Unable to remove zero access rootkit - help.

Hi there,
Please could someone advise on getting rid of zero access rootkit.
Combofix seems to freeze at the part where it says it is attempting to fix - may take 10 minutes etc.
If I run in safe mode, it restarts and then freezes at Windows startup.
I have disabled McAfee and all the other anti malware software - superantispyware and malwarebytes but makes no difference.

Any help much appreciated.
Many thanks

 

Hi jimba10, welcome to MajorGeeks

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and then attach the requested logs to your next reply when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes, you could use a flash drive too, but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

* Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated - our system works the oldest threads FIRST.
​

 

Hi, thanks for the advice and instructions.
I've managed to download all the programs suggested to the desktop but have a problem where zero access rootkit has hidden all my desktop icons. I am unable to open 'My Computer' or even the control panel. Trying the run command does not work either.
I have run a command to unhide all the files but it does not make any difference 'Unhide.exe'.
Any other suggestions as I Cannot even run from a USB stick as the drives are not accessible.
Thanks

 

Were you able to open unhide.exe?
Did you see a DOS box open up, etc? Or are you saying it simply was not successful in restoring the icons on your desktop.

Which operating system are you on?

 

Hi, thanks for response.
Sorry, unhide.exe did not work as it would not run.
I had to open a command prompt and type ATTRIB -H *.* /S /D
A DOS window ran with lots of lines mostly stating 'Access Denied or files not unhidden'. It ran for about 10 minutes but still the files, folders and icons were missing on every profile.
I'm running Windows XP Home SP3.
Thanks

 

ZeroAccess itself doesn't hide files/folders. What makes you suspect that you are infected with ZeroAccess? Give me a bit more background on what you are experiencing and what you have experienced so far.

 

McAfee initially detected zero access after computer starting running slower and slower.
Ran a virus scan with McAfee which said it cleaned but every time restarted - it came back.
Ran Malwarebytes and Superantispyware but this did not find anything.
McAfee still detected Zero Access.
Ran Combofix in normal mode and it did not finish detecting, just froze, left overnight but no change.
Ran Combofix in saf emode, Combofix completed then restarted but McAfee still detected Z Access.
I had disabled McAfee during Combofix scan just to add.
When I restarted again, all files, folders, icons are missing, unable to open 'My Computer from start menu or control panel.
Unable to open files/folders from Run Command.
Managed to run Rogue Killer first time as the Administrator profile in Safemode allowed me to do so and it detected Zero access and saved the log file to desktop but I am unable to see it as it's hidden.
After I restarted, cannot see anything.
So not sure, if Combofix did something to my computer or it is still infected.
I'm stuck as I can't run anything now.
Hoping I don't have to do a recovery but it's probably looking that way.
Thanks

 

Try the following while in Safe Mode. We are going to try to unhide your files.

Open a command prompt window.

• Type in: explorer
• Now press ENTER
• A new window should have opened.
• In this new window, select Tools => Folder Options...
• A smaller window should have opened
• Click the View tab
• Look for the following item:
  • Show hidden files and folders <= Put a bullet in here by left-mouse clicking in the bubble.
• Look a bit further down and you should see:
  • Hide extensions for known file types <= Make sure there is not a checkmark in this box
  • Hide protected operating system files (Recommended) <= Make sure there is not a checkmark in this box.
• Now click OK at the bottom of the Window.
  • This closes the Folder Options window you were just in.
• Do you see your desktop icons and folders now?

 

Thanks thisisu
Files and Folders were already unhidden.

I managed to boot into safemode under the Administrator account and the icons have now appeared but only on this profile so took my chances and ran MGTools again, I selected to fix shortcuts and did a restart, my icons have now appeared again in normal mode on all profiles.
Offline, I have removed McAfee and installed Microsoft Security Essentials and did a scan in safe mode.
It has detected wn32/sirefef.AB and winNT/Necurs.A trojans so have selected to remove them and also ran another scan.
Not sure if this is the last of it now but so far things are looking good.
Fingers crossed.
Will repost if anything else happens. Thanks again