for Jeff - Need your expertise again! [Solved]

Hi,

If you get a message saying " Illegal operation attempted on a registry key that has been marked for deletion ", please restart your computer.

This should clear things up for you. I will look over your newest ComboFix log and get back as quickly as I can.

[external image: Posted Image] OTL

• Download OTL to your desktop.
• Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

———-

Hi,

If you get a message saying " Illegal operation attempted on a registry key that has been marked for deletion ", please restart your computer.

This should clear things up for you. I will look over your newest ComboFix log and get back as quickly as I can.

Good Morning Jeff!

I never got an e-mail alert about the OTL.exe instructions. I just happened to scroll down to what I thought was your last response, and that is when I discovered your instrucctions for OTL…geez!

anyway, I ran it last night here are the two files

dar

Hi,

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.
———-

[external image: Posted Image] FRST

Download the 64 bit version for your system of FRST and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

———-

hi wow - is this the same one I had last July? Seems this is familiar….. Anyway, I don't have any system disks - I did make a repair disk for windows 7 64 bit on march 31 2010 when I bought this laptop. I am making another one as a spare, just in case. I don't have any installation disks. None came with the pc. I will have to priint this page out to make sure I follow instructions. Can I continue if I don't hafe any installation disks? Please advise. I also will not be doing this tonight. I will do it tomorrow night after dinner, 7 pm EST. Let me know. NCIS is on…..I must go… dar

Jeff: How does one get infected with AccessZero Root Kit?? Please advise. dar

Hi,

How does one get infected with AccessZero Root Kit??

Please advise.

Well it's really hard to say how you have gotten infected because there are so many ways to do it and most of which are probably by no fault of your own.
————

Can I continue if I don't hafe any installation disks?

Let's see what we can get done using the instructions for FRST before we start worrying. When you get FRST ran and the log created, please post that.

Jeff

I'm a little confused on the most recent set of instruction.

Download the 64 bit version for your system of FRST and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options. <———- Where do I type this? Nohting happens when I put the thumb drive in with this program in it.

To enter System Recovery Options from the Advanced Boot Options:
•Restart the computer.
•As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
•Use the arrow keys to select the Repair your computer menu item.
•Select US as the keyboard language settings, and then click Next.
•Select the operating system you want to repair, and then click Next.
•Select your user account an click Next.

Dar

Hi,

How does one get infected with AccessZero Root Kit??

Please advise.

Well it's really hard to say how you have gotten infected because there are so many ways to do it and most of which are probably by no fault of your own.
————

Can I continue if I don't hafe any installation disks?

Let's see what we can get done using the instructions for FRST before we start worrying. When you get FRST ran and the log created, please post that.

Jeff

Your instructions on the 2nd paragraph state to insert installation disk - I don't have that - I only have a repair disk windows 7 64 bit - to run FRST it at the bottom of your instructions….I'm lost…

dar

Hi,

How does one get infected with AccessZero Root Kit??

Please advise.

Well it's really hard to say how you have gotten infected because there are so many ways to do it and most of which are probably by no fault of your own.
————

Can I continue if I don't hafe any installation disks?

Let's see what we can get done using the instructions for FRST before we start worrying. When you get FRST ran and the log created, please post that.

Jeff Thanks for have patience with me and the faith that I would figure it out. Attached is the log file from running FRST64 dar

Hi!

Great job!!

[external image: Posted Image] FRST

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\L
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\U

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
———-

Post the new FRST log and let me know how your system is running.

Good Morning Jeff!

I ran it…

I will reboot and try some stuff..

I have a meeting tonight, friday is impossible and saturday we are driving to Cleveland OH - so anything you want me to do will be done Sunday. Hope that is OK!

dar

Hi!

Great job!!

[external image: Posted Image] FRST

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\L
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\U

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
———-

Post the new FRST log and let me know how your system is running.

Good Morning!

I rebooted for the heck of it.

Word loads faster now, but after I open a file, I still get NOT RESPONDING - I'm beginning to wonder, is it a video display or something? Maybe a driver is corrupt? EXcel still has it too. My YOUTUBE videos ran better - here is my BEST: http://www.youtube.com/watch?v=IJbsIMyW3Eg

Is this nasty thing gone? I did check, and it's the same one I had summer July.

Question - my TrendMicro is due for renewal at the end of March. Is there a better anti virus out there that may have caught this nasty thing?

dar

Good Morning Jeff!

I ran it…

I will reboot and try some stuff..

I have a meeting tonight, friday is impossible and saturday we are driving to Cleveland OH - so anything you want me to do will be done Sunday. Hope that is OK!

dar

Hi!

Great job!!

[external image: Posted Image] FRST

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt

C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\L
C:\Users\DARLENE'S\AppData\Local\{4d69ce62-0186-2acc-f4de-bc14bad586a2}\U

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
———-

Post the new FRST log and let me know how your system is running.

Hi,

Yes that was the parts of the ZeroAccess rootkit that were on your system.

Question - my TrendMicro is due for renewal at the end of March. Is there a better anti virus out there that may have caught this nasty thing?

I prefer either Microsoft Security Essentials or Avast antivirus. They are both very good antivirus programs and are free of charge.
——–

You say you are having problems with Word not opening? With this infection, the possibility of breaking bits and pieces of your system is very possible. It is possible that this is what may have happened but I can't be absolutely sure. Do you have the installation disk for Microsoft Office or did Word come pre-installed on your system? Go to Start > Control Panel > Programs and Features and see if Microsoft Live Add-In 1.3 is on your system.
——–

[external image: Posted Image]Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

There is an exploit of Java out right now that has no fix presently. I would recommend keeping Java off of your system completely until this issue has been resolved by Oracle.
————-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

———-

hi I'm off to work…will follow thru sunday!! I have microsoft office live add in 1.5 when i try to uninstall java - it asks me if I want to update java, I save NO - and it just stops - should I say YES? I want to remove, not update. Word and Excel open - when I open a file in word, there is a 5 second pause - it's wont let me type, then I get not responding. Excel opens - then it says not responding and I have't done anything! So is zeroaccess gone from my system? I don't want it back! will watch for your replies!! dar