Got ZeroAccess and can't get rid of it

[MrCharlie]

The "cleaning of temp files" didn't work right

We'll do it this way:

Download TFC to your desktop

Close any open windows.

Double click the TFC icon to run the program

TFC will close all open programs itself in order to run,

Click the Start button to begin the process.

Allow TFC to run uninterrupted.

The program should not take long to finish it's job

Once its finished it should automatically reboot your machine,

if it doesn't, manually reboot to ensure a complete clean

~~~~~~~~~~~~~~~~~~~~

Then.............

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[campbelldw]

Here is the log from AdwCleaner

AdwCleanerR3.txt

[MrCharlie]

Looks like you already ran that program.

~~~~~~~~~~~~~~~~~~~~~~~~

Is there any improvement??

If not please do this......

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats and the option Scan unwanted applications is checked

Click Advanced settings and select the following:

• Scan potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

Click Start

Wait for the scan to finish

Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic

MrC

[campbelldw]

It will not run. Attached is the result of my attempts. This is pretty consistant of the issues that I am having at this time. Cannot reach in or out for things. IE is the only working browser/internet enabled program. The windows firewall error which I uploaded earlier is still happening as well.

[campbelldw]

I have also found that there is an issue with several of the services which will not start. Many of them are dependant on the Base Filtering Engine which provides an access denied error even when "run as administrator" is used.

[MrCharlie]

This infection really plays havoc on a system.

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
    
  • Windows Defender
    

  [*]Press "Scan".

  [*]It will create a log (FSS.txt) in the same directory the tool is run.

  [*]Please copy and paste the log to your reply.

MrC

[campbelldw]

Here is the log. It is unchanged from the last FSS log that I posted.

FSS-2.txt

[MrCharlie]

Download these reg files to your desktop:

http://download.blee.../7/wuauserv.reg

http://download.blee...ices/7/BITS.reg

http://download.blee...haredAccess.reg

Now double click on each one and allow it to merge into the registry.

~~~~~~~~~~~~~~

Reboot and click on this link:

http://support.micro...iagnostic/en-us

"Run Now" <---click

Repeat for this one:

http://support.microsoft.com/kb/971058

"Run Now" <---click

Reboot and run another FSS scan. MrC

[campbelldw]

Ok so here is the FSS scan. Also the SharedAccess would not merge and the windows fix it links could not connect. I am at a total loss.

FSS-3.txt

[MrCharlie]

Give this a try............

Please download on the Desktop the following application: Windows Repair

Next, extract and launch the Repair_Windows.exe

Click on Start repairs tab and then click on Start

Check mark following options alone

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Repair Internet Explorer

Repair MDAC & MS Jet

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Windows Updates

Checkmark Restart System When Finished option

click the Start button

System should restart after repair

Let me know.....MrC

[campbelldw]

The program is running now. Going to let it run overnight and then we will see. Have to work tomorrow too so I will likely not be on til evening tomorrow. Again, Thanks for your help

[campbelldw]

Sorry bout not getting back to you yesterday. You know how life can be. At anyrate, the windows repair file that you had me run seems to have done the trick to restore access for me. The only thing that continues to go on is that the AVG is still bringing up the cookies. They are tracking but do not seem overly malicious. Thank you very much for all your help and please feel free to hit me up if there is something I can do for you.

Respectfully,

Dan

[MrCharlie]

Cookies are basically harmless.

There's a couple of programs I use to prevent these type of cookies.

Can you run the ESET scan and let me know if anything is found, MrC

[campbelldw]

Don't remember which program that is. Please let me know. I have run tdsskiller, roguekiller and fss and found nothing. AVG and MalwareBytes also find nothing. Attached you will find the logs from FSS and RogueKiller that show the system clean. If there is anything else or you can recommend a way to contain the cookies which I have got growing please let me know.

FSS.txt

RKreport4.txt

[MrCharlie]

ESET Online Scanner >>>

Note: You will need to use Internet Explorer for this scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats and the option Scan unwanted applications is checked

Click Advanced settings and select the following:

• Scan potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

Click Start

Wait for the scan to finish

Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic

~~~~~~~~~~~~~~~~~~~~~~~~~~~

For the cookies >>>>>

Do Not Track Plus:

http://www.abine.com/dntdetail.php

MrC

[campbelldw]

Here is the scan results of said scanner, though I could not find the dirctory you indicated. This was from the "List of Found threats" at the end of the scan. Sorry bout the delay in getting this done.

esec_scan_results.txt

[campbelldw]

Just found the file you originally asked for. Sorry bout that.

log.txt

[MrCharlie]

OK, how is it? MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!