Avatar of Dale Forguson
Dale Forguson
Flag for United States of America asked on

Zero Access infection

This workstation is running Win 7 Pro sp1. Automatic Update wasdisabled so I checked services.msc and discovered the services were missing. I have installed latest versions of rkill, rogue killer, tdsskiller, and malwarebytes. Rogue killer and rkill both report zero access root kit. tdsskiller found no infection. while booted to normal desktop using administrator user account I ran rkill and then ran Malware bytes which stopped responding in the middle of the scan. log files are attached. I have not deleted any files or registry entries yet.
RKreport-1--S-01052013-02d1015.txt
Rkill.txt
Anti-Virus AppsAnti-Spyware

Avatar of undefined
Last Comment
John

8/22/2022 - Mon
John

Root kit viruses are very difficult to remove completely (or even remove at all). You have sufficient problem here to warrant backing up, formatting and then doing a fresh install of Windows. Then get a good, paid, commercial antivirus.

..... Thinkpads_User
Dale Forguson

ASKER
@ Thinkpads_user

I do understand your point but this is a business workstation. reconfiguration would require + 4 hours after OS install due to multiple 3rd party softwre. User had allowed AV to lapse. Found related post here; http://www.bleepingcomputer.com/forums/topic449600.html but
atapplies and what doesn't. Would like to attempt repair. please advise
Dale Forguson

ASKER
but (not sure what applies and what doesn't)
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
ASKER CERTIFIED SOLUTION
John

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Dale Forguson

ASKER
@ Thinkpads_User

I've seen a lot of your posts. Usually spot on. Thanks for the advice. I'll get back to you.
SOLUTION
Gerwin Jansen

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Dale Forguson

ASKER
@ Thinkpads_User and gerwinjansen

I followed the steps in the Bleeping Computer tutorial but Malwarebytes and Combofix (step 4) both stopped responding while running. Next I ran the Eset removal tool mentioned above. After this MS Updates started working but still couldn't run MWB. I noticed that MWB was hanging on a file in the Temporary Internet Files folder so I tried removing using IE which appeared to work but didn't fix the problem. I also tried CCleaner but it ran overnight without finishing. Next I started manually removing files in Temporary Internet Files folder from a command prompt. Then MWB ran to completion without finding anything but 15 risks showed up in Vipre AV (which was installed after lapse of coverage). I realize I can't be sure the system is clean but I think I may have gotten it. I intend to run Eset online scanner as well as running rkill and Rogue Killer again just to see if they come back clean. Do either of you want to see any log files? HJT etc.?
John

You can never be sure with rootkits because they come back again. If you think the system is working, run it for a while to see if it is stable.
.... Thinkpads_User
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Gerwin Jansen

Might be an idea to run a virus scanner from a bootable cd. Avg has one,  as do Comodo, bitdefender and Avira.
Dale Forguson

ASKER
I neglected to mention earlier that I was also reluctant to do a fresh install because the computer has a recovery partition but no Disks. Not insurmountable but it can be difficult to find drivers sometimes.
The Eset online scan found and fixed one more problem, rkill and Rogue Killer both found no issues. Vipre full scan also found nothing. I'll run a CD based scan as suggested above but I think I may have it cleaned up. Thanks for the suggestions.
John

@rettif9 - Thanks for the update. I was happy to help you with this.

.... Thinkpads_User
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes