Crap, my computer has been rootkitted
|
Joined: Dec 2007
Posts: 7,786
axiomite
|
OP
axiomite
Joined: Dec 2007
Posts: 7,786 |
Any of the IT guys here have any experience with the zeroaccess virus?
I got hit by a fake antivirus the other day and instead of immediately booting into safe mode I tried to remove it and think I ended up installing the rootkit (via elevated process on Vista).
I'm going to restore from an Axronis image to clean up the computer, but the image is old, so I'm copying some files from my desktop onto a thumb drive.
I know this is a nasty botnet virus, so I want to be cautious.
My questions are as follows:
1. Do I need to be concerned with this virus propagating onto the thumb drive? Thumb drives are cheap and the data I copied is useful, but not critical. I'll toss the drive if there is a risk.
2. Might this virus insert itself into data files on the computer? I've partitioned the drive so that I can restore just the OS onto a system drive. In the past that has been sufficient to clean up infections. Again, I want to be extra cautious.
Thanks.
Fred
------- Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Dec 2007
Posts: 7,786
axiomite
|
OP
axiomite
Joined: Dec 2007
Posts: 7,786 |
Well, mixed results from that. It seems to have removed something as my AV is back, Something nasty is still trying to load and is being blocked by the AV. I'm running a full scan now.
Update service is gone as are a few other services. Trying to use the Catalyst Control Center results in a bluescreen.
I'll try a repair install of the OS when the scan is done.
I'm not entirely convinced the computer is clean though. I may still re-image.
Fred
------- Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: May 2003
Posts: 18,044
shareholder in the making
|
shareholder in the making
Joined: May 2003
Posts: 18,044 |
Do you have system restore turned on? I would try reverting to a checkpoint about a week in the past if so. That'll also save you some time.
I am the Doctor, and THIS... is my SPOON!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Dec 2007
Posts: 7,786
axiomite
|
OP
axiomite
Joined: Dec 2007
Posts: 7,786 |
Well, no restore points. The scan picked up 8 or 9 virus files, all in temp directories. I still feel more comfortable with doing an image restore to make absolutely sure my system is clean. Too bad I havn't kept more up to date on my imaging. It won't make a big difference as I have not changed the system much over time. I'll have an hour or so of updates to install.
Fred
------- Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Jan 2011
Posts: 1,291
connoisseur
|
connoisseur
Joined: Jan 2011
Posts: 1,291 |
before doing an image restore, i would prefer to use the system after the cleanup; it might be ok and then you will not spend hours restoring it. if it's still there, you will soon know.
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Jun 2007
Posts: 4,357
connoisseur
|
connoisseur
Joined: Jun 2007
Posts: 4,357 |
Fred, have you considered using the free services from agents on a website like Bleeping Computer? I had a nasty virus a couple years ago, and with the assistance of an agent from the same site, my computer was virus free and in perfect working order. Here's a recent thread regarding the same trojan that was removed.
The only reasonable argument for owning a gun is to protect yourself from the police.
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Dec 2007
Posts: 7,786
axiomite
|
OP
axiomite
Joined: Dec 2007
Posts: 7,786 |
From Symantec: Furthermore, it opens a back door and connects to a command and control (C&C) server, which allows the remote attacker access to the compromised computer. The attacker is then able to perform any number of actions on the computer, and the computer may then become part of a wider botnet. This is why I am concerned. If this was nuisance malware, I would clean up and wait. If my computer is now part of a botnet, I'm not so sure I would see obvious activity.
Fred
------- Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Dec 2007
Posts: 7,786
axiomite
|
OP
axiomite
Joined: Dec 2007
Posts: 7,786 |
Cam. I started at Bleeping computer. It was one of their tools that detected signs of zeroaccess.
Fred
------- Blujays1: Spending Fred's money one bottle at a time, no two... Oh crap!
|
|
|
Re: Crap, my computer has been rootkitted
|
Joined: Jun 2007
Posts: 4,357
connoisseur
|
connoisseur
Joined: Jun 2007
Posts: 4,357 |
Cam. I started at Bleeping computer. It was one of their tools that detected signs of zeroaccess. Did an agent pick up your case?
The only reasonable argument for owning a gun is to protect yourself from the police.
|
|
|
Forums16
Topics24,945
Posts442,489
Members15,617
|
Most Online2,082 Jan 22nd, 2020
|
|
0 members (),
707
guests, and
4
robots. |
Key:
Admin,
Global Mod,
Mod
|
|
|
|