Zero Access infection

Discussion in 'Malware Help (A Specialist Will Reply)' started by TheShadowKnows, Jul 6, 2012.

  1. TheShadowKnows

    TheShadowKnows Private E-2

    Hi!

    I am helping another person who has the Zero Access malware.

    I had run several AV programs, including ESET (online) and MBAM. I got it down to just the one (Rootkit.0Access).

    At this point I need knowegable assistence. I looked at similar posts over the last few years, but it looks like at some point each infection solution is customized to the particular incident.

    I went through the Read & Run Me First post and (if I don't mess up), the logs will be attached.

    Thanks for your help!

    Dan
     

    Attached Files:

    TheShadowKnows, Jul 6, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Download OTL to your desktop.

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
:killallprocesses
:files
C:\Windows\SysNative\drivers\dzbgakup.sys
C:\Windows\SysNative\drivers\zzrznmsp.sys
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG40AB.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG452E.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG5C36.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG5C37.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG5CF2.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG5F62.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG6386.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG654B.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG6F3A.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG6F59.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7014.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7062.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7301.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7330.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7448.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG75BF.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG76F7.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG78CB.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG79B5.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG7B79.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG81EF.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG82E9.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\BCG8B90.tmp
C:\Users\Lynsie Hall\AppData\Local\Temp\CVR5DC9.tmp.cvr
C:\Users\Lynsie Hall\AppData\Local\Temp\CVR7712.tmp.cvr
C:\Users\Lynsie Hall\AppData\Local\Temp\CVR8FA1.tmp.cvr
C:\Users\Lynsie Hall\AppData\Local\Temp\CVRB3F5.tmp.cvr
C:\Users\Lynsie Hall\AppData\Local\Temp\CVRFAC4.tmp.cvr
C:\Users\Lynsie Hall\AppData\Local\Temp\DDNi
C:\Users\Lynsie Hall\AppData\Local\Temp\G2MCodec.log
C:\Users\Lynsie Hall\AppData\Local\Temp\g2mE9D8.tmp
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.


    Now run CCLeaner to clean out your temp folders.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Jul 7, 2012
    #2
  3. TheShadowKnows

    TheShadowKnows Private E-2

    Hi!

    I downloaded OTL and ran it. (I did paste the code as directed.)
    It asked me to reboot and I did. I saw the report, but when I closed Notepad, there was no copy on the desktop. Was I supposed to save it? (If so, I apologize!)

    I ran CCCleaner.
    I ran Getlogs.bat (as Admin). Zip file is attached.

    The issues with this computer were intermittant, like randomly playing (Asian) music. Since MBAM seems to detect Zero Access, I ran a quick scan and it still reports a Rootkit.0Access infection.

    Dan
     

    Attached Files:

    Last edited: Jul 7, 2012
    TheShadowKnows, Jul 7, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please attach the log from running MBAM.
     
    TimW, Jul 8, 2012
    #4
  5. TheShadowKnows

    TheShadowKnows Private E-2

    Hi!

    I didn't save that log, so just repeated it.

    I did the quick scan with MBAM which reported Rootkit.0Access, removed the infection, rebooted. MBAM reports it as removed, but finds it again with the next scan.

    Then did it again three more times. (At which point I stopped and tipped my hat to Einstein. *sigh* Need a smiley for "insanity".)

    The last log is attached.

    Dan
     

    Attached Files:

    TheShadowKnows, Jul 8, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
:killallprocesses
:files
C:\Windows\Installer\{0d6d7987-fba3-da6f-fadc-f5965b18ad73}\U\800000cb.@
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Jul 8, 2012
    #6
  7. TheShadowKnows

    TheShadowKnows Private E-2

    Did as requested.

    After OTL and reboot, again the log appeared, but when I closed notepad, the log didn't appear on the desktop. But this time I copied the contents into another file (dan.txt) before closing notepad and I have attached that.

    After Getlogs.bat completed, I ran MBAM quick scan and it still finds the virus. I've attached the MBAM log.

    My apologies for taking so much of your time.

    Dan
     

    Attached Files:

    TheShadowKnows, Jul 8, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download ComboFix to your desktop and run it. Attach the log.
     
    TimW, Jul 8, 2012
    #8
  9. TheShadowKnows

    TheShadowKnows Private E-2

    Hi, Tim!

    I have an issue and I don't want to continue without checking with you.

    I downloaded and ran ComboFix.
    It rebooted the computer.
    It then popped up a Window saying that it detected MSE antiVirus and antiSpyware running, and that I need to disable them before clicking Okay.

    However, I see no signs of MSE. No icons. No way to disable it. I checked msconfg and do not see it in the Start Up tab.

    When I try to check the firewall advanced settings, it throws an error saying "There was an error opening the Windows Firewall with Advanced Security snap-in."

    This computer was running MSE at one point, but that had been uninstalled and Spyware Hunter installed before my friend asked me to help.

    Since ComboFix warns that continuing without disabling these could cause unpredicible results or computer damage, I'm not sure what to do.

    Any advice?

    Dan
     
    TheShadowKnows, Jul 8, 2012
    #9
  10. TheShadowKnows

    TheShadowKnows Private E-2

    I forgot to add that my thought is to
    1) cancel out of ComboFix,
    2) download MS OneCare CleanUp tool and run that to hopefully clean up any remanents of MSE, then
    3) run ComboFix again.

    Dan
     
    TheShadowKnows, Jul 8, 2012
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Go ahead and try to do that. Let me know the results.
     
    TimW, Jul 9, 2012
    #11
  12. TheShadowKnows

    TheShadowKnows Private E-2

    Hi!

    Apparently MS OneCare Cleanup successfully removed the remenants of MSE!

    Reran ComboFix. Log attached.

    Dan
     

    Attached Files:

    • log.txt
      File size:
      31.3 KB
      Views:
      1
    TheShadowKnows, Jul 9, 2012
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It looks like Combo cleared the infection. Tell me what issues you are still having, if any.
     
    TimW, Jul 9, 2012
    #13
  14. TheShadowKnows

    TheShadowKnows Private E-2

    Wow, thanks!

    I've not experienced anything except the rare Asia music starting to play on its own. (It's my friends computer.)

    I just did the MBAM quick scan that had been reporting the infection, and it now shows as clean!

    I'd like to return the computer to my friend for a day or two to see if she notices anything before declaring victory. Is this reasonable?

    Also, I'd like to download and install an antivirus before returning the computer to her to protect the computer while she tests it. (She has bought Webroot for this computer.) Is that okay at this point?

    Dan
     
    TheShadowKnows, Jul 9, 2012
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your welcome.
    Yes, install and AV program and let her run it for a while.

    In the meantime:
    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Jul 9, 2012
    #15
  16. TheShadowKnows

    TheShadowKnows Private E-2

    Roger that! And hearty Thank You!

    Dan
     
    TheShadowKnows, Jul 9, 2012
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Jul 10, 2012
    #17

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds