MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 10-24-11, 17:05
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Zero Access Rootkit Removal

Good afternoon,

I have come to the conclusion that my desktop PC has been infected with a Zero Access Rootkit. I downloaded and ran ComboFix and it confirmed the presense of this rootkit. I have reviewed the other threads about removing the rootkit, and the only thing I am not capable of is discerning the problem entries in the ComboFix log, which I have attached. I know you are very busy, but I would very much appreciate your help in this matter.

Also, I have already downloaded The Avenger and TDSSKiller. I refrained from downloaded Win32Diag.exe since I wasn't sure about the link provided by google. Please let me know if I need addtitional removal software. Thank you.
Attached Files
File Type: txt log102411.txt (14.8 KB, 6 views)
Reply With Quote
Sponsored links
  #2  
Old 10-24-11, 18:36
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,087
Thanks: 991
Thanked 3,782 Times in 3,683 Posts
Default Re: Zero Access Rootkit Removal

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run


Please also download MBRCheck to your desktop
  • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
  • It will show a Black screen with some information that will contain either the below line if no problem is found:
    • Done! Press ENTER to exit...
  • Or you will see more information like below if a problem is found:
    • Found non-standard or infected MBR.
    • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
  • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
  • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Download and run Win32kDiag per the below instructions:
  • Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
  • Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log
C:\win32kdiag.exe -f -r


Now we need to scan the system with this special tool.
  • Please download Junction.zip and save it to your root folder (C:\Junction.zip)
  • Unzip it and put junction.exe in the root folder (C:\junction.exe)
  • Now click Start => Run... => Copy and paste the following command in the run box and click OK:
    cmd /c junction -s c:\ >C:\log.txt
  • A command prompt window opens and also a license agreement from SysInternals will appear.
  • Accept the license agreement and the scan will begin.
  • Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes). (How to attach items to your post)
  • NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.


And one more scanning tool I want to use to collect more information is OTL per the below.

Please download OTL by Old Timer to your desktop.
See the download links under this icon:
  1. Double-click OTL.exe to run (Vista and Win7 right click and select Run as Administrator)
  2. When OTL opens, change the Output (at the top-right portion of the program) to Minimal Output.
  3. Put check-marks in LOP Check and Purity Check.
  4. Now click the button.
  • When the scan is complete, two logs entitled OTL.txt and Extras.txt will be created on your desktop.
  • Attach both of these logs to your next message as well as any other requested logs.

Then you need to make sure that you complete as much as you can of the below.


Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and attach the requested logs when you finish these instructions.
  • **** If something does not run, write down the info to explain to us later but keep on going. ****
  • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.
  • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
Helpful Notes:

  1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
  2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
  3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
  4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #3  
Old 10-25-11, 12:36
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

Kestrel,

I ran through the read and run me. Interestinly, SAS didn't report any viruses; didn't even report any cookies. Also, the ComboFix log I attached (CFlog102511) is the combofix log generated after running everything in read and run. My next post has the outputs from the other checks.
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 10-25-2011 - 09-04-46.log (578 Bytes, 2 views)
File Type: txt mbam-log-2011-10-25 (09-28-23).txt (902 Bytes, 1 views)
File Type: txt CFlog102511.txt (13.0 KB, 1 views)
File Type: txt TDSSreport102511.txt (26.3 KB, 1 views)
Reply With Quote
  #4  
Old 10-25-11, 12:39
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

More output.
Attached Files
File Type: txt MBRCheck_10.25.11_11.27.23.txt (9.3 KB, 1 views)
File Type: txt Win32kDiag.txt (436 Bytes, 1 views)
File Type: txt rootrepeallog102511.txt (35.3 KB, 1 views)
File Type: txt OTL.Txt (106.7 KB, 1 views)
Reply With Quote
  #5  
Old 10-25-11, 12:52
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

Last one.

