infected with ZeroAccess Rootkit, can't run Combofix

[mattbiel]

Hello -

I went through all the steps in the "Read and Run Me First" post. I am attaching the logs for SAS, MBAM, RR and MG Tools. I could not get Combofix to complete a scan. It creates a restore point, it pops up with a warning that I'm infected with Zero Access, then it goes to the blue screen where it says "scanning may take 10 minutes or more" but I waited overnight and it didn't even complete Step 1 of the scanning.

Can you help me?

[thisisu]

Hello mattbiel

I want you to read and follow these instructions: TDSSKiller - How to run

[mattbiel]

Hello Thisisu! So happy that you have answered my distress call.

I downloaded tdsskiller, extracted it and saved it to the desktop, then changed the name to lskd.com However, it still will not run. I just see the hourglass flash for a 1/2 second and then nothing. I tried to run it in normal startup and safe mode but it will not run either way.

I will wait to hear from you for the next step/option, but just to let you know that if it will help I have the ability to pull out the HDD and slave it to a clean machine.

[thisisu]

Please download FixTDSS by Symantec to your desktop.

• Double-click it to run.
• Follow the prompts.
• After it has finished, retry running TDSSKiller.

[mattbiel]

Was able to run FixTDSS and it said that it repaired the MBR. I was then able to run TDSSKiller, which found 11 suspicious objects but all were default action "skip" so I skipped them as per the run instructions.

I tried to run Combofix but it still freezes before getting to "step 1" of the scanning process.

[thisisu]

From Add/Remove Programs (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 29 (outdated)

Attach your log from TDSSKiller

Please download OTL by OldTimer.

• Save it to your desktop.
• Double click on the OTL icon on your desktop.
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the text-field.
  

  activex
  netsvcs
  /md5start
  afd.sys
  i8042prt.sys
  ipsec.sys
  netbt.sys
  svchost.exe
  tcpip.sys
  /md5stop
  %windir%\$ntuninstallkb*. /30
  %windir%\system32\drivers\*.sys /lockedfiles
  %windir%\*.* /mp
  %windir%\*.* /rp
  %windir%\*.* /sl
  %systemdrive%\mgtools\*.*

• Now click the button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

[mattbiel]

Before I saw your most recent post below (with instructions for OTL) I tried rebooting and running Combofix from Safe Mode. It worked!

As per your instructions I have removed Java 29. I am attaching the TDSS log and the Combofix log. Should I still follow your previous instructions for OTL?

[thisisu]

Originally Posted by mattbiel

Should I still follow your previous instructions for OTL?

Yes. How is the computer working at this point?

[mattbiel]

The computer is working GREAT! Internet access is fine. To my untrained eye it appears/acts as though it is completely virus and rootkit free. Here is the OTL log.

[thisisu]

That's good
This last fix should take care of the remnants found.

Please download Disable/Remove Windows Messenger to your desktop.

• Double-click MessengerDisable.exe to run it.
• Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
• Click Apply
• Click Exit

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

:otl
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Simbad)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\Darwin\LOCALS~1\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\Darwin\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\bplxamdt.sys -- (bplxamdt)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Atdisk)
DRV - File not found [Kernel | Disabled | Stopped] --  -- (Abiosdsk)
O16 - DPF: {ADACAA8F-3595-47FE-9C31-9C7471B9BEC7} http://71.254.154.35/cab/OCXChecker_8120.cab (OCXDownloadChecker Control)
O16 - DPF: {1DFB237D-8771-47E5-8014-457DA60E97AF} https://my.convenos.com/install/versioncheck.cab (CheckVers Class)
[2012/04/28 08:56:02 | 000,000,184 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\-7CiEiNvPiJ4DwJr
[2012/04/28 08:56:02 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\-7CiEiNvPiJ4DwJ
[2012/04/27 15:23:17 | 000,000,837 | ---- | M] () -- C:\Documents and Settings\Darwin\Desktop\Data_Recovery.lnk
:services 
bplxamdt
:files
rd /s/q C:\WINDOWS\$NtUninstallKB19946$ /c
C:\Documents and Settings\Darwin\Local Settings\Application Data\0Mp8n7BDj1d
C:\Documents and Settings\All Users\Application Data\7CiEiNvPiJ4DwJ
C:\Documents and Settings\Darwin\Start Menu\Programs\Data Recovery
C:\found.000 /d
C:\Documents and Settings\Darwin\Local Settings\Application Data\p7Fj0O6C
xcacls.exe C:\WINDOWS\$NtUninstallKB19946$\2334308791 /p Administrators:f SYSTEM:f /y /c
fsutil reparsepoint delete C:\WINDOWS\$NtUninstallKB19946$\2334308791 /c
xcacls.exe C:\WINDOWS\$NtUninstallKB19946$ /p Administrators:f SYSTEM:f /y /c
fsutil reparsepoint delete C:\WINDOWS\$NtUninstallKB19946$ /c
rd /s/q C:\WINDOWS\$NtUninstallKB19946$ /c
:commands
[clearallrestorepoints]
[emptytemp]

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

[mattbiel]

Thank you, thank you, thank you! Everything is great.

[thisisu]

Originally Posted by mattbiel

Thank you, thank you, thank you! Everything is great.

You're welcome