OT- ZeroAccess rootkit trojan: Anyone with experience/advice on removing?

To be honest, just treat yourself to a new laptop. In this day and age, any piece of technology over 5 years old is ancient. Plus, Vista was an awful OS. Windows 7 is so much faster, easier to use, etc. I'm sure this will draw some snarky responses from Mac or Linux users, but whatever. Depending on what you need out of a computer, you could easily find a decent one for well under $1,000.

I have this same problem right now, and I have already backed up everything in anticipation of wiping and re-installing the operating system.  i even have a dual boot system and when I ran a virus scan and Malaware after booting up on the other drive, it still couldn't get it clean.  When I researched the problem, I found some solution-like substances that involved some complicated-looking stuff that had the risk of screwing up your system. 

I've had the same one on my wife's junk laptop for a year plus.  I just do important banking and buying from a different computer now.

If you have everything backed up.. Just restore it to factory defaults and cut your losses.  While that is not a guarantee to remove the virus, 9 times out of 10 it days.  If you do not know how. here ya go.

http://support.gateway.com/s/software/microsof/Vista/7515910/7515910su9.shtml

and trojan/malware issues in the past year, the standard programs were no good......malwarebytes and others did nothing.

I did some digging around online at the time and came across a program called "ComboFix.exe"...........I've used it twice now and have found it to be my last defense against these types of problems........it's looks ghetto and runs out of the DOS window........it runs an initial scan, will detect the problems and then ask to reboot.........once it reboots, it goes through a number of steps and ultimately got rid of the issues I had..........I was skeptical at first, but it works great.

You can download it from the cnet.com website.......and it's free.

http://download.cnet.com/Combofix/3000-8022_4-75221073.html

So, here is my thought on viruses. 90% of the time, anti-virus should take care of viruses with no issue. 9% of the time, you might have to do a little bit more, but everything works out. That 1% of the time, though, even if you manage to remove it from your system, it leaves it's mark behind. I find that when a virus is difficult to remove, the damage has already been done and it's easier to just cut your losses and start clean. I go with this mentality from the start and I keep all of my data separate from the OS. Lately, it's been a lot easier because I can keep almost everything online.

I know nothing about this particular rootkit, but, generally, rootkits are so deep in the system, they essentially become or appear to be part of the system, which is why they are so hard to remove. If you wipe, there should be no trace of the rootkit left over.

Depending on your priorities, here is what I would do.

1. Back everything up.
2. Try some of the more dangerous procedures to remove the virus (I'd skip this but it is an option).
3. Format your system and start fresh.
4. Get rid of McAfee, do a bit of research, and pick the best AV for you. I use Microsoft Security Essentials. Avast and AVG are also free. I've heard good things about Panda Security, but I think that costs money.

As Moleskyn mentioned above, there is the option of buying a new computer as well. That is not necessary, though, if your laptop was running to your satisfaction before the virus. If a computer is built right when you buy it, it can last years before it needs to be replaced. I built a computer for $600 6 years ago, replaced the graphics card 2 years ago, and it's still kicking. I won't upgrade that computer until I start having issues running software, which hasn't happened yet. If, however, your computer was slow, even before the virus, I suggest that you purchase a new laptop as reformatting would be like doing a full detail on a car with 150k miles on it that you don't plan on keeping for too much longer.

If you decide to do #2 in the list above, I found plenty of resources with a google search that should walk you through the steps necessary to remove it. You could also probably post on one of those forums and have someone help you one-on-one with your specific scenario.

The laptop is old enough. Get your data off and re-image. if you don't have your original windows product key, just put Ubuntu/Linux Mint on it. for day to day tasks like browsing you won't notice a difference. If anything it'll probably run a little faster.

In this case, system restore will not work. Before you run any tool/cleaner, turn it off.

Download Tdsskiller from here

 http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Follow the instructions here

http://support.kaspersky.com/faq/?qid=208280684

Good luck, I hope you get rid of this nasty bug. If you want to be completely sure, then backup everything you want to save. Either burn the saved items to disk, or back them up to an external hard drive. Once that's done, make sure you have unpluged your external from the laptop. It's easy to forget that it's still connected, and you can accidentally format the external as well. Once you have everything backed up, then you can reformat/reinstall windows. All you need is a Windows Operating System Disk. You don't need the original recovery disks that came with the laptop.

If you don't know how to reformat/reinstall Windows. You will want to delete all partitions on the laptop, and then do the reinstall. You can find many youtube tutorials on how to do it. It's not hard, just take your time.

I have dealt with these things in the past and am currently in the middle of trying to clean my computer from Trojan Sirefef.

To me, wiping the hard drive is the absolute last chance fix. There are many good forums much like this one that have techs who will walk you through the process of cleaning the computer for free.

