Please Help: Zero.Access Rootkit

Friends computer lost internet access the other day and access to Peachtree accounting. Error message "unable to renew IP address". Repair of tcp/ip and Winsock did not solve problem. Ran ComboFix, and it discovered Zero.Access Rootkit has affected the tcp/ip stack.

After running combofix, computer still cannot obtain an ip address and peachtree still does not work as it uses tcp/ip to access data files on computer, so the problem still exists.

Hardware is fine, need to figure out how to recover now from the infection.

I'll upload all the required logs.

Thanks for reviewing and your help.

Fisher01

 

Here's the other logs.

Thanks for reviewing.

Fisher01

 

Hi and welcome to Major Geeks, fisher01!

Please also attach the log from MBAM and MGtools.exe (c:\MGlogs.zip) as requested by the Read and Run Me first thread.

 

I'm in the process of doing all the steps in the read me first thread. I'll post all new scans results once completed. Thanks

 

Ok, I went through the readme first instructions and followed them in detail.

The computers OS is Windows XP Home SP3, 32bit.

The same problems still exist after following all the instructions. Windows is unable to obtain an IP address and Peachtree will not work as it requires a working TCP/IP, to access the data on the computer. Enclosed are the new log files.

Thanks for your help.

Fisher01

 

And here's the MGTools Zip file.

Thanks again.

Fisher01

 

http://img716.imageshack.us/img716/4756/msmsg.gif Please download Disable/Remove Windows Messenger by Doug Knox to your desktop.

• See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
• Double-click MessengerDisable.exe
• Place a check-mark in Uninstall Windows Messenger
• Click Apply
• Click Exit

http://img825.imageshack.us/img825/2648/hjt.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Choose "Do a system scan only" and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

========WARNING========
The below is specifically for fisher01's computer
Do NOT run the below if you are not fisher01
Doing so may damage your PC!
========WARNING========

Attached to this post is afd.zip

Inside is:

• afd.reg
• fixme+restart.bat

Extract both files to the infected computer's desktop.

First double-click afd.reg and allow it to merge into the registry. You should receive a successful message.

Now reboot your PC.

Once you have rebooted...

Test your internet, If it still is not working, run the fixme+restart.bat file by double-clicking it.
Your PC will reboot again. Once you are back in Windows, test your internet again.

If it still does not work, attach the fixme_results.txt file the .bat file created.

 

I've followed your directions and the internet is working again. I did not have to run the fixme+restart bat.

However, the Peachtree Acounting software will still not open. Says program incurred an error and had to shut down. When I talked to their tech support the other day, they said it couldn't open because the tcp/ip wasn't working. Any suggestions, or I'll give them a call tomorrow.

Thanks for all your help here.

 

Glad to hear it.

I do not know about this software. You may try asking for help with this in the Software forum.

You can tell them TCP/IP is working now. :-D
TCP/IP is related to your internet. Has nothing to do with programs not being able to open/shutting down immediately.

You're welcome, surf safely!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!