Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I think im infected with zeroaccess rootkit. What should i do?


  • Please log in to reply
7 replies to this topic

#1 Jackol1234

Jackol1234

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 27 August 2011 - 09:53 PM

This started a few days ago. I installed McAfee total protection 2011 and it worked fine but a few days later it started acting up. It would randomly turn off real-time scanning and id turn it on but then a few seconds later itd turn off again so i updated it and after that my computer restarted and got stuck in a bootloop once itd hit the welcome screen so i put it into safe mode uninstalled McAfee and it worked fine. So i got malwarebytes anti malware and when i would try to scan ot would for about 15 seconds then the program would turn off and id try to turn it on and it would say i didnt have the permission to do that. I finally was able to uninstall that so i got a free trial of Norton 360 and it installed and it ran but after a while it crashed and i started the app back up and it came up with an error. I looked around i the norton folder and noticed the definitions for it got all permissions cancelled and i cant change them. I hear zeroaccess will do that to all antivirus software if they try to scan the rootkit. Do i have zeroaccess trojan or something else and how do i get rid of whatever i have?
Also, if it matters, the only time i can scan my computer is when i go into safe mode without networking. Once i go to normal mode or safemode with networking and try to scan then the software i use gets all permissions stripped.
I have scanned in safe mode and it said afd.sys and its registry (i think that was it) was infected but i didnt know what todo about that because i read removing that can mess up the computer and also that sometimes it comes up as a false positive so if you could help fix that thatd be nice and i dont have another computer.

BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:44 AM

Posted 27 August 2011 - 09:56 PM

Welcome aboard Posted Image

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

64-bit users go HERE
  • Double-click SystemLook.exe to run it.
  • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box into the main textfield:
    :filefind
    consrv.dll
    winsrv.dll
    :reg
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#3 Jackol1234

Jackol1234
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 27 August 2011 - 10:51 PM

Im sorry for the super late reply. My internet suddenly went out on my computer and it wont connect anymore. I went to services and a whole bunch of them are off now and so is the firewall and i tried to start them up but they turn on then off immediatly.

#4 Jackol1234

Jackol1234
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 27 August 2011 - 10:55 PM

Im on my iphone right now and when i try to start the "Windows Firewall/Internet Connection Sharing (ICS)" service it says "could not start the Windows Firewall/Internet Connection Sharing (ICS) service on Local Computer. Error 10050: A socket operation encountered a dead network."

#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:44 AM

Posted 27 August 2011 - 11:04 PM

I'll report this topic to malware people who deal with this kind of situation.
Hold on there.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,442 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:44 PM

Posted 30 August 2011 - 01:44 PM

Besides this firewall, can you use the computer normally?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft

 

animinionsmalltext.gif


#7 Jackol1234

Jackol1234
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:44 PM

Posted 30 August 2011 - 06:17 PM

I just decided to recover my pc and use the destructive option and now everythings working again. Now im not gonna make the mistake of getting antivirus last this time

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,442 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:44 PM

Posted 31 August 2011 - 02:37 AM

Glad to hear things are running fine now. :)

Please read these advices, in order to prevent reinfecting your PC:
  • Install and update the following programs regularly:
    • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
  • Keep Windows (and your other Microsoft software) up to date!
    I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.
    Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
  • Keep your other software up to date as well
    Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
  • Stay up to date!
    The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.
Some more links you might find of interest:

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft

 

animinionsmalltext.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users