Zeroaccess quarantined - am I safe?

DancingDragon

I am not at all techy but understand that this is a real nasty. McAfee quarantined it, I then deleted it, ran stinger and rootkit removal. A full scan then came up clean - is my computer safe?

I think it may have arrived on a fake adobe update which I did not do but had to shut down with it still on screen as I couldn't get rid of it.

Would be grateful for any re-assurance you give me

GunJack

zeroaccess has become easier for av/mbam/etc to stop and remove. Run Malwarebytes as a belt'nbraces

DancingDragon

Many thanks. Ran that and it found and removed stuff!
Hopefully that's the end of it!

waddler_8

Run mbar - it's better than normal mbam with rootkits: http://www.malwarebytes.org/products/mbar/

Run the fix damage executable too as ZA deletes services etc.

DancingDragon

That's the one I used first after loading to usb from a "clean" computer. Ran the other as well after - that also found and cleared something. (sounds as if I know what I'm doing -really just following instructions after some research)

Do you think I'm ok now?



PS Sorry it's taking so long to get back on here and reply/thank but I'm mostly at work or scanning right now!

waddler_8

Ran the other as well after - that also found and cleared something.

Do you have the log?

DancingDragon

I think so but I'm on a different computer at the moment. I read somewhere that i should change all my passwords so was about to do that.

If I can post the log later I will (is it ok - safe - paranoid now) to just copy and paste the whole thing into a reply?

waddler_8

Yep, just C&P.

DancingDragon

ok. will try after changing many, many passwords on this very old, very slow machine instead of the speedy one I only bought a few months ago:mad:

DancingDragon

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.12.05.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
C855-1G_ :: C855-1G_-TOSH [administrator]
05/12/2013 16:50:42
mbam-log-2013-12-05 (16-50-42).txt
Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 323319
Time elapsed: 46 minute(s), 25 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Users\C855-1G_\AppData\Local\Temp\RegTask\PIPAskToolbar\Offercast2802_BCPA_.exe (PUP.Optional.Spigot.A) -> Quarantined and deleted successfully.
(end)

waddler_8

That's ok, nothing ZA related.