« previous next »
Pages: 1 ... 5 6 [7] 8   Go Down

Author Topic: Help deleting Rootkit.ZeroAccess  (Read 44295 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #90 on: January 10, 2013, 07:26:09 PM »
Could you run it one more time...  This is a really weird situation that I have not yet come across
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #91 on: January 10, 2013, 07:43:42 PM »
should I uninstall it and download a fresh copy?
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #92 on: January 10, 2013, 07:45:36 PM »
Yes that may be advisable.. 

Link 1
Link 2
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #93 on: January 10, 2013, 08:20:21 PM »
i wasn't sure if you wanted me to add that CFSript.txt file to it, so I didn't do that.  ComboFix detected rootkit.zeroaccess again, the log is attached.

I forgot to ask, is this IP address correct?   TCP: DhcpNameServer = 192.168.2.1
« Last Edit: January 10, 2013, 08:22:49 PM by LaLuz »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #94 on: January 10, 2013, 08:27:26 PM »
Now I am totally baffled as to where it is detecting it...  None of the other tools find a trace in any shape or form

As an aside did you install this programme USB Lock AP

forgot to ask, is this IP address correct?   TCP: DhcpNameServer = 192.168.2.1Yes it is your router
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #95 on: January 10, 2013, 08:35:53 PM »
That application was on the new USB that I've used to create the OSO2Disk.  I must confess to you that I had to remove the battery to reset the BIOS password in order to change the booting settings.  I don't know if that has anything to do with not being able to boot from the USB  :-[
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #96 on: January 10, 2013, 08:43:57 PM »
Yes that is a USB locking application.  It disables USB's from being written to or read 

How is the computer behaving as I am a tad suspicious about combofix's report
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #97 on: January 10, 2013, 08:57:21 PM »
I was able to download that OTLPE on the USB.  I can view the contents of the USB. 

As far as the PC performance, here are my issues:

1.  The internet slows down all of a suden, and my links from my favorites don't always work.

2.  Some of my desktop and start menu icons are not working and they display a folder with a windows screen over it.  The icons don't work with just a click, I have to right click and select open.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #98 on: January 10, 2013, 09:06:39 PM »
OK I am just going to check something out

Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #99 on: January 10, 2013, 10:44:11 PM »
Could you download Dr Web and run the programme from safe mode please http://www.freedrweb.com/cureit

Basic instructions are on the download page, or if you like I will now be creating some instructions in the use of it

 
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #100 on: January 10, 2013, 11:01:50 PM »
Please download Dr Web Cureit from here to your desktop

The file will be randomly named
Reboot to safe mode
Run Dr Web
Tick the I agree box and select continue
Click select objects for scanning


Tick all boxes as shown
Click the wrench and select automatically apply actions to threats 


Press start scan

The scan will now commence


Once the scan has finished click open report


A notepad will open
Select File > Save as..
Save it to your desktop
Upload the file to Mediafire and post the sharing link, or if you have dropbox then put it there and post the public link 
« Last Edit: January 10, 2013, 11:06:51 PM by essexboy »
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #101 on: January 11, 2013, 07:55:50 PM »
Here is the report.

http://www.mediafire.com/?cqhpdlgydatd7jq

I was finally able to run OTL and I'm including a copy of the report.
« Last Edit: January 11, 2013, 08:40:12 PM by LaLuz »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #102 on: January 11, 2013, 08:41:14 PM »
Ta downloading now
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Help deleting Rootkit.ZeroAccess
« Reply #103 on: January 11, 2013, 08:51:01 PM »
Again as clean as a babies bum  ::)

OK download this zip file to your desktop

http://www.dougknox.com/xp/fileassoc/linkfile_fix.zip

Extract the reg file and double click
Reboot and try the desktop icons .. Do they work
Logged

LaLuz

  • Guest
Re: Help deleting Rootkit.ZeroAccess
« Reply #104 on: January 11, 2013, 09:09:45 PM »
yes the icons work, but the ones listed on the start menu still display that weird folder with some windows page over it.

When I run Curit it said that some Trojan.Swizzor.18340 was found, did that show in the report? 

Also I'm not sure if you saw the OTL report that I added to my reply.
Logged
Pages: 1 ... 5 6 [7] 8   Go Up
« previous next »