It seemed very odd to me that SAS, MBAM, and TDSSKiller did not show anything. After the first run of ComboFix, a window popped up stating that it detected a rootkit. After doing the read and run, the ComboFix I ran today did not end with a window about a detected rootkit. I don't how it would have been taken care of since yesterday.
Attached Files
File Type: txt Extras.Txt (50.5 KB, 1 views)
Reply With Quote
Sponsored links
  #6  
Old 10-25-11, 19:27
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,087
Thanks: 991
Thanked 3,782 Times in 3,683 Posts
Default Re: Zero Access Rootkit Removal

Please also attach the C:\MGlogs.zip. I need that too.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #7  
Old 10-26-11, 11:20
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

Sorry about that; had it on hand, just forgot to add it.
Attached Files
File Type: zip MGlogs.zip (154.0 KB, 1 views)
Reply With Quote
  #8  
Old 10-26-11, 18:29
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,087
Thanks: 991
Thanked 3,782 Times in 3,683 Posts
Default Re: Zero Access Rootkit Removal

The logs look good. Describe to me how things are running please.

I would also like you to uninstall the below:

AVG 9.0
<--- Outdated and could have been compromised.
Java(TM) 6 Update 20 <--- Outdated.

Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

You can get the current version of AVG HERE.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #9  
Old 10-27-11, 17:09
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

Everythings seems to be running normal now. I uninstalled and reinstalled AVG 9.0 and Java. I feel like the boy who cried wolf, but my first combofix run said there was a rootkit. After the read and run, the next combofix run didn't mention it. It is not still lurking around hiding from detection? I guess that's one of the reasons y'all ask for the read and run. I really appreciate the help.

How can I help support this website and the work y'all do?
Reply With Quote
  #10  
Old 10-27-11, 17:44
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

Just an addition here; I ran the reinstalled AVG, and it found and removed/healed the viruses listed in the attached document. I don't know why SAS and MBAM didn't find these, but, hopefully, that is the end of them. Thank you again for your help.
Attached Files
File Type: txt NEW AVG SCAN RESULTS.txt (3.2 KB, 8 views)
Reply With Quote
Sponsored links
  #11  
Old 10-27-11, 19:29
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,087
Thanks: 991
Thanked 3,782 Times in 3,683 Posts
Default Re: Zero Access Rootkit Removal

What AVG found in system, restore is not a problem, however it concerns me that it is nuking it's own files. Hope it has not been compromised due to something still hiding.

Run Combofix again and see what the result of that is, attach its log.

Also run this please.

Please download GMER and save it to your desktop:
  • Unzip (extract) it to your desktop.
  • Disconnect from Internet and close all running programs.
  • There is a small chance this application may crash your computer so save any work you have open.
  • Double-click gmer.exe to run it.
  • Let the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan... click NO.
  • Click the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Then click the Scan button. Wait for the scan to finish.
  • Once done, click the Copy button.
  • This will copy the results to the clipboard. Open Notepad and press CTRL + V to paste the log, and save it to your desktop. Attach this log to your next reply.

NOTE: If you're having problems with running gmer.exe, try it in Safe Mode. This tool works in Safe Mode whereas many other rootkit revealers do not.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #12  
Old 10-28-11, 10:30
samwise753 samwise753 is offline
Private E-2
 
Join Date: Oct 2011
Posts: 8
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Zero Access Rootkit Removal

I've attached those logs.

You should know, the infected AVG files were from AVG 9.0, which was the full version on my computer prior to these problems, not the free version I downloaded yesterday, AVG 2012. I think those infected files were from the previous version; I'm not sure if uninstalling the previous version should have gotten rid of any infected files. I wasn't sure if you were saying the newly installed AVG was compromised.
Attached Files
File Type: txt log102811.txt (18.0 KB, 1 views)
File Type: txt GMERlog102811.txt (3.6 KB, 1 views)
Reply With Quote
  #13  
Old 10-28-11, 10:46
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,087
Thanks: 991
Thanked 3,782 Times in 3,683 Posts
Default Re: Zero Access Rootkit Removal

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required (If we renamed it please rename it back to Combofix.exe.
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Zero Access rootkit clean up help, please whatmeworry Malware Removal 12 10-18-11 19:49
Help removing Zero Access Rootkit timmytheman2 Malware Removal 151 10-11-11 00:25
Help removing Zero Access Rootkit 3 Dollar Bill Malware Removal 11 09-25-11 15:13
0 access (zero access) rootkit discussion Blizzardess Malware Removal 3 09-15-11 11:39


All times are GMT -5. The time now is 19:12.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger