"0" Access Infection

[sixwheeler2011]

Hello All,

Tech here, Just inquiring if any of the Admins or any of the techs' here
have any luck with this infection. killing the process and removing the primary infection leaves a reacuring root kit at this point non removable.
You can run the rescue CD (Lenix) by: AVG and can get it removed, w/ out it it will destroy the PC is has infected.
If Anyone has had some progress in removing this (Mal-ware) -RootKit, please send a post

Thanks In Advance
Sixwheeler.

 

[tom982]

Hello sixwheeler2011

Just to give you some sort of idea of what you've got, there's this:

Challenging Rootkit - Geeks to Go Forums

This thread came up a few weeks ago and as you can see, it is a very long one - 16 pages to be precise. Considering the average thread length for malware removal is about 2-3 pages, you can realise how complicated this rootkit is.

If you're really interested in it, then read this: pxnow.prevx.com/content/blog/zeroaccess_analysis.pdf

A hacker (whitehat) broke open the code of the rootkit and released it online so people can develop fixes for it, there's a great analysis of the rootkit

It's a seriously nasty piece of work, it makes hidden partitions and it creates kernel device objects. It disguises itself using Alternate Data Streams (ADS) and kills any process trying to remove these streams

I can't assist you with removing this rootkit, but I would really appreciate it if you could do this for me please:

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.​

I haven't got a log from a ZeroAccess infection and I would really like to know what to look out for for future reference

Thanks,

Tom

 

[sixwheeler2011]

I do not have this Infection, I am At work, and we all are having a real good time with this one

Thanks Tom.

 

[niemiro]

Personally, I reacon that this can be removed, if you know which tools to use, and how to read the logs. Also, how long it takes to clean an infection varies mainly against the skill and speed of the remover, and RKinner isn't exactly renouned for being quick, but still very good, unlike someone like Essexboy who is lightning quick.

 

[tom982]

I do not have this Infection, I am At work, and we all are having a real good time with this one

Thanks Tom.

Oops, my mistake

Personally, I reacon that this can be removed, if you know which tools to use, and how to read the logs. Also, how long it takes to clean an infection varies mainly against the skill and speed of the remover, and RKinner isn't exactly renouned for being quick, but still very good, unlike someone like Essexboy who is lightning quick.

I'm still new enough to not know these sort of things But I'll have to bear that in mind in future. How far into the degree did you get before you took your break? I'm nearing the end of PL4 at the moment

Tom

 

[sixwheeler2011]

This rootkit is nasty, It turns out to be a reload on
most cases. I am a starter at the moment, but have background.
hoping some programers out there will come up w/ something
Tdskiller finds it deleting the files but
not the root cause.