Zero Access/trojan horse dropper.generic_c.mmi

ryanpic · Jul 17, 2012

My AVG has detected it, also had one that said "backdoor" pop up. Ran basic scans on malwarebytes etc. to no avail. Random tabs open on firefox/when I'm googling, but no other symptoms. I'm wondering if it works to just do a system restore? Or is it engrained in my system. I don't know if I can reinstall windows as my DVD drive doesn't work (not related)

I saw this fix: Spencer to the rescue.. (seems too simple to actually work)

Hi, I have found a soultion to the problem.

1. Go to start, type "cmd" to open the command prompt
2. Type or copy & paste "sfc /scanfile=c:\windows\system32\services.exe" and press enter
3. Restart your computer
This will replace the infected services.exe with the original.
If it dosen't work try it in safe mode.

I would greatly appreciate any advice, I've read other threads but it seems like the fixes are user-specific so I don't want to mess anything up. Seems like from what I've read simple fixes won't work because it's deep in your system. I appreciate anyone who is gracious enough to give me their valuable time.

ryanpic · Jul 17, 2012

I just hope that it's not unfix-able for a novice like me, I'm feeling rather hopeless.

Kestrel13! · Jul 17, 2012

What operating system are you on? If on Win 7 or Vista run the below.

For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

If on XP then you should follow these instructions instead.

READ & RUN ME FIRST. Malware Removal Guide

ryanpic · Jul 18, 2012

Thank you, good sir. I shall acquire a flash drive from my friend and report the log tomorrow, probably around this time.

Kestrel13! · Jul 18, 2012

Thank you, good sir.
Click to expand...

You're welcome. But believe it or not, I'm actually female!!

ryanpic · Jul 19, 2012

Forgive me for my unintended sexism. Here's the log : )

Kestrel13! · Jul 19, 2012

Boot to System Recovery Options and run FRST again.
Type the below bolded text in the edit box after "Search:".

services.exe

Then click the Search button.

It will make a log (Search.txt) on the flash drive. Please attach this log to your next reply.

----------------------------------------------

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

-------------------------

Run FRST again like you did the very first time. Attach the log. So three logs to attach all in all please.

ryanpic · Jul 19, 2012

logs

Kestrel13! · Jul 20, 2012

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

---------------

Run FRST like you did the very first time again and attach that log too.

ryanpic · Jul 20, 2012

thanks again for your time.

Kestrel13! · Jul 20, 2012

You are most welcome. But I made a slight error and something was not done correctly, let's try again!

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

------------------------

Run FRST again like you did the first time and attach that log too please.

ryanpic · Jul 20, 2012

here ya go.

Kestrel13! · Jul 21, 2012

Hello, is everything running smoothly at this point or are there more problems?

ryanpic · Jul 21, 2012

Seems like everything is going well, which is practically miraculous from my point of view, an every day fix from yours : ) Are there any other parameters I can take to ensure? Thanks again.

Kestrel13! · Jul 21, 2012

You are most welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Zero Access/trojan horse dropper.generic_c.mmi

ryanpic Private E-2

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

ryanpic Private E-2

Attached Files:

Fixlog.txt

Search.txt

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

ryanpic Private E-2

Attached Files:

Fixlog.txt

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

ryanpic Private E-2

Attached Files:

FRST.txt

Fixlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Zero Access/trojan horse dropper.generic_c.mmi

ryanpic Private E-2

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

ryanpic Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

ryanpic Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

ryanpic Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ryanpic Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches