Barrage of blocked viruses

General Topics
1

This morning I began receiving Avast pop up messages that a trojan horse had been blocked and no further action is necessary. I’ve been getting the same message every few minutes for several hours. The file that is being blocked is called RECYCLER

I deleted my cache and my cookies and restarted my computer, but it’s still happening. Does anyone know what I might do about this?

Thanks! Neil

2

It is the latest zero access it hides here

========== ZeroAccess Check ==========

[2012/09/23 00:35:44 | 000,002,048 | -HS- | M] () – C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720@
[2012/09/23 00:35:44 | 000,077,312 | -HS- | M] () – C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720\n
[2012/09/23 00:35:44 | 000,000,000 | -HSD | M] – C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720\L
[2012/09/25 13:41:05 | 000,000,000 | -HSD | M] – C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720\U
[2012/09/25 08:47:25 | 000,000,804 | ---- | M] () – C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720\L\00000004.@
[2011/01/19 15:05:22 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini
[2012/09/25 13:15:19 | 000,005,120 | -HS- | M] () – C:\WINDOWS\assembly\GAC\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
“ThreadingModel” = Both
“” = C:\RECYCLER\S-1-5-21-1914378695-1302515424-3380946746-96952$ff2caa1aa22dfcfd966705d0cb61f720\n. – File not found

[HKEY_LOCAL_MACHINE\Software\Classes\clsid{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
“” = %SystemRoot%\system32\shdocvw.dll – [2010/11/05 07:05:36 | 001,510,400 | ---- | M] (Microsoft Corporation)
“ThreadingModel” = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
“” = C:\RECYCLER\S-1-5-18$ff2caa1aa22dfcfd966705d0cb61f720\n. – [2012/09/23 00:35:44 | 000,077,312 | -HS- | M] ()
“ThreadingModel” = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
“” = %SystemRoot%\system32\shdocvw.dll\system32\wbem\wbemess.dll

http://forum.avast.com/index.php?topic=53253.0 follow the steps here, I will continue in this thread

3

I’ll move the thread to the virus category. I want to find out how to get rid of it…It doesn’t show up on an Avast scan…

4

We can continue here if you wish

5

Thanks Essex, Can Avast get rid of this? It seems to be blocking it but it happens every couple of minutes. I thought I had a cookie or something that was causing some website to continuously try to download it, but I deleted all my cookies. It’s happening both on Explorer and Chrome.

6

Avast is essentially preventing it from getting worse (all of the blocked URLs), but getting rid of the underlying zero access rootkit requires specialist tools to first generate log files so that they can be analysed by a malware removal specialist (essexboy).

He will then give a custom fix for your system, so you need to follow the instructions given in the link he posted in his first reply. You now need to run the tools and ‘attach’ the logs in this topic.

There may be some delay due to differing time zones and availability of the volunteer malware removal specialists. It is not almost 1:30am in the UK so essexboy will be in bed.

7

Thanks, unfortunately I don’t know where to begin and what to do with the posted code…Is there a simple way to tell me how to apply it?

8

Essexboy gave you a link to the guide above…here it is again http://forum.avast.com/index.php?topic=53253.0

attach (not copy and paste) the logs from

AdwCleaner
Malwarebytes
OTL
aswMBR

9

Oh thanks, Pondus (and Essex) …I missed that earlier. I’ll give it a try. Neil

10

Ignore the data I posted earlier as that is just an example of the infection and not a fix