Rootkits and Stuff

Thorax_the_Impaler

Minecraft Veteran
Messages
352
Location
127.0.0.1
Firstly, Merry Christmas to all. :) Secondly, thanks to all who answer this question.

Now, a while back I had to do a complete reformat on my HDD in a computer of mine. The machine was (according to Malwarebytes) infected with two Rookits, both showing up as "Rootkit: Access" in the scanner. Now I tried every trick I know to get rid of them, and each time it just made the OS installation worse and worse in terms of lag (and to the best of my assumptions, stability). Skipping to the end of the story, I just deleted everything and did a fresh install; which seemed to solve my problem. Until, I found out recently that yet another machine I have has the exact same problems, and as you may have guessed, the same Rootkits (or so I can tell). Basically, upon each Malware removal attempt, (including those that involved disabling system restore and such), the Rootkits were never removed. They caused the web browser to go haywire, redirecting to URL's that were jumbled messes of characters, and they also made it exceptionally difficult to disable (through Windows) any network cards, active or not (since Internet Explorer opened on its own at times). I am not exaggerating when I say I had to physically tear out the wireless-enabling PCI card to keep the system from freezing, and at times, going straight to the bluescreen.

Considering that this other machine I have also has these Rootkits (which I assume will cause the same problems), is there anything somebody can recommend to get rid of them? I'll just reinstall if that's what it comes down to but I'd like to avoid that headache as much as possible.
 
Run TSSDKiller from Kaspersky. Would then recommended running Panda Antirootkit. After that, run Combofix (download it from BleepingComputer website as they are the primary site for the download). Then run MalwareBytes Antimalware. Post all logs here.
 
I prefer to use RKill (RKill Download) first to stop whatever's there from running, then run the anti-rootkit scans. It seems to up removal rate in my opinion. There are also different version of Rkill in case it doesn't let you run .exe's or any type of executable program.
 
I found with TDSS killer it's good to enable the option "detect tdlfs file system"
 
Rootkit: Access = ZeroAccess Rootkit

Can bury rootkit code into the master boot record (MBR) of the PC's hard drive.

The programs mentioned by carnageX are helpful, as well as one called
RogueKilller.

It will help with ZA detection and removal, and will also run an MBR check:
Download: http://tigzy.geekstogo.com/Tools/RogueKiller.exe

It can also be used to terminate and remove malicious processes from your computer, like RKill, mentioned by Yevrag35.

HTH ;)
 
Back
Top Bottom