Inactive System infected: ZeroAccess Rootkit Activity 4 and TidServ Activity 2

[paulisofi]

It does work! Shall I try to recover ComboFix log (in Safe
Mode) by going to C:\… like you said before?

 

[Broni]

If it's there post it.

 

[paulisofi]

Oh no! I hadn't done anything else yet and got a pop up saying Windows recovered from unexpected shutdown and that it can check for solution online. The problem was a blue screen and it lists the details. Please tell me if you need those as the pop up is still there. It also says it can check for solution or cancel (but this is not safe mode with networking). Before, when I chose safe mode, the option that was highlighted by default was "Repair Computer".

 

[Broni]

You can go for repair (I doubt it'll do anything but it won't break anything so give it a shot).

Let me know how it went.

 

[paulisofi]

I chose Repair and it wants to do a system restore. Before doing that, computer is waiting for me to select a keyboard layout from different options listed.

 

[Broni]

Skip that.
Restart manually to safe mode.
See if it'll boot to safe mode.

 

[paulisofi]

Sorry, not a System Restore but a System Recovery. Sorry, my bad.

 

[Broni]

Then go for it.

 

[paulisofi]

Broni, I can't t do that right now because first I'd need to update the back up of my work files.

 

[Broni]

Not a problem.
Let me know when ready....

 

[paulisofi]

But the computer is infected. Can I back up my work files from this infected computer? Won't it mess up my clean (not-infected) external hard drive?

 

[Broni]

Possibly.
I'd wait with backup.

 

[paulisofi]

So then I can't do the system recovery... I can't lose those files without updating their backup first. What do you suggest I should do?

 

[paulisofi]

This is the only place where the new files are.

 

[Broni]

Try to restart to safe mode one more time.

 

[paulisofi]

I restarted the PC in safe mode and I got combofix log report and saved it to desktop, but this safe mode doesn't have internet.

 

[Broni]

Restart in Safe Mode with Networking to post it.
Alternatively use USB flash drive to move it to a computer you're posting from.

 

[paulisofi]

Shall I restart it in safe mode with networking and paste the log in a post?

 

[Broni]

This is what I said

 

[paulisofi]

Sorry our messages crossed paths. I'm a little confused now. Let's see. To recap, I need to restart infected computer in safe mode with networking; that's clear enough. What confuses me is the flash drive part. What should i do with the usb flash drive? What should I move in there? Please know that at this time that my infected computer (let's call it "PC1") has no antivirus (I uninstalled NIS), I'm using my cell phone to post. I have another computer (clean) ("PC2") that I'm not using (it's not even plugged in) because it's in the same network the infected computer (PC1) and I fear the virus will go there too. Last time I used PC2 was last Friday and PC1 got infected 2 days later.

 

[Broni]

If you can restart in Safe Mode with Networking and post Combofix log from there that's all I need.

 

[paulisofi]

I can post from the infected PC.

 

[paulisofi]

I can certainly do that after I restart it in safe mode with networking.

 

[paulisofi]

Sorry, crossed messages again. I'll do what you just said. Thanks so much.

 

[Broni]

Go ahead....