ZeroAccess and other Malware

jefemats · Jul 20, 2012

Hi there,

I've been having some malware problems lately and were wondering if you could help. There have been Google redirects, pop-ups in Firefox, and general computer slowness. My problems are similar to this user's:

http://forums.majorgeeks.com/showthread.php?t=261949

I also ran AVG and it detected:
1) c:\Windows\assembly\GAC_64\Desktop.ini (infection: Trojan horse Generic28.ANIC)
2) c:\Windows\assembly\GAC_32\Desktop.ini (infection: Trojan horse BackDoor.Generic15.AXLA)

I ran your 6-step pre-posting method, and step 6 showed that the Trojans and malware still exist, so I have attached the logs. Any help you could provide would be appreciated, thanks. Please let me know if you require additional info, thanks.

Kestrel13! · Jul 20, 2012

http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

jefemats · Jul 23, 2012

Hi,

Thanks for the reply.

I ran the program and attached the log below.

Just FYI though, the only recovery disc that I had access to was a 32-bit Recovery disc, even though I am running Windows Vista 64-bit on my computer (which is the only OS installed). Since I was in 32-bit System Recovery, the 64-bit FRST64.exe did not work and I ran the 32-bit FRST.exe instead, which worked. If this makes a difference, please let me know. Thanks again.

Kestrel13! · Jul 24, 2012

Seeking some advice before I make the next move. Hang in there.

jefemats · Jul 24, 2012

Hey,

So I finally was able to get a 64-bit Windows Vista System Recovery Disc. I ran FRST64.exe and attached the log below. Thanks again for the help.

Kestrel13! · Jul 25, 2012

Excellent!

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

------------------------------

Run FRST again like you did for me before, no fix, just a scan and attach that log too. Let me know how things are running.

jefemats · Jul 25, 2012

Attached the fixlog and new FRST log. It seems to be running better, but I just ran the FRST 10 minutes ago, so we'll see. Thanks again.

Kestrel13! · Jul 26, 2012

OK, just checking something with thisisu. Hang in there.

Kestrel13! · Jul 27, 2012

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

ZeroAccess and other Malware

jefemats Private E-2

Attached Files:

RKreport[1].txt

mbam-log-2012-07-19 (19-00-18).txt

hitmanpro.zip

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

jefemats Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

jefemats Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

jefemats Private E-2

Attached Files:

FRST.txt

Fixlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member