+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.ly/Forum-Antivirus-Protection)
+--- Thread: Infected with ZeroAccess Rootkit (/Thread-Infected-with-ZeroAccess-Rootkit)
Pages:
1
2
Infected with ZeroAccess Rootkit - Asuna_mybb_import7736 - 09-19-2012
Hello you reading this.
I've notified that my firewall can't run anymore. The error code it gives, have I googled, and almost all the results were about the ZeroAccess Rootkit. I've looked at a couple of sites for removing, but I still don't know what to do!
So please, Oh mighty HC members, teach me about ZAR removement! :/
RE: Infected with ZeroAccess Rootkit - bluedog.tar.gz - 09-19-2012
What about just reinstalling the OS? I wouldn't really know how to remove the rookit. You may want to try software such as http://www.safer-networking.org/personal/
RE: Infected with ZeroAccess Rootkit - Shining White - 09-19-2012
please read -=--> http://malwaretips.com/blogs/zeroaccess-sirefef-virus/
RE: Infected with ZeroAccess Rootkit - Asuna_mybb_import7736 - 09-19-2012
(09-19-2012, 05:31 PM)Shining White Wrote: please read -=--> http://malwaretips.com/blogs/zeroaccess-sirefef-virus/
I've heard, that ComboFix is dangerous to your computer. If it's not used with causion, it would eventually lead to "unpredictable results."
RE: Infected with ZeroAccess Rootkit - Shining White - 09-19-2012
(09-19-2012, 05:59 PM)drake8 Wrote:(09-19-2012, 05:31 PM)Shining White Wrote: please read -=--> http://malwaretips.com/blogs/zeroaccess-sirefef-virus/
I've heard, that ComboFix is dangerous to your computer. If it's not used with causion, it would eventually lead to "unpredictable results."
there is lot of ways i think ,
Did you instaled malwarebyte ?
and what is your AV ? and Firewall ?
can you post the Error and generated report you have ?
RE: Infected with ZeroAccess Rootkit - Asuna_mybb_import7736 - 09-20-2012
I have Mbam, and just un-installed AVG, Norton 360 and Kaspersky.. -.-'
The error is (Remember it's translated from danish, so it may vary in translation): Some of the settings can't be changed.
Failcode 0x80070424"
RE: Infected with ZeroAccess Rootkit - H4R0015K - 09-20-2012
The ZeroAccess rootkit also known as
Sirefef, is a malicious program that has
as a primary motivation of to make
money through pay per click
advertising. It does this by downloading
an application that conducts Web
searches and clicks on the results. This
is known as click fraud, which is a very
lucrative business for malware
creators.
get more info about it and steps to remove it here
malwaretips.com/blogs/zeroaccess-sirefef-virus/
RE: Infected with ZeroAccess Rootkit - 3r3bus - 09-20-2012
Combofix is really great. RUN IT!
It will probably clear our that rootkit.
RE: Infected with ZeroAccess Rootkit - Asuna_mybb_import7736 - 09-20-2012
Hacker VS. Hacker
Now it has also disabled my mbam!! That pisses me off!!
RE: Infected with ZeroAccess Rootkit - muhammad fakir - 09-20-2012
Hey use your cmd to check..
Launch attrib
To start attrib
Go to Start Menu > Run
Type cmd (cmd stands for command prompt)
Press Enter key
To use attrib
Go to the root directory first by typing cd\(because this is always the target of Malware / Virus)
2. Type attrib and press Enter key
if you found SilentSoftech.exe and autorun.inf that is malware...
Since you cannot see this file nor delete it (because the attributes that was set on these files are +s +h +r)
+s - meaning it is a system file (which also means that you cannot delete it just by using the delete command)
+h - means it is hidden (so you cannot delete it)
+r - means it is a read only file ( which also means that you cannot delete it just by using the delete command)
Now we need to set the attributes of autorun.inf to -s -h -r (so that we can manually delete it)
Type attrib -s -h -r autorun.inf ( be sure to include -s -h -r because you cannot change the attributes using only -s or -h or -r alone)
Type attrib again to check if your changes have been commited
If the autorun.inf file has no more attributes, you can now delete it by typing del autorun.inf
Since SilentSoftech.exe is a malware you can remove its attributes by doing step 1 and step 3(just change the filename) ex. attrib -s -h -r silentsoftech.exe
when autorun.inf keeps coming back even if you already deleted it, be sure to check your Task Manager by pressing CTRL + ALT + DELETE ( a virus is still running as a process thats why you cannot delete it. KILL the process first by selecting it and clicking End Process
You can also apply the attrib -s -h -r command to all the partition of your computer, drive D: drive E: drive F: (all of your drives). For example. for drive D, just type "D:" (minus the double quote) then you can see that your current drive is D.. type there the command "attrib -s -h -r *.exe" for exe files and "attrib -s -h -r *.inf" and then delete the file by "del autorun.inf".
i just can help you here...
i unable to upload or paste pic in here due i am not VIP users. Thanks
Or you can delete by Registery
as usual..
goto run ----> Regedit---->click ok---->Open the "HKEY_LOCAL_MACHINE" folder to look for any viruses in the registry..
This is typically where the virus installs itself on the system,
Select the file once. To see the installation date of the file, right-click it and select "Preferences." If the file's installation date seems to match the date when you started experiencing trouble on the computer, it might be the virus you are looking for. Click "OK" to close the "Preferences" window.
Click the virus file once and press the "Delete" button. You are asked if you are sure you want to remove the file. Click "Yes," and the file is removed. Thanks