zeroaccess infection.

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by drmax, Jan 25, 2013.

  1. drmax

    drmax Private E-2

    Hello and not trying to go around any rules here...it's just that I had already perfrom a scan with rougekiller, and have my report. I appear to be infected, but do not know how to remove infection. Here is my report...
     

    Attached Files:

    Last edited by a moderator: Jan 25, 2013
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

  3. drmax

    drmax Private E-2

    attached in the other post
     
  4. drmax

    drmax Private E-2

    Thankyou for attaching appropriately. I am also suppose to report that I found no issues with tdsskiller, malwarebites, and I was unable to have a log created with mgtools, after following the directions as indicated. The only things we have to work with is the RK log.
     
  5. drmax

    drmax Private E-2

    I was able to create the log from mgtools....I will attach and it is zipped.
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What about Hitman, were you able ti run that? :)
     
  7. drmax

    drmax Private E-2

    Rerunning hitman now. I was unable to save a logfile. Hold tite
     
  8. drmax

    drmax Private E-2

    It states "no threats found"
     
  9. drmax

    drmax Private E-2

    NEW malwarebytes "anti rootkit" software beta

    I ran this and BAM! All gone a repaired. I'll be buying a subscription from these folks tomorrow!!
     
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Re: NEW malwarebytes "anti rootkit" software beta

    I thought you said Himan said no threats found, so what exactly found something?

    Uninstall the below:

    Coupon Companion Plugin
    ParetoLogic Data Recovery


    The below entries may or may not show, but have a look anyway:


    [​IMG] Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these 3 detections:

    • [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$1e9339da09b7843ff081d435102d9026\U --> FOUND
    • [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-2872747093-637173786-3556813959-1000\$1e9339da09b7843ff081d435102d9026\U --> FOUND
    • [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$1e9339da09b7843ff081d435102d9026\L --> FOUND
    • [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-2872747093-637173786-3556813959-1000\$1e9339da09b7843ff081d435102d9026\L --> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.


    Now re run RogueKiller (just a scan) and then attach the new log for me.
     
  11. drmax

    drmax Private E-2

    Here you are. I did not see those 3 files listed as you requested....(btw, there were 4 files you pointed out) As I previously stated, that 1st Rk report you read was prior to me running the malware bytes.
     

    Attached Files:

  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Now explain how things are running please.
     
  13. drmax

    drmax Private E-2

    Wonderfully! Thank you
     
  14. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    ;)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds