MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.

Closed Thread
Thread Tools Display Modes
Old 09-03-11, 00:11
John24 John24 is offline
Private E-2
Join Date: Sep 2011
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Default Rootkit.Win32.zaccess.c removal success!!!

I was able to successfully remove this very stubborn Rootkit virus.

Lots of spyware antivirus tools needed...perhaps too many at times and then eventually ComboFix was able to get rid of it in Safe Mode. I probably ran ComboFix 5-6 times in safe mode before it even found it.

I had a file named {E9C1E0AC-C9B2-4c85-94DE-9C1518918D02}.tlb in C:\Windows\Temp and also a process which looked like two phone numbers. Mine started with 2194239936:2. Sorry I don't remember the whole name but it was 2 numbers which happen to be Harshad Numbers...

I could kill the process and remove the .tlb file with File Assasin but they would just come back on each reboot.

Products used
Dr Web CureIt Read More here-->
Webroot Spysweeper
Hijack This
Spybot Search and Destroy

Also ESET Online Scanner and Kapersky Online Scanner.

30+ hours to get rid of this virus. I wish I knew where I got it so I could get it again and streamline the removal process. I would say only the first 5 or so programs were helpful...the rest did find some stuff but I believe they found the easy stuff.

Also, once the Rootkit was removed I uninstalled all of the programs above and reinstalled Malwarebytes, SuperAntiSpyware, DrWeb Cureit, ComboFix, and Webroot Spysweeper and all found additional Cookies, Spyware, and old virus files in my restore points. I removed all of the old restore points and create new ones every time I remove more spyware.

I have an old computer I might try getting infected just so I can streamline the removal process.

Last edited by John24; 09-03-11 at 00:19..
Sponsored links
Old 09-03-11, 00:24
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,183
Thanks: 280
Thanked 1,441 Times in 1,358 Posts
Default Re: Rootkit.Win32.zaccess.c removal success!!!


I have an old computer I might try getting infected just so I can streamline the removal process.
You could also try using a Virtual Machine too. I use Virtual Box
Closed Thread

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Gone through read & run me first with no success please help with rootkit Anne808 Malware Removal 7 11-08-09 12:28
Rootkit-Agent.DI also named Win32/CutwailF removal?? mattknobs Malware Removal 9 07-29-09 22:33
Help with Win32:RustNT [Rtk] and Win32:Rootkit-gen [Rtk] mchoi325 Malware Removal 4 07-17-09 16:47
Win32:Rootkit-gen cyspur Malware Removal 3 05-15-08 16:02

All times are GMT -5. The time now is 22:50.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds

All content Copyright source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger