ZEROACCESS rootkit symptoms found, and missing some Services

rusl07cl08 · 28 Oct 2014

Hi guys, I have run malwarebytes and rkill. The results are the following:

Code:

* ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\00000004.@ [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\201d3dde [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\76603ac3 [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\U\ [ZA Dir]

Checking Windows Service Integrity: 

 * Base Filtering Engine (BFE) is not Running.
   Startup Type set to: Automatic

 * Windows Update (wuauserv) is not Running.
   Startup Type set to: Disabled

 * Windows Firewall Authorization Driver (mpsdrv) is not Running.
   Startup Type set to: Manual

 * iphlpsvc [Missing Service]
 * MpsSvc [Missing Service]
 * WinDefend [Missing Service]
 * wscsvc [Missing Service]

 * SharedAccess [Missing ImagePath]

Should I be worry about this? Thanks!

ICIT2LOL · 28 Oct 2014

Hello Rus mate run the TDSS Killer from this and there are more you can run if it doesn't work but it usually is pretty good.
Best Free Rootkit Scanner and Remover

Let us know how it goes and there is an another option if it doesn't cure the problem.

rusl07cl08 · 28 Oct 2014

Thanks ICit2lol but the results are:
0 threats
0 objects quarantined

Btw, I used Kaspersky TDSSKiller.

ICIT2LOL · 28 Oct 2014

Ok mate lets try this it will run from power up and not involve Windows therefore not involve any system filing stuff. It means making a bootable disk but it keeps for a while before it needs getting a fresh copy - so handy for the future.
Download Kaspersky Rescue Disk 10

Kaktussoft · 28 Oct 2014

Download and run Windows Repair (All In One)
Do at least test 1,3,26,17,6 and reboot afterwards.
After that run the tests again as you did in #1 and post the results

rusl07cl08 · 28 Oct 2014

Btw, I have run Trojan Remover (http://www.simplysup.com/tremover/download.html) a minute ago then the rkill resulted:

Code:

* Windows Firewall Disabled

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000

 * ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\00000004.@ [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\201d3dde [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\76603ac3 [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\U\ [ZA Dir]

Checking Windows Service Integrity: 

 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Manual

ICIT2LOL · 28 Oct 2014

Ok Katususoft but I would like to se what becomes of that rescue disk run first.

Kaktussoft · 28 Oct 2014

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

=>quite normal. I think you have another virusscanner running(?) You have microsoft security essentials installed?

Kaktussoft · 28 Oct 2014

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Modify that registry value of "EnableFirewall" to 1 instead of 0!

ICIT2LOL · 28 Oct 2014

Ok mate I shall leave you in Katususofts hands