ZeroAccess Malware Removal prompts new D7 features!

D7 v4.6.4 now includes special methods related to deleting the reparse point created by this malware on the Tweaks tab > NTFS Junctions.  The new function is “Destroy Junction” which will be able to delete the junction point on top of the directory where the malware hides, allowing you to then delete that directory.

Haven’t seen this malware before?

• It IS accompanied by legitimate yet infected system drivers – the driver it infects is random. 
• Any app that attempts to terminate/disinfect the malware (or scan it’s registry locations) will be terminated, including D7/KillEmAll L 
• It also removes default ACL entriescausing several issues:

1.  Fire up D7, click the D7 menu > IFEO Modifier. 
1. Find and select this executable in the drop down list. (e.g. 123587654:12987432.exe)
2. Hit the CREATE button. 
3. Now it won’t be able to execute itself and stop you from standard removal. 
2. DO NOT DELETE THE MALWARE YET.  SIMPLY REBOOT THE PC.
1. (When the PC reboots you’ll note the malicious EXE is no longer running.)
3. Use TDSSKiller and cure anything it finds. 
1. Alternately, there are a few specific tools for this that may be useful to add to your flash drive: 
1. I have not yet used them, but note that neither tool does step 7 below, so don’t skip that final step!
2. http://anywhere.webrootcloudav.com/antizeroaccess.exe
4. REBOOT AGAIN.
1. Now would be a good time to FIXMBR.  Just in case a new variant also decides to start infecting the MBR… currently this step isn’t necessary however. 
5. Open D7, goto Tweaks tab > NTFS Junctions.  Scan the Windows directory.  
1. When found, you should see one junction probably named $NtUninstallKB32069$
2. Highlight the directory, click Destroy Junction.  When prompted, delete the directory underneath – unless you wish to visually inspect it.  Now the malware is really gone.
6. Follow up with the usual scans as if it were a normal infection.  
1. Don’t forget to delete the random numbers directory containing the ADS in %windir% (e.g. 123587654)
7. Run the Repair Permissions function on D7’s malware or repair tab. 
1. This fixes all of the ACL problems caused by the malware, should fix the antivirus (confirm it), and also MSSE installation or any other Installer error 2203’s that would otherwise occur.