ZeroAccess RootKit Infection

[w3junky]

I was recently infected with the ZeroAccess Rootkit. I have done several steps in removing this per viewing messages on this forum (using ComboFix, TDSSKiller, Malwarebytes, RKill, the list goes on) and it appears it was removed, but I still have two issues going on. I am running Windows 7 32-bit.

 

Issue 1: I cannot download anything from Internet Explorer (version 9). Each time I attempt to download a file (exe, pdf, etc), it tells me the file contained a virus and is unable to download.

 

 

Issue 2: Windows Defender service will not start. This also occured with Windows Firewall, but I was able to get that working per a number of fixes. As for Windows Defender, when I try and open it via the Control Panel, I get:

 

 

 

Looking at the service in Services, it shows as:

 

 

 

Looking at the files on the C:\ drive, I see them but they appear to be listed as shortcuts:

 

 

 

If I attempt to start the MSASCui.exe, I receive the following:

 

 

Any help would be greatly appreciated!

 

 

[w3junky]

By the way, I was running AVG Free, but it has since been removed, and removed completely per their Removal program.

[D-FRED-BROWN]

Hello w3junky and welcome to Malwarebytes!

I am D-FRED-BROWN and I will be helping you.

Please print or save this topic. It will make it easier for you to follow the instructions and complete all of the necessary steps.

I will need you to re-run several of those tools per my instructions below.

----------Step 1----------------

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.

  Vista/Windows 7 users right-click and select Run As Administrator.

• If TDSSKiller does not run, try renaming it.
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
• Click the Start Scan button.
• Do not use the computer during the scan
• If the scan completes with nothing found, click Close to exit.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

  Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed.

• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
• Copy and paste the contents of that file in your next reply.

----------Step 2----------------

Please download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

----------Step 3----------------

Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingc...to-use-combofix

***IMPORTANT: save ComboFix to your Desktop***

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please go here to see a list of programs that should be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

Please include the C:\ComboFix.txt in your next reply for further review.

NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

----------Step 4----------------

Please download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

----------Step 5----------------

In your next reply, please include the following:

• TDSSKiller's logfile
• MBAR mbar-log.txt and system-log.txt
• ComboFix's report (C:\ComboFix.txt)
• Security Check checkup.txt

After that, please let me know: How is your computer running now? Do you have any questions or concerns you'd like me to address? Don't hesitate to ask.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Note:

Please make sure you are subscribed to this topic: Click on the "Follow This Topic" Button (at the top right of this page), make sure that the "Receive notification" box is checked and that it is set to "Instantly"

 

-------> Your topic will be closed if you haven't replied within 3 days! <--------

(If I don't respond within 24 hours, please send me a PM)

-DFB

[w3junky]

Thank you for helping out. I have attached the files.

TDSSKiller.2.8.18.0_15.07.2013_16.14.25_log.txt

system-log.txt

ComboFix.txt

mbar-log-2013-07-15 (16-19-12).txt

checkup.txt

[D-FRED-BROWN]

Looking better. I'd like to do some deeper digging though:
 

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select English as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Let me know how things go. If you at any point have trouble using FRST, please stop and post back here to let me know.

[w3junky]

File is attached.

FRST.txt

[w3junky]

Can you not edit posts on here? I meant to add, I see a ZeroAccess listing in this latest log and of course it's referring to Windows Defender which I am having issues with.

 

C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

 

Thanks again.

[D-FRED-BROWN]

This should get us going.

 

Please do the following:

• Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
• Right-click in the open notepad and select Paste).
• Save it on the flashdrive as fixlist.txt

Quote

Quote

DeleteJunctionsIndirectory:
C:\Program Files\Windows Defender

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options.

Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it in your next reply.

[w3junky]

Attached...

Fixlog.txt

[D-FRED-BROWN]

Go ahead and run the same fix, but do it in Normal Mode instead this time

[w3junky]

Well, the first time through when I tried it, it deleted the Windows Defender folder, so when I attempt this again, it states it can't find the folder/files to fix.

