You are not logged in. [Log In]


Forums » General Discussion » The Water Cooler » Crap, my computer has been rootkitted

Page 1 of 2 1 2 >
Topic Options
Rate This Topic
#382861 - 09/15/12 04:40 PM Crap, my computer has been rootkitted
fredk Offline
axiomite

Registered: 12/06/07
Posts: 7786
Loc: Canada
Any of the IT guys here have any experience with the zeroaccess virus?

I got hit by a fake antivirus the other day and instead of immediately booting into safe mode I tried to remove it and think I ended up installing the rootkit (via elevated process on Vista).

I'm going to restore from an Axronis image to clean up the computer, but the image is old, so I'm copying some files from my desktop onto a thumb drive.

I know this is a nasty botnet virus, so I want to be cautious.

My questions are as follows:

1. Do I need to be concerned with this virus propagating onto the thumb drive? Thumb drives are cheap and the data I copied is useful, but not critical. I'll toss the drive if there is a risk.

2. Might this virus insert itself into data files on the computer? I've partitioned the drive so that I can restore just the OS onto a system drive. In the past that has been sufficient to clean up infections. Again, I want to be extra cautious.

Thanks.
_________________________
Fred

-------
Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!

Top
#382862 - 09/15/12 06:47 PM Re: Crap, my computer has been rootkitted [Re: fredk]
Ken.C Offline
shareholder in the making

Registered: 05/03/03
Posts: 18044
Loc: NoVA
I would use something like this: http://www.symantec.com/security_response/writeup.jsp?docid=2011-121607-4952-99

Generally they work ok, and then you won't have to roll it back.
_________________________
I am the Doctor, and THIS... is my SPOON!

Top
#382864 - 09/15/12 09:50 PM Re: Crap, my computer has been rootkitted [Re: Ken.C]
fredk Offline
axiomite

Registered: 12/06/07
Posts: 7786
Loc: Canada
Well, mixed results from that. It seems to have removed something as my AV is back, Something nasty is still trying to load and is being blocked by the AV. I'm running a full scan now.

Update service is gone as are a few other services. Trying to use the Catalyst Control Center results in a bluescreen.

I'll try a repair install of the OS when the scan is done.

I'm not entirely convinced the computer is clean though. I may still re-image.
_________________________
Fred

-------
Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!

Top
#382865 - 09/15/12 10:07 PM Re: Crap, my computer has been rootkitted [Re: fredk]
Ken.C Offline
shareholder in the making

Registered: 05/03/03
Posts: 18044
Loc: NoVA
Do you have system restore turned on? I would try reverting to a checkpoint about a week in the past if so. That'll also save you some time.
_________________________
I am the Doctor, and THIS... is my SPOON!

Top
#382868 - 09/16/12 01:29 PM Re: Crap, my computer has been rootkitted [Re: Ken.C]
fredk Offline
axiomite

Registered: 12/06/07
Posts: 7786
Loc: Canada
Well, no restore points. The scan picked up 8 or 9 virus files, all in temp directories.

I still feel more comfortable with doing an image restore to make absolutely sure my system is clean. Too bad I havn't kept more up to date on my imaging. blush It won't make a big difference as I have not changed the system much over time. I'll have an hour or so of updates to install.
_________________________
Fred

-------
Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!

Top
#382869 - 09/16/12 01:38 PM Re: Crap, my computer has been rootkitted [Re: fredk]
J. B. Offline
connoisseur

Registered: 01/19/11
Posts: 1291
Loc: Quebec, Canada
before doing an image restore, i would prefer to use the system after the cleanup; it might be ok and then you will not spend hours restoring it.
if it's still there, you will soon know.
_________________________
See: http://www.blu-ray.com/community/gallery.php?member=Gelli
or: Axiom Gallery

Top
#382870 - 09/16/12 06:13 PM Re: Crap, my computer has been rootkitted [Re: fredk]
Ya_basta Offline
connoisseur

Registered: 06/23/07
Posts: 4299
Loc: Sitting down somewhere
Fred, have you considered using the free services from agents on a website like Bleeping Computer? I had a nasty virus a couple years ago, and with the assistance of an agent from the same site, my computer was virus free and in perfect working order. Here's a recent thread regarding the same trojan that was removed.
_________________________
The only reasonable argument for owning a gun is to protect yourself from the police.

Top
#382871 - 09/16/12 06:14 PM Re: Crap, my computer has been rootkitted [Re: J. B.]
fredk Offline
axiomite

Registered: 12/06/07
Posts: 7786
Loc: Canada
From Symantec:
Quote:
Furthermore, it opens a back door and connects to a command and control (C&C) server, which allows the remote attacker access to the compromised computer. The attacker is then able to perform any number of actions on the computer, and the computer may then become part of a wider botnet.

This is why I am concerned. If this was nuisance malware, I would clean up and wait. If my computer is now part of a botnet, I'm not so sure I would see obvious activity.
_________________________
Fred

-------
Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!

Top
#382872 - 09/16/12 06:16 PM Re: Crap, my computer has been rootkitted [Re: Ya_basta]
fredk Offline
axiomite

Registered: 12/06/07
Posts: 7786
Loc: Canada
Cam. I started at Bleeping computer. It was one of their tools that detected signs of zeroaccess.
_________________________
Fred

-------
Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!

Top
#382873 - 09/16/12 06:35 PM Re: Crap, my computer has been rootkitted [Re: fredk]
Ya_basta Offline
connoisseur

Registered: 06/23/07
Posts: 4299
Loc: Sitting down somewhere
Originally Posted By: fredk
Cam. I started at Bleeping computer. It was one of their tools that detected signs of zeroaccess.


Did an agent pick up your case?
_________________________
The only reasonable argument for owning a gun is to protect yourself from the police.

Top
Page 1 of 2 1 2 >

Moderator:  alan, Amie, Andrew, axiomadmin, Brent, Debbie, Ian, Jc 
Forum Stats

15,255 Registered Members
16 Forums
24,041 Topics
424,560 Posts

Most users ever online:
883 @ 03/04/17 05:06 PM

Top Posters
Ken.C 18044
pmbuko 16437
SirQuack 13572
CV 11677
MarkSJohnson 11444
0 registered ()
40 Guests and
4 Spiders online.
Key: Admin, Global Mod, Mod
Newsletter Signup