Solved ZEROACCESS rootkit symptoms found, and missing some Services

[rusl07cl08]

Hi guys, I have run malwarebytes and rkill. The results are the following:

* ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\00000004.@ [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\201d3dde [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\76603ac3 [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\U\ [ZA Dir]

Checking Windows Service Integrity: 

 * Base Filtering Engine (BFE) is not Running.
   Startup Type set to: Automatic

 * Windows Update (wuauserv) is not Running.
   Startup Type set to: Disabled

 * Windows Firewall Authorization Driver (mpsdrv) is not Running.
   Startup Type set to: Manual

 * iphlpsvc [Missing Service]
 * MpsSvc [Missing Service]
 * WinDefend [Missing Service]
 * wscsvc [Missing Service]

 * SharedAccess [Missing ImagePath]

Should I be worry about this? Thanks!

 

[ICIT2LOL]

Hello Rus mate run the TDSS Killer from this and there are more you can run if it doesn't work but it usually is pretty good.
Best Free Rootkit Scanner and Remover

Let us know how it goes and there is an another option if it doesn't cure the problem.

 

[rusl07cl08]

Thanks ICit2lol but the results are:
0 threats
0 objects quarantined

Btw, I used Kaspersky TDSSKiller.

 

[ICIT2LOL]

Ok mate lets try this it will run from power up and not involve Windows therefore not involve any system filing stuff. It means making a bootable disk but it keeps for a while before it needs getting a fresh copy - so handy for the future.
Download Kaspersky Rescue Disk 10

 

[Kaktussoft]

Download and run Windows Repair (All In One)
Do at least test 1,3,26,17,6 and reboot afterwards.
After that run the tests again as you did in #1 and post the results

 

[rusl07cl08]

Btw, I have run Trojan Remover (http://www.simplysup.com/tremover/download.html) a minute ago then the rkill resulted:

* Windows Firewall Disabled

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000

 * ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\00000004.@ [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\201d3dde [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\76603ac3 [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\U\ [ZA Dir]

Checking Windows Service Integrity: 

 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Manual

 

[ICIT2LOL]

Ok Katususoft but I would like to se what becomes of that rescue disk run first.

 

[Kaktussoft]

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

=>quite normal. I think you have another virusscanner running(?) You have microsoft security essentials installed?

 

[Kaktussoft]

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Modify that registry value of "EnableFirewall" to 1 instead of 0!

 

[ICIT2LOL]

Ok mate I shall leave you in Katususofts hands

 

[rusl07cl08]

Download and run Windows Repair (All In One)
Do at least test 1,3,26,17,6 adn reboot afterwards.
After that run the tests again as you did in #1 and post the results

Done. I think it's somehow fixed my problems. This is the result:

Checking for processes to terminate:
 * C:\ProgramData\DatacardService\DCService.exe (PID: 1496) [AU-HEUR]
 * C:\ProgramData\DatacardService\DCSHelper.exe (PID: 2864) [AU-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:
 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:
 * ALERT: ZEROACCESS rootkit symptoms found!

     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\ [ZA Dir]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\00000004.@ [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\201d3dde [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\L\76603ac3 [ZA File]
     * C:\Windows\Installer\{2b524474-7c58-2ccb-2efa-8d9df2ff344d}\U\ [ZA Dir]

Checking Windows Service Integrity: 
 * No issues found.

Searching for Missing Digital Signatures: 
 * No issues found.

And thank you for that.
By the way, during the tweaking repairs, I encountered BSOD displaying:

PAGE_FAULT_IN_NONPAGED_AREA
Technical Information:
*** win32k.sys - Address FFFFF9600018354B base at FFFFF960000C0000, DateStamp 54163648

Regarding this:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

=>quite normal. I think you have another virusscanner running(?) You have microsoft security essentials installed?

After the tweaking repairs, I started my Windows Defender and it is now updating. Thanks! I don't have MS Security Essentials. My AV is ESET Smart Security 5.

 

[Kaktussoft]

So the repair seems to fix the issue....nice.
Did you rerun it after the BSOD?

BSOd: I don't know why it crashed

 

[rusl07cl08]

So the repair seems to fix the issue....nice.
Did you rerun it after the BSOD?

BSOd: I don't know why it crashed

Yeah. The result is what I posted above. Thanks!