ZeroAccess Infection - Internet Access Broken

I was/am infected with the ZeroAccess rootkit.

I noticed that something was wrong when I was getting my Google search results redirected to bugus sites.

I ran TDSSkiller but it immediately terminated after I ran a scan.

I could not get Combofix to run either.
I tried this in both normal mode/safe mode with networking.

I was able to get the software to run in Safe mode.

Combofix alerted me that I was infected with the ZeroAccess rootkit and that it is difficult to remove. It also mentioned to me that the ZeroAccess rootkit infects the TCP/IP stack.

After running Combofix and restarting the machine I am no longer able to access the internet.

I tried running Combofix again but it did not solve the issue.

I tried deleting my NIC from the device manager and that did not help.

I also reset the TCP/IP stack and Winsock but that did not help either.

Upon start-up I get WSA Socket Errors 10050 and 10038.

I am really out of ideas... I don't want to reformat.

Is it possible I'm still infected after running Combofix?

 

A lot of those rootkits change the proxy settings. Go to control panel and then Internet Options and click the connections tab. There is a button called "Lan settings". Click that and make sure they did not change your proxy settings.

 

ask for assistance from one of the sites listed. once malware is removed you might need to repair os install
www.wilderssecurity.com/showpost.php?p=1533481&postcount=3

combofix is most useful in a hand of an experienced antimalware removal specialist (trained user)

 

You can mess a computer up using Combofix if you don't know what you are doing.

 

Yup.

I suggest hitmanpro.

 

Scan with one of the many bootable Antivirus Rescue CD's. Here are some examples.

1. Avira Rescue System
2. Kaspersky Rescue Disk 10
3. Dr.Web LiveCD (Slow scan speed)

 

This is why its a good idea to have a clean system image available. Many of these rootkits are near impossible to repair and still have a usable system afterwards.

 

I should have ben more clear.
I am not getting an from DHCP anymore. Windows reports limited to no connectivity.

 

I would run Avira and Kaspersky rescue disc and see if they find something Combofix missed.

 

You can repair many things with this utility: http://maketecheasier.com/d7-troubleshoot-your-computer/2011/06/04

Videos:
http://www.youtube.com/watch?v=5KjzPi6KRek&feature=channel_video_title

http://www.youtube.com/watch?v=09Z4Yc9Kknk&feature=relmfu

 

To be honest, you really should consider reformat. It could save you time, and at the same time, it could give you a peace of mind.

 

And also a discussion on the subject: https://www.wilderssecurity.com/showthread.php?t=303030

TH

 

I would "wipe" (zero write to all hard drive sectors) and then do a "full format" just to have a "Peace of Mind".

 

Yes and even better would be if he had an image to go back to.

 

TrueCitrus,
Just curious, what was running in realtime, securitywise when the infection took place?

 

Symantc Endpoint Protection

 

I second that!