The one I use is called www.techsupportguy.com. Create a login, then go to the  virus/malware removal forum and post your symptoms/malware/etc and wait for someone to respond. To speed things up, download a program called hijackthis (link should be on techsupportguy site) and run it and post the results in your initial post. This is a quick system snapshot of what programs are running and they can see what doesnt belong.

A few years back my computer autoinstalled an update which completely screwed up my computer, blue screen of death and all. I called Dell and explained it was one of their updates which caused the problem. Their solution? Wipe out the entire hard drive. I said F that and got on to techsupportguy and explained my situation. They walked me through uninstalling that particular update and bingo...computer back to normal.

I ran into this problem with my netbook a couple of years ago, and ultimately all I did was clean the system and reinstall the OS.  If you have your files backed up, you should be good.  Might need to follow up with some of the vendors if you have license keys, but that's relatively trivial and shouldn't be an issue for those that rely on physical addresses/IDs for authenticating your system.

Rootkits are notoriously tough to get rid of, and at some point just starting over makes more sense than slamming your head against a wall.

back.  I went to the web site AUMHA.net and looked/searched through a variety of threads.  A number of other people were having similar problems and they fixed it for them.  About AUHMA:

• They are computer guys who do this free but expect donations.  If they fix your problem, then I am sure you will be willing to donate.

• They solve a variety of problems for a lot of people.  Look through the relevent threads and see how they handle people and what they expect.

• How it works:  Unlike MGoBlog, you are instructed to post on your own thread ONLY.  If you post on someone else's thread, they will likely not only not help you but ban you. 

• These guys do not suffer fools at all.  Do exactly what they ask, everything they ask, and in the order that they ask.  You screw up once, they will berate you.  Screw up a second time and they likely will lock your thread and not deal with you.

• Your problem will be solved, but it will probably take a couple of days of back and forth e-mails and you sending some logs for them to check.

You will get one-on-one help with an expert with no cost except you donation if and when you choose to make one.  However this dialog that you have will be visible to anyone on the net. 

Everyone is instructed not copy the protocol set forth in threads (no matter how pertinent the other person's situation is to yours) other than the one(s) you start.  If you do, and this does not solve you problem, and then you start a thread asking for help, they will likely lock you thread.

Hope that helps.

I need to backup my computer.  Haven't done that in a while.  Once my kids got their own computers, things have been a lot "cleaner" with this system.

Trojans are tricky to get rid of because they update themselves. You can scan and remove all you want, but if there is a connection to the internet it will not go away. To fix this problem you have to scan in safemode.

If you want to make sure it gets out you have to learn the hard way. Find out which files are executing, back everything up and get rid of them manually.

Ditch your anti-virus, the knowlegde of protection systems and intrusion prevention is better then any anti-virus you could ever buy.

this thread makes me happy i no longer use windows.  I splurged on a shiny new imac in 2006.  It still works like new.  I've never had a virus.   I think the last time I rebooted it was 5 months ago

I'd second the malwarebytes/combofix route.  While "ghetto" in appearance as someone mentioned, combofix is an extremely effective tool.  MB run in safe mode w/ networking (for definition update) can be useful if you follow it up with normal mode scans.  I've found it usually works best to tackle these problems with a nice arsenal of tools at your disposal.  Most of the aformentioned programs will work well for you.  The only resource limiting you is time, and how much you're willing to dedicate to the task. 

I'll also third/fourth/fifth the notion of getting rid of McAfee and using Microsoft Security Essentials.  It's lightweight and unobtrusive, sort the far end of the pendulum swing from MS's User Account Control

I used to fix mine, but I don't really remember how to, there are message boards that can help you step by step, I used forospyware.com but is in spanish.

There are tools like antimalwarebytes wich help a lot and some other that gives you the root directory, I remember one called bazooka, but it was when I had a pentium 4 computer with Windows xp so maybe that's too old now, you had to write down the directions and restart the computer in safe mode, then erase those files and directories, some needed additional software like killbox to be able to delate the files. Some other software like edowe (I think it was called that) was usefull to scan the computer and get the logs, people in those message boards read the logs and tell you what to erase or so, but after half a day I was able to remove red sheriff, a really nasty spyware very hard to remove as far as I know, perhaps backing up everything and reinstalling windows would be easier.

Download a USB Virus scanner such as Kaspersky to a USB drive, off another computer. Then boot up in safe mode, run the scanner, and hope that the virus is removed. 

Talk about nuking above, but that's a last resort option in my opinion. 

Also, this laptop is an utter piece of junk, the fan is actually blaring right now and making some irritating noise. I heard the ultrabooks are pretty nice, but they're pretty expensive compared to the other laptops I'm looking at in Newegg. It's about the same age as the OP's laptop, so I could use a new laptop that actually runs videos and surfs the internet without freezing!