Some what painfull - Trogan removal

I was looking for a picture of a MF 300 combine over the weekend and happened across a site I “DID NOT” want to be at. Picked up the ZeroAccess.eh & .ee Trojan. They somehow managed to shut down McAfee just long enough to launch that pop up showing virus removal. I knew I been had.

Anyhow, I ran Malwarebyte’s and clean out 4 Trojans but McAfee was popping up with a series of 3 blocks every few minutes (at least it was doing its job). A little research and I was able to locate the windows installer folder they were originating from, delete the contents, then emptied the trash.

Problem solved.

So if you get hit with it here is a bit of info;

There are a series of randomly named files it puts on the machine. If any of them do not get removed it will keep your AV program busy. I found the remaining files by looking through McAfee logs.

There is a youtube video that does a good job of explaining where to look for those files (search ZeroAccess removal). If you do all that and still get the blocks, open the log files and look for the source (in my case a windows installer folder) and delete the file(s). However they will still function from the trash can so you must empty it.

I use the free version of Malwarebytes and have no idea if the paid version would have found the randomly named file or not. Took me a about 5 hours over two days to figure this out, so I thought I would pass it along.

Yep, me too yesterday.

Allan

The paid version of Malwarebytes is cheap and it would have blocked the Trojan from installing on your computer. I have been using Norton Antivirus 2012 and the paid version of Malwarebytes for several years with no problems.

We run Avira and Malwarebytes (paid versions). Before downloading them, we got hit 3 times.

In our 2nd year with these softwares and not one virus or problem.