candide

Rootkit.Win32.ZAccess!E2

Recommended Posts

Hi,

After running Emsisoft Malware, there is a rootkit (Rootkit.Win32.ZAccess!E2) that cannot be removed automatically and requires your support please. I attached the 3 files required from the instructions.

I thank you a lot for your attention and your help.

Sincerely,

Candide.

Share this post


Link to post
Share on other sites

Please download ComboFix from one of the following links, and follow the instructions below to run it. Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

Link 1

Link 2

* IMPORTANT !!! Save Combo-Fix to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    See HERE for help
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

When finished, ComboFix will produce a log.

Note:

1. Do not mouseclick combofix's window while it's running. That may cause it to stall!

2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Attach logs for: (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

  • ComboFix (C:\combofix.txt)

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Share this post


Link to post
Share on other sites

First of all, thanks so much for your fast reply! I actually have an issue. I think I made a mistake. I installed combofix and thought I turned off the antivirus. But when I started combofix I had a message about the fact that symantec antivirus auto-protect was still on. I tried to turn off the software again but because I fail each time I try to do so. Then I remembered that maybe I need the IT of our group to do it. I am not sure we can 'play' with the settings actually. Anyway. In the panic, I closed the window related to combo-fix to cancel the process so I can ask the IT to do it himself. But now I have a window with 'Please wait. ComboFix is preparing to run.'. I hope I did not do something very harmful. But is there a way to close the combofix window please?

Thanks a lot.

Share this post


Link to post
Share on other sites

Hi again, at last the window closed. I am going to ask the IT and let you know how things work following your instructions above. Thanks again for your help.

Sincerely.

Share this post


Link to post
Share on other sites

If you hold down the Ctrl and Shift keys on your keyboard, and then tap the Esc key, Windows should open the Task Manager. Some infections will prevent it from opening, so if you don't see it appear after a moment then simply try restarting your computer.

If the Task Manager does appear, then go to the Processes tab, and look through the list for ComboFix. It should be called either Combo-Fix.exe or ComboFix.exe. Right click on ComboFix in the processes list, and select End process tree. This will terminate ComboFix and any processes that it launched while running.

Share this post


Link to post
Share on other sites

Also, just as a followup, if this is your work computer and you do not have access to an administrator account, then your best course of action is to wait for your IT department to take a look at the computer. They will most likely want to back up your data and reimage the computer, as that process tends to be the quickest and most reliable (especially in a corporate environment) for ensuring that the computer is completely clean.

Share this post


Link to post
Share on other sites

Hi, this is indeed my work computer :) Unfortunately the IT is away for a few days so I have to wait a little. A strange thing though is that Emsisoft does not detect anymore the rootkit. There are still traces though... Anyway. I will let you know.

Thanks again for all your advices and help.

Sincerely.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.