Rootkit and ZeroAccess

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by RodimusPrime98, Jul 16, 2012.

  1. RodimusPrime98

    RodimusPrime98 Private E-2

    It looks like I am being hit with the recent attack of a ZeroAccess or a combination of such. I have run Malewarebytes, ESET online, and AVG. It started as Windows Shield malware, then websites were being redirected and Microsoft Security Essentials was being disabled.
    1. First I tried the instructions here for removing Windows Shield:
    http://www.bleepingcomputer.com/virus-removal/remove-windows-shield-tool

    2. Then I tried these instructions for removing Dropper.Generic_c.MMI which AVG was finding by using these instructions for removing and replacing the Services.exe while in safe mode:
    http://forums.avg.com/ww-en/avg-forums?sec=thread&act=show&id=209835&page=6&type=0

    3. The current status is that AVG is detecting:
    a. c:\Windows\assembly\GAC_64\Desktop.ini (infection: Trojan horse Generic28.ANIC)
    b. c:\Windows\assembly\GAC_32\Desktop.ini (infection: Trojan horse BackDoor.Generic15.AXLA)

    Googling the above current issues lead me here to this site where it looks like a few moderators have had success helping those with this particullarly nasty malware/trojan/virus. TimW seemed to have luck here: http://forums.majorgeeks.com/showthread.php?t=261783

    I have started your process by performing this:
    http://forums.majorgeeks.com/showthread.php?t=35407
    This has lead me to:
    1. uninstall MS Security Essentials, Secunia PSI, ESET online scanner, and Malwarebytes and leave only AVG
    2. Completed Step 4 and 5.
    3. Step 6 shows that the Zeroaccess and others still exsist and the logs are attached.

    Any help is greatly appreciated.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Yes you definitely have a ZeroAccess infection. We need to run another scan to collect info for a fix we will make.

    Please do the below so that we can boot to System Recovery Options to run a scan.

    For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
  3. RodimusPrime98

    RodimusPrime98 Private E-2

    Thanks for your quick response, please find attached the new scan log file.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download this >> View attachment fixlist.txt


    Save fixlist.txt to your flash drive.
    • You should now have both fixlist.txt and FRST64.exe on your flash drive.
    Now reboot back into the System Recovery Options as you did previously.
    Run FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • Fixlog.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  5. RodimusPrime98

    RodimusPrime98 Private E-2

    I performed the requested actions and attached are the files.

    In general, the computer seems to be running better and AVG has not flaged a realtime threat lately. No more browser re-directs either.

    Here are my remaining questions:
    1. Is ZeroAccess removed and the computer corrected now?
    2. How can I be sure that the actions taken truly removed all aspects effected by this virus/trojan?
    3. How can I best protect myself from rootkits in the future? (ie. Is MS Security Essentials no longer the recommended program? Should I be using AVG, ESET, Norton, McAffee, Malwarebytes, etc.? Seems like I should cross reference the results of more than one of these programs but I understand you should not run/have installed more than one at a time; this makes regularly scheduled scans a pain!)
    4. Why did your approach to resolving the ZeroAccess use different methods than others in this forum? (Such as 'Combofix', etc.)
    5. I have not run a full scan using AVG (because I have not been instructed to yet by you), is it ok to run virus scans now and check for problems?

    Thanks again for your help!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The heart of the infection is gone but the infection broke your Windows FIrewall an some other services . Thus, there is some additional repair work to do.

    When we say you are clean, in most cases you will be clean. However there is no 100% guarantee that a PC is clean once it has been infected and in fact, once it is connected to the internet there is no guarantee. ;)

    Covered when we get to final instructions.

    Different Windows Operating system, different forms of an infection, .....etc result in differing actions.

    Don't do anything unless requested. Once we have finished, you can the freely do what you want.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.



    Be patient while doing the below. The fixes can take quite awhile to run. Especially the permissions repairs. It may be best to kick it off and goto bed or do something else. It is better not to run anything while the repairs are going on.

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  7. RodimusPrime98

    RodimusPrime98 Private E-2

    Thanks for responding to all my questions. Do you feel that any of the big anti-virus company tools for removing ZeroAccess would be as effective as the process you are having me use?
    Also, I apologize I did run an AVG scan before I heard back from you, it does not seem to have found anything or taken any action. Please let me know if this has effected your repair process. Again, I apologize I thought we were done, I will not do anything unless instructed to or you tell me I may do so.

    The registry change process you had me perform worked successfully.

    The Repair_Windows.exe completed and rebooted successfully.

    Attached are the new MGTools log.

    Overall the computer seems to be running better and not randomly running at full power for no reason. It sleeps as it is supposed to, when it previously had issues with this. No recent anti-virus warnings.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    Not a chance!!! And in addition, they would not repair the damage the infection cause either.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    8. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
  9. RodimusPrime98

    RodimusPrime98 Private E-2

    So I followed your instructions: uninstalled the tools we used, removed AVG and installed MS Security Essentials, installed Comodo firewall.

    Last night MS Security Essentials found Win64/Sirefef.B (See attached image of scan after MS says it fixed it). It says it has been cleaned by I am not fully convinced.
    Also, I ran a Malwarbytes scan and it did not find any issues.

    I reinstalled MGTools and attached a new log.

    What should I do to ensure everything is truly resolved with this PC?
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just a left over from some previous scan tool you may have run. It was not active. It was a file "pending deletion". MSE should have no problem removing this since it is not an active infection. Your PC is clean.

    Just make sure you have completed all of my final instructions including removing MGtools again and also toggling system restore.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds