ZeroAccess Help

Removed ZeroAccess with ComboFix, can connect to the wireless router but not the Internet ….other PC's work fine, Removed and intstalled drives, removed and installedTCP/IP. Released and renewed IP along with catalog ect……….really need someone to help me on this one,…..running XP. Thanks

Hi mcdc1224 and welcome to WhatTheTech forums!
I'm Sunyata and I will be helping you with your computer problems.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts before I post them. This is to ensure that I am giving you the best possible advice. This may cause a delay, but I will do my very best to keep it as short as possible.

Please read the following guidelines which will help to make cleaning your machine easier:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• The fixes I will give you are specific to your problem and should only be used for this issue on this machine.
• Please make sure to carefully read any instructions posted. If you're not sure, please stop and ask!
• Please stay with this thread until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that all malware is gone.
• PLEASE DO NOT install/uninstall any programs unless asked to.
• PLEASE DO NOT run any malware scans other than those requested.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
• I will reply back shortly with instructions

Note to Vista and Windows 7 users:

• These tools MUST be run from the executable. (.exe) every time you run them
• These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")

Thanks and waiting for your reply!!

Hello mcdc1224

Please post the output from all the ComboFix runs…

Output from your latest run should be in:

C:\ComboFix.txt

Output from all your previous runs should be in:

C:\Qoobox\ComboFix2.txt
C:\Qoobox\ComboFix3.txt
…
etc

Next,

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure "Include All Files" option remains checked.
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Here are the results. Thanks Farbar Service Scanner Version: 14-02-2012 Ran by [removed] (administrator) on 16-02-2012 at 21:34:51 Running from "J:\" Microsoft Windows XP Professional Service Pack 3 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Attempt to access Google IP returned error: Google IP is offline Attempt to access Yahoo IP returend error: Yahoo IP is offline Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ Windows Update: ============ File Check: ======== C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit C:\WINDOWS\system32\netman.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\srsvc.dll => MD5 is legit C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit C:\WINDOWS\system32\wscsvc.dll => MD5 is legit C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit C:\WINDOWS\system32\wuauserv.dll => MD5 is legit C:\WINDOWS\system32\qmgr.dll => MD5 is legit C:\WINDOWS\system32\es.dll => MD5 is legit C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit C:\WINDOWS\system32\svchost.exe => MD5 is legit C:\WINDOWS\system32\rpcss.dll => MD5 is legit C:\WINDOWS\system32\services.exe => MD5 is legit Extra List: ======= Gpc(6) IPSec(11) NetBT(12) PSched(7) Tcpip(10) 0x0C0000000B00000004000000010000000200000003000000050000000600000007000000080000 00090000000A0000000C000000 **** End of log ****

combofix

Hello mcdc1224

You were indeed infected with the ZeroAccess rootkit. One of the capabilities of this infection includes a "backdoor." Backdoors are very dangerous because they use advanced techniques as a means of accessing a computer system that bypasses security mechanisms. They can gain unauthorized access to your computer and take control of it without your knowledge, stealing sensitive information which they send back to the hacker.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach. Please read How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud for more information.

We can remove what we see that needs to be removed, but I cannot guarantee that we can get your computer completely clean. With this type of infection, the hacker may have left other means to access your computer that we cannot detect. The only way to guarantee a clean computer after such an infection is to "flatten" it. This means we must do a low-level reformat of your drive and re-install the operating system.




Please respond how you wish to proceed: Malware removal, or OS reinstall.



If you wish to proceed with malware removal, please perform the following steps…

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
• When asked if you want to download Avast's virus definitions please select Yes.
• Click the Scan button to start scan.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]

Next,

Please download OTL to your desktop.

• If you are using Firefox, make sure that your download settings are as follows:
  

  -Tools->Options->Main tab
  -Set to "Always ask me where to Save the files".

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
%systemroot%\*. /rp /s
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

In your next reply please post the contents of:

• aswMBR.txt
• OTL.txt
• Extras.txt

Sounds like it must be a reinstall to be safe, if you think thats the best………..just hate losing all my programs. Thanks

Hello mcdc1224

Sounds like it must be a reinstall to be safe, if you think thats the best

I just want to be clear that I am not telling you what is best. I am communicating what the possible risks are. The decision is yours based upon your willingness to accept those risks measured against how much pain and inconvenience you will indure by a flatten / reinstall. Also, I don't know if it is necessary to lose your favorite programs. If you have valid licenses for them, you should be able to reinstall and get them back after you wipe everything clean.

If the reinstall is the way you wish to go, here is a link that describes the process:
http://forums.whatthetech.com/index.php?showtopic=91962

If you need help with this process, open a new topic in our windows forum here:
http://forums.whatthetech.com/index.php?showforum=119

If you do post for help in the windows forum, please be sure to include a link to this thread to give your helper some background.
We will leave this thread open for a few days, if you change your mind. If you do change your mind, just post back here with the logs from the scans I asked you for.
Also please post the requested logs if you would like us to try cleaning the machine first.

What ever you choose, good luck to you and safe computing

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic