A with 8)
    • Under File menu click Save and close the notepad.
  2. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
    • On the General tab, click Install a popup window opens.
    • Select Protocol from the list and then click Add.
    • A new window opens, click Have Disk....
    • In the browse... box type c:\windows\inf
    • Click OK.
    • Select Internet Protocol (TCP/IP), and then click OK.
    • On the Local Area Connection Properties screen select Internet Protocol (TCP/IP) and click Uninstall, and then click Yes.
    • Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
  3. Go to Start ==> Run (or Windows key+R)
    • Type the following in the run box and click OK: notepad c:\windows\inf\nettcpip.inf
      (note that there is space after notepad)
    • A file opens in the notepad. Under TCP/IP Primary Install section find the following: Characteristics = 0x80
    • Edit 0x80 and replace it with 0xA0 (replace 8 with A)
    • Under File menu click Save and close the notepad.
  4. Go to Start ==> Control Panel. Double-click Network Connections. Right-click Local Area Connection, and select Properties.
    • On the General tab, click Install
    • A popup window opens. Select Protocol.
    • A new popup window opens. Select Internet Protocol (TCP/IP), and then click OK.
    • Wait until it asks to restart, and then restart as requested. Continue with the below after restarting.
Uninstall the below old versions of software:
Java(TM) 6 Update 16
Java(TM) 6 Update 24

Now install the current version of Sun Java from: Sun Java Runtime Environment


Now shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
  • Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
  • Copy the text in the code box below and paste it into the text-field.
Code:
:OTL
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\transactional.dll -- (Xyz777b)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\oracleorahomehttpserver.dll -- (REVO)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\oracleorahome92pagingserver.dll -- (point32)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\websensepolicyserver.dll -- (oracleorahome92tnslistener)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\VAIOMediaPlatform-VideoServer-HTTP.dll -- (OracleOraHome92ClientCache)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\dac960nt.dll -- (oracleoradb10g_home1isql*plus)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\msftpsvc.dll -- (lxcr_device)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\vpcvmm.dll -- (lxcc_device)
SRV - File not found [Disabled | Stopped] -- %systemroot%\system32\https-admserv61.dll -- (lxby_device)
SRV - [2010/12/14 13:12:00 | 000,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-4077326862-4270047272-744067899-1005\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_24)
NetSvcs: 0 - C:\WINDOWS\0.log ()
NetSvcs: 1 -  File not found
NetSvcs: 9 -  File not found
NetSvcs: lxby_device - %systemroot%\system32\https-admserv61.dll File not found
:Files
C:\WINDOWS\$NtUninstallKB62840$
C:\Documents and Settings\Jonathan Rush\Local Settings\temp\Kno4.tmp
C:\WINDOWS\System32\drivers\i8042prt.sys|C:\WINDOWS\System32\dllcache\i8042prt.sys /replace
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
:Commands
[PURITY]
[EMPTYTEMP] 
[EMPTYFLASH]

[REBOOT]
  • Now click the button.
  • If the fix needed a reboot please do it.
  • Click the OK button (upon reboot).
  • When OTL is finished, Notepad will open. Close Notepad.
  • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
  • Attach this log to your next message. (See: How to attach)
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • the log from OTL
  • C:\MGlogs.zip
Make sure you tell me how things are working now!
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
The Following User Says Thank You to chaslang For This Useful Post:
chipndale (04-16-12)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Rootkit.zeroaccess kbtrade Malware Removal 1 02-25-12 21:58
Rootkit: ZeroAccess jschaf01 Malware Removal 15 02-25-12 18:39
Help with Rootkit.ZeroAccess! christophersquid Malware Removal 30 02-22-12 12:48
Rootkit.zeroaccess mpetro1 Malware Removal 12 12-29-11 16:04
Help with rootkit.zeroaccess elias7 Malware Removal 3 12-21-11 11:04


All times are GMT -5. The time now is 01:54.


MajorGeeks.Com Home Page
| Admin Tools | All In One | Anti-Spyware | Anti-Virus | Appearance | Backup | Benchmarking | BIOS | Browsers | Covert Ops |
Data Recovery | Diagnostics | Drive Cleaners | Drive Utilities | Drivers | Driver Tools Ergonomics | Firewalls | Games | Game Tweaks | Graphics | Input Devices | Internet Tools | Macintosh | Mail Utilities | Memory | Messaging | Monitoring | Microsoft | Multimedia | Networking | Office Tools | Process Management | Processor | Registry | Security | System Info | Toys | Video | Miscellaneous
|
Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger