BleepingComputer.com: Infected w/Rootkit.ZeroAccess

Hello all,

I read, with great interest a thread where the various log generation utilities were run, resulted submitted and analyzed, leading to a successful removal.
I'm afraid, I tried ComboFix before I even thought to read through this forum to see what the experience on this was.

Bottom line, after many attempts to run ComboFix, it finally ran through stage 50 and generated a log file - ending successfully (without crashing like it had on earlier runs). However, that successful run was preceded by the message saying that "rootkit.zeroaccess is detected". After the successful run, I rebooted and ran it again hoping not to get the message, unfortunately, I gave me the same message, but ran through the 50 stages very quickly, again, resulting in a log file and success.

My Symantec endpoint protection software seems to have been clobbered, so I just uninstalled that, and everything else that looks to be wasted electrons.

I have now, after the fact, run the prescribed sequence of utilities and I'm hoping someone wouldn't mind taking a quick look to see if I've slain the monster. GMER is running (10 items listed) as I type this, and I don't know what it's telling me.

Thanks in advance

Hello again,

I've attached the log files. Just for kicks I re-ran combofix to see it the infection was gone, it pops up with "There's a newer version of ComboFix available, Would you like to update ComboFix?"

Not sure what this is all about...

EDIT: Posts merged ~Budapest

This post has been edited by Budapest: 20 July 2011 - 05:15 PM

Please post the ComboFix log(s)

then run the following:

Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
  
• A black window should pop up, press any key to close once the fix is completed.
  
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).



NEXT


Please download TDSSKiller.zip

• Extract it to your desktop
  
• Double click TDSSKiller.exe
  
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    
  • Then click Continue > Reboot now
  
  
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.