Virus HELP (Possibly Zeroaccess)

Viruses and worms
1

As stated previously here : http://forum.avast.com/index.php?topic=53253.0
I have Malwarebytes installed and ran the DDS with the following text logs down below.
If Combo fix is still needed or other malicious software removal tools are, then it would be much appreciated.
I am currently just trying to stop or figure out what may be wrong with my PC : /
I also have Windows Security essentials installed and am wondering if that will degrade security at all with malware bytes also installed on my comp.
I noticed the virus about yesterday and found it under the “Save-AS” or “web-search-good results.info” tags, but knew that the removal tools provided by a google search are probably just leads to more viruses.
Also, just wanted to point out that jeffce’s post brought me here, and from the looks of it you guys know what you are doing, which is reassuring for anyone in my situation.
Anyways, Can someone please help?
:-\

2

go to the link you posted above…attach the following logs

AdwCleaner
Malwarebytes
OTL
aswMBR

removers are notified

3

Hi do not use combofix as it has been pulled… Time for me to get my hands dirty ;D

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.good-results.info/
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}
IE - HKU\S-1-5-21-3470973704-1900168078-3303168660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.good-results.info/
O2 - BHO: (SaveAs) - {0715CCEB-EA4A-9471-96B6-25AF1D797B5D} - C:\ProgramData\SaveAs\51075edf4fb73.dll File not found
[2013/01/28 21:07:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SaveAs
[2013/01/28 21:07:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveAs
[2013/01/28 21:07:02 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

4

HAHA, the grin made me chuckle a bit.
Ok, so heres the quick scan log after the initial OTL scan with that cool restore point source code placed in and kind of made me worried for a bit : /

Thanks for the quick responses!

5

How is the computer now, any alerts ?

Download AdwCleaner from here to your desktop
Run AdwCleaner and select Delete

https://dl.dropbox.com/u/73555776/AdwCleaner.GIF

Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that

6

ok, here it is.

7

How is the computer behaving now ?

8

Very nicely. I gave it some reddit candy and a lollipop for going through the treatment.
Thank you Dr. Essex! If ever a problem ill know where to go and will be more cautious with what I DL.
You have my utmost gratitude and acknowledgement for helping me so quickly.
Great community and help from UNITE members : D

9

OK then ;D

Run OTL and press the cleanup button, that will remove the tools