Virus:W32/ZeroAccess

Manual repair

Caution: Manual repair is a risky process; it is recommended only for advanced users.

The following manual removal instructions apply to Windows 7 systems with a service.exe file infected by Trojan.patched.sirefef.[variant], and with F-Secure Internet Security 2012 (FSIS 2012) installed.

• Turn off real-time scanning to prevent interference with the removal process.
• Boot to safe mode
• search for the backup copy of services.exe; this copy will usually be:

  • C:\Windows\Winsxs\[directory path]\services.exe
• Go to C:\windows\system32\ folder and rename the infected copy of the services.exe file to 'services.exe.vir' (use cmd.exe if necessary)
• Copy the backup services.exe file from the Winsxs folder to C:\Windows\system32\
• After reboot, open the FSIS 2012 product and uncheck the "scan only known file types" setting under manual scanning.
• Next, run a full system scan. The product should detect items in the following locations:

  • C:\Users\[user]\appdata\local\{[numbers]}\n
  • C:\Windows\Installer\{ [numbers]}\n
  • C:\Windows\Assembly\gac\desktop.ini OR \gac_32\desktop.ini
• The product should then prompt for reboot to remove one of the n files listed above. Note: if the n files are not detected by the product:

  • Please send a copy to the Submit A Sample (SAS) for a Labs Analyst to create the necessary detection.
  • Then boot to Safe Mode to manually locate the n files at the locations listed above. Rename the files to "n.vir", then restart in normal mode and delete the entire folder with those files.
  • If any file is locked by services.exe, first fix services.exe as above.
• After reboot, manually delete all remaining traces of the malware by deleting the {[numbers]} folders
• Finally, re-enable real-time scanning, reboot and run another full scan.

Notes: Many users will also find files in the Java cache being detected for Blackhole exploits; this is the most commonly dropped on the computer on visits to compromised/malicious sites silently serving the exploits. The detected files may be removed.