ZeroAccess trojan - cannot remove

[jazzy81]

Hi there, any help is appreciated.

My fiance's computer was running slowly so I did a scan with MalwareBytes and it came up with like 4 different trojans. ZeroAccess is one of them. I've tried numerous things to get rid of them but every time I reboot the computer, they come back. I am trying to save the PC before I have to format it because he's had it since 2006 and it has a lot of personal stuff on it.

Anyway, I have a few logs here. The following is from MalwareBytes (I didn't take action this latest scan because it never seems to work):

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.17.07

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Jimmy Vermeer :: JIMMYVERMEER-PC [administrator]

01/19/2013 10:14:14 AM

MBAM-log-2013-01-19 (10-22-33).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 259231

Time elapsed: 5 minute(s), 36 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\Windows\assembly\GAC\Desktop.ini (Trojan.0access) -> No action taken.

C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U\00000004.@ (Rootkit.Zaccess) -> No action taken.

C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U\00000008.@ (Trojan.Dropper.BCMiner) -> No action taken.

C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U\000000cb.@ (Rootkit.0Access) -> No action taken.

C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U\80000000.@ (Trojan.0Access) -> No action taken.

C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U\80000032.@ (Trojan.Clicker) -> No action taken.

(end)

The following is a roguekiller scan that I did, this is what it came up with:

RogueKiller V8.4.3 [Jan 10 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Jimmy Vermeer [Admin rights]

Mode : Scan -- Date : 01/19/2013 09:46:54

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[TASK][sUSP PATH] RunAsStdUser Task : "C:\Users\Jimmy Vermeer\AppData\Local\gameflakeSA\bin\1.0.10.0\GameFlakeSA.exe" -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\@ --> FOUND

[ZeroAccess][FILE] @ : C:\Users\Jimmy Vermeer\AppData\Local\{00dbe1d0-3dc5-e070-2048-2047f893557d}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U --> FOUND

[ZeroAccess][FOLDER] U : C:\Users\Jimmy Vermeer\AppData\Local\{00dbe1d0-3dc5-e070-2048-2047f893557d}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{00dbe1d0-3dc5-e070-2048-2047f893557d}\L --> FOUND

[ZeroAccess][FOLDER] L : C:\Users\Jimmy Vermeer\AppData\Local\{00dbe1d0-3dc5-e070-2048-2047f893557d}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini --> FOUND

[susp.ASLR|Sig - ZeroAccess][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST350063 0AS SCSI Disk Device +++++

--- User ---

[MBR] 6f5e17e3e95aa32c8f3cf8b54545fb2f

[bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : HP tatooed MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 467720 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 957891690 | Size: 9216 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_01192013_02d0946.txt >>

RKreport[1]_S_01192013_02d0946.txt

I do also have those dds.com logs saved as well if they are needed.

Thanks in advance

[MrCharlie]

Here you go......

Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!