Fixlog.txt

[w3junky]

And by the way, I can now download files without issues. Probably because Windows Defender is gone. If you know of a way to restore those files that would be great. Otherwise, I can just copy them from a working PC at work.

[D-FRED-BROWN]

This should do it. Save this as fixlist.txt and run it from Normal Mode.
 

Move:
C:\FRST\Quarantine\Windows Defender C:\Program Files\Windows Defender

DeleteJunctionsIndirectory:
C:\Program Files\Windows Defender

[w3junky]

Well, it won't let me move the files from the location due to permission problem. I even changed the permissions on the files and added SYSTEM with full control but still a no go. Do I need to do this in safe mode?

 

[D-FRED-BROWN]

Run this fix in Recovery Mode:

 

Move:
C:\FRST\Quarantine\Windows Defender C:\Program Files\Windows Defender

 

Then, run the next one in Normal Mode:

 

DeleteJunctionsIndirectory:
C:\Program Files\Windows Defender

[w3junky]

Does the Windows Defender folder need to be created ahead of time before I do this? And will I need to put anything in brackets since there is spaces in Program Files?

[D-FRED-BROWN]

No you shouldn't have to do either of those. Let me know if you encounter any trouble.

[w3junky]

Didn't work. So I created the fixlist.txt and placed it on the usb drive. Parameters look like:

 

Move:
C:\FRST\Quarantine\Windows Defender C:\Program Files\Windows Defender

 

Booted to Recovery Mode and ran the .exe and clicked Fix. Received the following:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-07-2013
Ran by SYSTEM at 2013-07-15 21:21:42 Run:10
Running from L:\
Boot Mode: Recovery

==============================================

Could not find Move:
Could not find Move:
"C:\FRST\Quarantine\Windows Defender C:\Program Files\Windows Defender" => File/Directory not found.

==== End of Fixlog ====

[D-FRED-BROWN]

Please do the following:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KILLALL::

 

FCopy::

C:\FRST\Quarantine\Windows Defender | C:\Program Files\Windows Defender

 

Reboot::

Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I shall require in your next reply.
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please include the newly-created C:\ComboFix.txt in your next reply, and let me know how things are running now
 

[w3junky]

File attached. I am heading offline and won't have access to this PC until Tuesday night.

 

 

[w3junky]

Doesn't appear the file attached so here is another attempt...

log.txt

[D-FRED-BROWN]

edit

[D-FRED-BROWN]

See if you can run the DeleteJunctionsIndirectory fixlist.txt in Normal Mode now. If not, we'll just move on

[w3junky]

I cannot, probbaly because nothing exists in this directory.

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-07-2013
Ran by Ryan at 2013-07-16 06:23:30 Run:11
Running from H:\
Boot Mode: Normal

==============================================

"DeleteJunctionsIndirectory:" => Not Found
"C:\Program Files\Windows Defender" => File/Directory not found.

==== End of Fixlog ====

[D-FRED-BROWN]

Okay no worries. Let's move on for now:

 

----------Step 1----------------
Please download AdwCleaner by Xplode onto your desktop.

• Double click on AdwCleaner.exe to run the tool.
• Click on Search.
• A logfile will automatically open after the scan has finished.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[R1].txt as well.

----------Step 2----------------
We need to create a New FULL OTL Report

• Please download OTL from here if you have not done so already:
  • Main Mirror
• Save it to your desktop.
• Double click on the OTL icon on your desktop.
• Click the "Scan All Users" checkbox.
• Change the "Extra Registry" option to "SafeList"
• Push the Run Scan button.
• Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

----------Step 3 (note: this scan may take a little time)----------------
I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt


----------Step 4----------------
Please post the AdwCleaner logfile, the OTL.txt and Extras.txt, and the ESET online scan log in your next reply.

Let me know how things go.