Malware in services.exe

Kreegath · Oct 23, 2012

I noticed that my windows firewall wasn't running, so I installed AVG Internet Security and ran a scan to find a virus in services.exe called win64/Patched.A. I tried running Roguekiller, Malwarebytes', tdsskiller, hitmanpro and MGlogs according to the "Vista and Win 7 Malware Removal/Cleaning Procedure" guide. But while the other programs seemed to do what they were supposed to, tdsskiller found but couldn't cure the virus, just like AVG. tdsskiller says it's found "virus.win64.zaccess.a" and that "There are unprocessed malware objects" when trying to cure. UAC as well as daemon tools is disabled.
Please, is there anything I can do to fix this?

Kestrel13! · Oct 23, 2012

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

Re run HitmanPro and have it REPLACE this file as an option.

C:\Windows\system32\services.exe

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[ZeroAccess][FILE] @ : C:\Windows\Installer\{166c9fb6-a8f5-ab15-fbeb-361feffca4f6}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{166c9fb6-a8f5-ab15-fbeb-361feffca4f6}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{166c9fb6-a8f5-ab15-fbeb-361feffca4f6}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND

[Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Do not reboot your computer yet.

If you did not deliberately set this proxy yourself then please include it in the HJT fix further below:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>

R3 - URLSearchHook: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)

After clicking Fix exit HJT.

Delete this folder:

C:\ProgramData\blekko toolbars

Next part takes a while, so go off and do something else.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Rerun RogueKiller (just a scan) and attach log.

Same for HitmanPro.

Same for TDSSKiller.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Kreegath · Oct 23, 2012

Thank you very much for helping out! I think the virus might be gone, but will have to finish another scan with AVG to make sure. At first it looked bleak when HitmanPro couldn't do the REPLACE thing to the virus, it returned a message saying it was unable to finish it, but Roguekiller managed to remove the services.exe file without the computer autorestarting and afterwards everything seems to have gone just the way you described. Now I just need to
Again, thank you very much!

Kestrel13! · Oct 24, 2012

Don't forget this part:

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
Click to expand...

Log in or Sign up

Malware in services.exe

Kreegath Private E-2

Attached Files:

HitmanPro_20121023_1933.log

MGlogs.zip

RKreport[1].txt

mbam-log-2012-10-23 (17-32-41).txt

tdsskiller report.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kreegath Private E-2

Attached Files:

RKreport[2].txt

RKreport[3].txt

HitmanPro_20121023_2327.log

tdsskiller report 2.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member