Rootkit ZeroAccess removed by Combofix, no internet connection thereafter

[chaslang]

You're welcome. Don't reinstall AVG until you get to last step in the below where the instruction in the How to protect.... link talk about having an antivirus installed.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

[visitavisroy]

Hi chaslang, really sorry to bother you again but seems like some final healing touches are still needed.

I followed your instructions of final cleanup (removing tools, combofix, MGClean, etc). Removed Malwarebytes, replaced trial SuperAntiSpyrare with a paid version, installed Avira, installed Comobo Firewall-only, CCleaner and updated windows.

However, after downloading windows updates and a reboot (required after removal of old SAS), the machine again had no connectivity. I re-ran your last instructions (ie sfc /scannow, visitavisroy.reg). The .reg merger was a partial success. Reboot and the connectivity was back.

Ran full version SAS and found no malware infection. Also ran FSS and MGlogs.bat. Comodo threw up a lot of warnings during MGlogs.bat but allowed them to let it run.

Attached are the logs. Keeping the machine turned on till your response.

I am bothering you on this one case for way too long

[chaslang]

Something has deleted your IPsec registry key again. At this point your problems do not really seem to be due to malware but rather seem to be due to either something you are running or due to just some corruption of drivers on your PC or due to a problem with Windows itself. The only way to probably resolve this at this point is likely to perform a totally new clean install of Windows.

Otherwise we would just be repeating the same kind of steps every day.

[visitavisroy]

Yes, you are right as usual. I just re-installed xp and things are fine now

Thanks a lot for your all your effort.

Cheers!

[chaslang]

You're welcome. You should work your way thru the below now:

How to Protect yourself from malware!

[visitavisroy]

Hi chaslang, have done the needful as per your instructions. Guess we can terminate the thread here. As always, thanks again!