Infected with "Trojan.Sirefef.Ys" & Rootkit.ZeroAccess

[jcUK]

Hi,

I have been recently infected with a nasty rootkit virus. Here is the message from RKill:

 

------ RKill mai message---------------
* ALERT: ZEROACCESS rootkit symptoms found!

* C:\WINDOWS\assembly\GAC\Desktop.ini [ZA File]

* ALERT: ZEROACCESS Reparse Point/Junction found!

* C:\WINDOWS\$NtUninstallKB65459$\1241927679 => c:\windows\system32\config [File]
---------

 

I have run several anti malwares (in order):

- Defogger (not really an antimalware, but to make sure that my logical DVD drives are not a problem for the antimalwares)

- RKill

- Kaspersky TDSSKiller

- ComboFix mentioned that I am infected with Rootkit.ZeroAccess that has inserted itself in the tcp/ip stack, which seems to be particularly difficult to remove.

- RogueKiller

- MalwareBytes Cameleon

- MalwareBytes Anti-Malware has detected 10 infections

- I have planned also another sets of tools for cleaning up my computer.

 

If you agree to help, I will post/send the exact details and log files from the different antimalwares that  I have been using.

 

Many thanks in advance.

 

JC (UK)

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

 

Kevin

[jcUK]

Hi,

 

I am runing currently Hitman Pro; as soon as it has completed, I will run Farbar and send you the logs requested.

 

Many thanks for your help and support.

 

Cheers,

 

JC

[kevinf80]

OK jcUK, post logs when you`re ready.

 

paul_smith, please do not post into active threads, start your own....

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!