Root Kit Zero Access Max++

PoolBoy · Aug 13, 2012

Hello and thanks for this web site.

I first noticed an occasional beep while using the computer. I then went to open and run MS Security Essentials and the icon was missing from my system tray. Went to START, ALL PROGRAMS, SECURITY ESSENTIALS and tried to launch and got the following error message; "Couldn't start the security essentials service." At that point I knew I had been hit with something.

Normally I would start with TDSKiller but it would not launch, skipped to SuperAntiSpyware and started scan and then came here to find out SAS not used anymore. Cancelled that scan and started RogueKiller which took me to a RK web page mostly in French telling me about Root Kit Zero Access Max++ and had instructions on how to remove which I followed. Then ran Maywarebytes which found 6 items and removed those.

As I was desperate I ran Combofix which came up with error "Advanced AntiSpyware Running" Please stop or disable in order to run scan.

I then ran iExplorer.exe as I knew this was a false error message but did not know else how to kill it.

To make a long story short, it took a couple of more scans of Malwarebytes in Safe Mode to come up with a clean scan.

Where I stand now. TDSKiller now runs and says nothing found. Security Essestials shows up in my system tray but is red and when I open it it says it is not protecting my system and then I try and click START NOW and it says can't start.

WIN XP Pro

TimW · Aug 14, 2012

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

PoolBoy · Aug 14, 2012

So I ended up removing and re-installing MS Security Essentials which got it working again.

Thanks for looking. I didn't realize that I had actually succeeded in getting rid of it since I could not get MS Security Essentials to work.

TimW · Aug 15, 2012

That infection typically breaks AV software. So a reinstall is usually all it take to fix it. Good to know you are working well. Safe surfing.

Log in or Sign up

Root Kit Zero Access Max++

PoolBoy Private E-2

Attached Files:

RKreport[1].txt

mbam-log-2012-08-13 (07-57-18).txt

HitmanPro_20120813_0757.log

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

PoolBoy Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member