Inactive Rootkit Virus Problem, Report: I've tried all Virus Scanners! No Solution Win64

Status
Not open for further replies.
Hello,
I have a windows 64 vista hp laptop with
Viruses: Win64.zaccess.b, sirefef and all the other relative trojans.

So I've been having problem with this rootkit virus probelm for a while now, a long time. I came to a point where I don't know if I have it or don't.

Problems that I still have:
1. Possibly related to: Ads "recommended" that show up at the bottom right of 'any' browser, its not exactly a pop-up, its this box with text-ad inside of it, sometimes its inside an iphone box. Also the browser redirects randomly to other sites from google.
2. Firewall is blocked.
3. Task Scheduler is corrupted or has a bad image.

my aswmbr.txt doesn't show any rootkits or atleast to my knowledge:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-05 14:31:47
-----------------------------
14:31:47.698 OS Version: Windows x64 6.0.6001 Service Pack 1
14:31:47.698 Number of processors: 2 586 0x170A
14:31:47.699 ComputerName: OMAR-SIDKY UserName: Omar Sidky
14:31:49.052 Initialize success
14:31:54.722 AVAST engine defs: 12070501
14:32:00.680 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
14:32:00.682 Disk 0 Vendor: FUJITSU_MHZ2320BH_G2 8909 Size: 305245MB BusType: 3
14:32:00.725 Disk 0 MBR read successfully
14:32:00.727 Disk 0 MBR scan
14:32:00.732 Disk 0 unknown MBR code
14:32:00.735 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 292471 MB offset 63
14:32:00.760 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 12770 MB offset 598982656
14:32:00.879 Disk 0 scanning C:\Windows\system32\drivers
14:32:11.488 Service scanning
14:32:36.010 Modules scanning
14:32:36.016 Disk 0 trace - called modules:
14:32:36.052 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys acpi.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
14:32:36.056 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004df6790]
14:32:36.061 3 CLASSPNP.SYS[fffffa60007a7b3a] -> nt!IofCallDriver -> [0xfffffa8005cecb20]
14:32:36.065 5 hpdskflt.sys[fffffa6001fec0ee] -> nt!IofCallDriver -> [0xfffffa8004be48f0]
14:32:36.070 7 acpi.sys[fffffa60008faff6] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004be7060]
14:32:37.181 AVAST engine scan C:\Windows
14:32:39.404 AVAST engine scan C:\Windows\system32
14:36:37.922 AVAST engine scan C:\Windows\system32\drivers
14:36:56.638 AVAST engine scan C:\Users\Omar Sidky
14:48:18.030 AVAST engine scan C:\ProgramData
14:54:47.176 Disk 0 MBR has been saved successfully to "C:\Users\Omar Sidky\Documents\MBR.dat"
14:54:47.177 The log file has been saved successfully to "C:\Users\Omar Sidky\Documents\aswMBR.txt"

The only one that spotted the rootkit was microsoft essentials but it did nothing, and almost messed up my pc because it kept restarting every 10mins. Finally I turned off the auto restart and I got kaspersky and it did take'em out, and then 7hrs later it happens again the same BS. Now its not showing anything infected, but who knows maybe tomorrow it comes up again. A day later nothing shows up and and then finally I got malewarebyes that comes up with yet another rootkit virus (rootaccess)! This last action was done today.

Could you please help me?
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running tools or applying updates other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===============================================

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
 
I'm sorry man my USB ports are kinda messed up from playing to much games and I don't have a flash drive atm. I know its not my place to ask but is there another way, I really appreciate it.
 
Status
Not open for further replies.
Back