ZeroAccess rootkit removal (XP)

chunter

Anybody got a definitive procedure for removing the ZeroAccess rootkit on XP?
It's the 3rd time I've seen it three weeks.

Browntoa

looks like combofix

http://www.bleepingcomputer.com/forums/topic444985.html

dogmaryxx

HitmanPro


Hitman Pro offers home users a free one-time license, valid for thirty days, to remove the malware that was found on the computer. This one-time free license can be deployed from the License tab under Settings:

chunter

Na, combofix loops in a 'reboot for rootkit removal' and then crashes out and goes back to square one.

TDSS killer finds two problems:
i) fsusbexdisk
ii) device/harddisk0/DR0
I asked TDSS removed both.

I ran combofix again after that and it's still picking it up and going into its reboot loop.

The first time i encountered it, I tried a host of antivirus programs but eventually reformatted.
Even went for the fixboot fixmbr.

GunJack

tried rkill before running cf??

waddler_8

Look for a malicious service loading under the netsvcs group. Boot the RC, take out that service & the service dll + then replace the infected driver - then run your cleanup tools with windows booted normally.

http://www.threatexpert.com/report.aspx?md5=32d78a59abf09258c33e4095924757ac

http://www.threatexpert.com/report.aspx?md5=c9add47cd8008e9706e2fd2b3ab9613f

http://www.threatexpert.com/report.aspx?md5=63fe01015f4ceb19c9b64ad0bccc723b

chunter

Got it i think. combofix run a couple more loops and actually finished.
Combofix removed a batch of GoogleUpate / Toolbar files as well as other stuff.
Back on internet, running a full kaspersky on it.

Different from original encounter. Steps taken here allegedly removed it but complete messed up all my network settings and no amount of "fixes" would get me back on the internet.

Maybe combofix and tdsskiller are better at dealing with it now.

poppellerant

Unless the system is desperately mission critical, I would backup everything important and do a total format and reinstall of Windows.

Before copying or installing any files from your backup, it would be very wise if you completely scanned your backup for any viruses using a computer known to be virus free, or using the reinstalled Windows system.

Notmyrealname

poppellerant wrote: »

Unless the system is desperately mission critical, I would backup everything important and do a total format and reinstall of Windows.

THIS. The only way to be sure you've got rid of a rootkit is to scrub the drive, not just format it, and start again.

OP if it is you who've been infected 3 times in a week you may want to look at Linux.