"Win64.Patched.a" and "Zeroaccess"

Sirbossman · Sep 30, 2012

I have been repeatedly recieving warnings that I have been infected with the Win64.patched.a virus by my AVG shield. I've done a scan which told me that the virus was "white-listed as a critical component" and that there were two trojans; the "Backdoor.Generic15.CGSY" and the "Generic29,ANPX". After using CCleaner like the READ ME FIRST Forum said, AVG stopped reporting the two trojans. I performed another scan to make sure and the only alert was the Win64.patched.a with the same white-listed result and no sign of the two trojans. I then performed the Roguekiller scan which informed me that I was infected with "Zeroaccess". I was able to scan and upload all the files from all the programs in the Malware removal guide in the READ ME FIRST Forum except the scan for TDSSKiller. I was able to scan my computer, but it hasn't given me a report after three scans. Malwarebytes hasn't detected any problems in any of the scans either. Help me please remove all the viruses and trojans on my computer. The logs should be attached.

TimW · Sep 30, 2012

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

Now, click the Files/folders tab and locate these detections:

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{282ab9b8-5a92-1b1f-43a9-47b04739af10}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{282ab9b8-5a92-1b1f-43a9-47b04739af10}\L --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
[Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Do not reboot your computer yet.

Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.
Choose to Delete these files if they are detected:

C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Windows\Installer\{282ab9b8-5a92-1b1f-43a9-47b04739af10}\L\ (ZeroAccess)
C:\Windows\Installer\{282ab9b8-5a92-1b1f-43a9-47b04739af10}\U\

Ignore all other detections.
Afterwards, click the Next button.
HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

What is this:
C:\Users\Jeffrey\Documents\4e60dc37.exe?

Now re-scan with both Hitman and RogueKiller and attach both logs.

Tell me how things are running now.

Sirbossman · Sep 30, 2012

I've done as you've asked. During the HitmanPro scan, it detected a services.exe file but it reported it as suspicious and not a virus. I told HitmanPro to replace it anyway and I noticed right before Hitman closed that it said unable to replace. I rescanned as you said, but it didn't appear in the scan. I assumed it either replaced or deleted the virus. I noticed after the first Roguekiller scan, there was three reports instead of one so I'm going to post all of them. Report 4 is supposed to be report 2. The rescanned report is number 5. By the way, I have no idea what C:/Users/Jeffrey/Documents4e60dc37.exe is. Should I delete it? My computer seems to be fine. My AVG trial has run out so AVG Resident Shield can't alert me of any viruses. I currently have no way of knowing wether or not I have viruses unless I use the Hitman, Roguekiller, or any of the other virus detectors the Majorgeeks supplied. I had McAfee before I posted this thread. Should I redownload it and scan my computer?

TimW · Oct 1, 2012

Rescan with HitmanPro.
Choose to Delete these files if they are detected:

C:\Users\Jeffrey\Documents\4e60dc37.exe

Ignore all other detections.
Afterwards, click the Next button.
HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

You can always re-download AVG freeware and scan with it.

After the reboot, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

Make sure you tell me how things are working now!

Sirbossman · Oct 1, 2012

Everything seems to be ok. Thanks for the help.

TimW · Oct 2, 2012

Attached is bfe.zip

Inside is:

BFE.reg

Extract bfe.reg to your desktop.
Double-click bfe.reg and allow it to merge into the registry. If you get a "successfully merged into registry" type of message, reboot your PC and see if you can turn on BFE, or if it is already turned on.

You can run these commands from the command prompt.

net start bfe

sc qc bfe

If after a reboot the service is still not running, do this:

Run regedit:
1. Browse to the location for the BFE service in the registry (HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy), right click and select permissions. (note: HKLM is short for HKEY_LOCAL_MACHINE_
2. In the “Permissions for Policy” window, click advanced | Add.
3. Once the “Select Users, Computers or Group” box appears, change the “From this location:” to point to the local machine name.
4. After changing the search location, enter “NT Service\BFE” in the “Enter the object name to select” box and click “Check names” – this will allow you to add the BFE account.

5. Give the following privileges to the BFE account:
Query Value
Set Value
Create Subkey
Enumerate Subkeys
Notify
Read Control

After adding the BFE account to the registry key, please try to start the Base Filtering Engine service.

Sirbossman · Oct 2, 2012

Done. Why do you think the BFE was missing? Is there anything else I should do?

TimW · Oct 3, 2012

If you open MGLogs.zip and look in the nwktst.txt log you will see that it was not running.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Log in or Sign up

"Win64.Patched.a" and "Zeroaccess"

Sirbossman Private E-2

Attached Files:

HitmanPro_20120929_2218.log

RKreport[1].txt

MGlogs.zip

mbam-log-2012-09-29 (21-49-25).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Sirbossman Private E-2

Attached Files:

RKreport[2].txt

RKreport[3].txt

RKreport[4].txt

HitmanPro_20120930_1600.log

RKreport[5].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Sirbossman Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Sirbossman Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member