Possible Zeus Remnants?

Lev621 · Nov 5, 2014

Hey all. I'm having issues with what I think may be remnants of the Zeus virus. Avira recently started popping up with notifications of Zeus detections. When I first detected it, I ran a web search and found a guide to remove it at the following link:

http://malwaretips.com/blogs/zeus-trojan-virus/

I followed this guide, but something is still lingering. My computer is running very slowly and I'm unable to turn on my firewall in either Avira or Windows Firewall. I also had issues with Internet Options shutting off my ability to download each time I rebooted and I'd have to re-enable it in the security settings section of Internet Options each time. There was also an issue with Avira no longer letting me update. I've reinstalled Avira, and Internet Explorer, which seems to have cleared those 2 issues. That leaves me with just the firewall issue, and the slow speed now that I am aware of.

I've attached all the logs requested. Please note, the attached logs are not from when I was following the removal guide in the link above. These are run after the fact when I realized there was still an issue.

If anyone can help me out, I'd appreciate it. I'm completely stuck at this point.

Thank you.

TimW · Nov 5, 2014

In your Newfiles log, Avira is not listed. Only Antivirus Pro is listed.

Do you know what these are:
C:\ProgramData\EicyElaq
C:\ProgramData\TucniGijgo

If not, delete them.

I am not finding any malware in your logs.

What malware issues are you having, if any?

Lev621 · Nov 5, 2014

I don't recognize those files, so I'll get rid of them.

Antivirus Pro is the Avira software I have. My major issue right now is ever since the Zeus infection I haven't been able to turn on my firewall(both my antivirus firewall and regular windows firewall). Since it's both, my guess was there's some service or file they both rely on that the virus shut off, damaged or removed.

When it first started, I was getting an error code when I tried to turn it on. Like 08X9328583 or similar (this number isn't the code I was getting, just similar format - I no longer get the code, so unfortunately can't get you the exact numbers). I used Microsoft's firewall repair tool straight off their site, and now that error code no longer appears, but the firewall still can not be enabled. When I click "Use recommended settings" the cursor spins for a minute or so, then gives me back control without activating the firewall.

In the case of Avira, when I clicked to turn the firewall on, it used to say "Windows Firewall is not using the recommended settings", and now it too just spins for a minute and says nothing when I try to enable it. The screen shots of both firewall windows are attached.

Kestrel13! · Nov 5, 2014

Try this... (It takes a LONG time to run so go off and do something else for a while)

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Lev621 · Nov 6, 2014

That worked. Thanks a lot! I ran it overnight, and this morning my computer had rebooted and the firewall was up and running.

I appreciate the help.

TimW · Nov 6, 2014

On behalf of Kestrel and myself, you are welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Possible Zeus Remnants?

Lev621 Private E-2

Attached Files:

MGlogs.zip

RKreport[1].txt

Malware Bytes.txt

TDSSKiller.txt

HitmanPro_20141103_1715.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Lev621 Private E-2

Attached Files:

Windows Firewall.JPG

Avira.JPG

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Lev621 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member