ZeroAccess Infection

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by tmfs, Jan 9, 2013.

  1. tmfs

    tmfs Private E-2

    I recently discovered a virus infection on my laptop after installing CloneCD which was downloaded from CNET (might have been unrelated). I have spent a bunch of time running online scanners and other antispyware programs I'm familiar with (ESET, Pandasoft, MBAM, SAS, Sophos) in windows regular and safe modes. Initially they showed some viruses etc. but now are showing up clean (unfortunately I didn't make note of the order of events nor the infections that were found though I may be able to dig up earlier logs). Despite scans showing up clean, I still had one symptom that concerned me which was that iexplore.exe kept showing up in the process list in task manager even though I had never started it. Eventually I ran through the "Read & Run me first" and noted that Roguekiller log made several references to ZeroAccess infection. Further research on this trojan leads me to believe that I had a ZeroAccess infection a year ago on this machine (based on how it operates) which I thought dealt with but may not have been completely removed. Given what I've learned about the dangers of ZeroAccess, I want to be sure that it is fully removed. I have attached logs as per the guide. Thanks in advance.
     

    Attached Files:

  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Re run Hitman and have it delete Potential Unwanted Programs

    [​IMG] Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these 2 detections:

    • [RUN][SUSP PATH] HKCU\[...]\Run : NewTech Infosystems (Rundll32.exe "C:\Users\ddavis\AppData\Local\NewTech Infosystems\leqntmrl.dll",?beep@CFlashIK@@QAE_NXZ) -> FOUND
    • [RUN][SUSP PATH] HKUS\S-1-5-21-3018765741-308787788-264681686-1001[...]\Run : NewTech Infosystems (Rundll32.exe "C:\Users\ddavis\AppData\Local\NewTech Infosystems\leqntmrl.dll",?beep@CFlashIK@@QAE_NXZ) -> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.

    and the same for these items on file/folder tab please..

    • [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$5c6b9d6734d238184c6814b55c231f60\U --> FOUND
    • [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3018765741-308787788-264681686-1001\$5c6b9d6734d238184c6814b55c231f60\U --> FOUND
    • [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$5c6b9d6734d238184c6814b55c231f60\L --> FOUND
    • [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3018765741-308787788-264681686-1001\$5c6b9d6734d238184c6814b55c231f60\L --> FOUND
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.



    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    After reboot, check to see if your firewall is working.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
  3. tmfs

    tmfs Private E-2

    Hi Kestral,

    Thanks so much for the help. I got through that. I'm not sure I did the roguekiller instructions quite right as I got 3 new logs from it. I've attached all 3.
    Everything else worked fine. I can turn the firewall on and off, but I don't off hand know how to verify that its working well. I'll try do some research on that later.

    I haven't used this machine very much since I finished the instructions, but there have been no noticeable problems so far and I haven't seen iexplore.exe pop up in taskman uninvited.

    Let me know if we need to do any more...

    Thanks,
    TMFS
     

    Attached Files:

  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard. This opens the Run dialog box.
      • Copy and paste the below into the Run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.
    8. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  5. tmfs

    tmfs Private E-2

    Thanks again Kestral, that wasn't as difficult as I had feared. So the logs look clean now?

    On reviewing some of the logs myself I noticed some references to snap.do which jogged my memory. It was snap.do searches appearing that triggered my malware removal efforts. I found that the Chrome homepage and several registry entries were still referencing snap.do so I ran JunkwareRemovalTool from bleepingcomputer (sorry, I should have asked first). Since I did, I attached the log.

    Any further concerns or scans I should do as a result of that revelation?

    Thanks,
    TMFS
     

    Attached Files:

    • JRT.txt
      File size:
      2.6 KB
      Views:
      2
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    No ;) You're all good.
     
  7. tmfs

    tmfs Private E-2

    Thats great. Just two last questions as I go forward.

    1) Would you say we were actually just cleaning up remnants of the ZeroAccess rootkit that were left over from my previous run in? Or was it likely active the whole time? Just trying to assess how much personal information may have been compromised over the last year.

    2) Were the the two registry entries and the file leqntmrl.dll related to the Backup software Acer had on my machine? or just hidden to look that way? If so, should I just uninstall it completely since I don't use it?

    Thanks again for all your help!
    TMFS
     
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yea, it looked like just remnants to me. Nothing was too deeply rooted in.
    leqntmrl.dll is nothing to do with Acer, no.

    Most welcome!
     
  9. tmfs

    tmfs Private E-2

    I see I can't drop some pennies in the beer fund for you so I'm off to buy some MajorGeeks gear. Thanks again,

    TMFS
     
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Thanks tmfs for showing your support!! :) MUCH appreciated!! :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds