1 Reply Latest reply on Sep 10, 2012 11:44 AM by sol

    zeroaccess trojan is still there

      I have contracted and installed McAfee Internet Security 2012.

       

      Some days ago a pop-up message from the antivirus tool informed me that zeroaccess trojan had been removed. This message started to appear constantly (3 times every 4 minutes, zeroaccess.ee, zeroaccess.eh and zeroaccess.el). Besides, the icons on desktop appeared aligned at the left side, and mcafee protection services were desactivated with no options to activate them again.

       

      After looking for information about this virus and trying to remove its rootkit, finally it seems to disappear after executing kaspersky TDSSkiller. After that, finally mcafee services seem to be activated again.

       

      I also executed Spyhunter that showed me that I also had two other trojans:magania and lop.com.

       

      In addition, I run a full antivirus scan process with mcafee and any threatwas found. Why mcafee didn't detect this other two trojans? how can Ibe sure if they are in my pc and how can I remove them?

       

      A day later  McAfee services were again desactivated. I runned again spyhunterwhich, again detected some threats and apparently removed them.

       

      Since then, I could work with my pc, but every 4 minutes there were messages of 3 threats. Some days ago, suddenly, the zeroaccess.el messages dissapered, and only two messages were added every time.

       

      Since today all those threats were removed by McAfee. Some minutes ago, one of these threats couln't be removed.

       

      I know that my pc is still infected and I don't know how to clean it completely. What can I do? Is McAfee to develop any tool to finish completely with this trojan?

       

       

       

      Thank you very much in advance

        • 1. Re: zeroaccess trojan is still there
          sol

          You may need to reboot the computer, and boot up in safe mode to stop the process that is preventing you from removing the file.

           

          It has been my experience as well that under the Windows\Installer there is usually a folder with different font ( smaller than the others) and once that is removed, the issues seems to stop. not all will have this unusual folder. But that's been my experience on the many computers i have cleaned. the same fodler can be found under the documents and settings/user profile\local settings\application data   or   document and settings/user profile\application data

           

          You can also use the system restore and restore your computer to a time prior to the incident and re-install the McAffee and once you boot up free of the virus.

           

          Message was edited by: sol on 9/10/12 11:44:08 AM CDT