My ISP emailed me a couple days ago to inform me that the laptops on my network might be infected with zbot/Zeus Trojan.
They recommended I scan with Microsoft Safety Scanner and a Symantec Zbot Removal Tool. Both of those scans came back clean.
I also used Superantispyware and that found some adware cookies.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.
SECOND >>>>
AdwCleaner by Xplode
Download AdwCleaner from here or from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.
Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:
[li]Click the [b]Scan[/b] button and wait for the scan to finish.
- After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: [b]Waiting for action. Please uncheck elements you don't want to remove.[/b]
- Click the [b]Clean[/b] button.
- [b]Everything checked[/b] will be deleted.
- When the program has finished cleaning a report appears.
- Once done it may ask to reboot, allow this
[/li]
The Fixlist removed one malware file and cleaned up left over settings / keys that needed to be closed so malware could not use them in the future. AdwCleaner removed a setting for a bad IM that is no longer on the system (again for the same reason; so nothing can use that key / setting in the future).
I did not see specific instances of Zbot / Zues but your ISP may have just been saying that there was a network traffic pattern that matched the infection. Please let us know if your ISP continues to see this “infection”.
Wow, that’s scary, none of the other scans showed anything. Was the malware something really dangerous? Also, is it okay if I post scan logs for my dad’s laptop on this thread? It’s the only other Windows using thing on my network and I want to be doubly cautious now.
I was just double checking because you found malware on my laptop and I thought I was safe. Was the malware you found on mine anything scary? Also, my dad’s laptop is agonizing slow so I thought there was for sure something there.
Thank you guys so much! Its such a huge relief to know that it was a false pos from my ISP.