Axiom Home Page Forums General Discussion The Water Cooler Crap, my computer has been rootkitted

Any of the IT guys here have any experience with the zeroaccess virus?

I got hit by a fake antivirus the other day and instead of immediately booting into safe mode I tried to remove it and think I ended up installing the rootkit (via elevated process on Vista).

I'm going to restore from an Axronis image to clean up the computer, but the image is old, so I'm copying some files from my desktop onto a thumb drive.

I know this is a nasty botnet virus, so I want to be cautious.

My questions are as follows:

1. Do I need to be concerned with this virus propagating onto the thumb drive? Thumb drives are cheap and the data I copied is useful, but not critical. I'll toss the drive if there is a risk.

2. Might this virus insert itself into data files on the computer? I've partitioned the drive so that I can restore just the OS onto a system drive. In the past that has been sufficient to clean up infections. Again, I want to be extra cautious.

Thanks.

I would use something like this: http://www.symantec.com/security_response/writeup.jsp?docid=2011-121607-4952-99

Generally they work ok, and then you won't have to roll it back.

Well, mixed results from that. It seems to have removed something as my AV is back, Something nasty is still trying to load and is being blocked by the AV. I'm running a full scan now.

Update service is gone as are a few other services. Trying to use the Catalyst Control Center results in a bluescreen.

I'll try a repair install of the OS when the scan is done.

I'm not entirely convinced the computer is clean though. I may still re-image.

Do you have system restore turned on? I would try reverting to a checkpoint about a week in the past if so. That'll also save you some time.

Well, no restore points. The scan picked up 8 or 9 virus files, all in temp directories.

I still feel more comfortable with doing an image restore to make absolutely sure my system is clean. Too bad I havn't kept more up to date on my imaging. It won't make a big difference as I have not changed the system much over time. I'll have an hour or so of updates to install.

before doing an image restore, i would prefer to use the system after the cleanup; it might be ok and then you will not spend hours restoring it.
if it's still there, you will soon know.

Fred, have you considered using the free services from agents on a website like Bleeping Computer? I had a nasty virus a couple years ago, and with the assistance of an agent from the same site, my computer was virus free and in perfect working order. Here's a recent thread regarding the same trojan that was removed.

From Symantec:

This is why I am concerned. If this was nuisance malware, I would clean up and wait. If my computer is now part of a botnet, I'm not so sure I would see obvious activity.

Cam. I started at Bleeping computer. It was one of their tools that detected signs of zeroaccess.

Did an agent pick up your case?