possible Trojan.Zeroaccess infection

system · 2015-10-03T04:21:31.000Z

Hello … this post may be long but I thought it best to be as detailed as possible. Starting on Sept. 23rd I’ve been getting this Avast message “A threat has been detected”. It happens 5 minutes after rebooting/restarting.

First time it shows this url …
URL: http:// vmddlxlckwoe.ru/ch5vf678ksdhv5op/

Five minutes later, it happens again the same url. Then five minutes later, it happens again with the url above following quickly with this url …
http:// vmddlxlckwoe.com/ch5vf678ksdhv5op/ and then this url http:// vvwxyylbsgjf.com/ch5vf678ksdhv5op/

So basically I hear and see the “A threat has been detected” message 5 times in total.

Here are 2 screenshots to view …

http://i62.tinypic.com/263vk43.jpg

http://i61.tinypic.com/29wpmdd.jpg

Then on Sept. 25th it keeps going off every 5 minutes, with no break. I did not install any programs the day this all started. I ran the Avast Smart scan, no detection. I ran a Malwarebytes scan, 1 file detected and deleted (Trojan.Dropped, C:\Windows\Remove.exe, Quarantined, [a042b67efb903204c5c388719e6341bf],)

Since Sept 25th, I’ve had Avast in Silent Mode. I have searched many times, trying to find a solution. No luck.

Now today, Oct 2nd I discover I have no internet. Called my ISP and was told they turned off my connection due to a virus on my computer. I was told I have 24-48 hours to clear it up, or I may lose my connection for 7 days. It was turned back on and the email they sent me said it was the Trojan.Zeroaccess horse. I downloaded the Trojan.Zeroaccess Removal Tool from Symantec as suggested, followed the directions and “No infections were found”.

Then I ran a full system scan with Avast. Two threats were found …

http://i60.tinypic.com/156fj1z.jpg

Avast then asks to run a Boot-time scan which I allowed. However the computer locked up at 13%. While restarting, Windows recommended the Startup Repair which I did. After another restart I got back to the desktop okay. BUT, 5 minutes later the Avast alerts start again due to Silent Mode now turned off. This time I’m seeing 7 alerts instead of the 5 from last week, one right after the other with these urls …

http:// d82bajd74y4yhd0i.cc/ch5vf678ksdhv5op/
http:// vvwxyylbsgjf.com/ch5vf678ksdhv5op/
http:// frvmtwqqnnop.ru/ch5vf678ksdhv5op/
http:// fttdiyuojuee.ru/ch5vf678ksdhv5op/
http:// felovsxummfb.ru/ch5vf678ksdhv5op/

http://i60.tinypic.com/2j0nts4.jpg

Then I ran another Malwarebytes scan, no detection. Before posting here I ran the Farbar Recovery Scan Tool and the aswMBR.exe. All 3 logs are attached.

I did notice in the aswMBR log this line …

23:41:12.277 File: C:\Users\Administrator\AppData\Roaming\4FFF169C\bin.exe HIDDEN

I thought I should mention that I got a popup earlier while running scans, saying “bin.exe has stopped working”. This happened between the Trojan.Zeroaccess Removal Tool scan and the full system scan with Avast earlier. The 4FFF169C folder from the HIDDEN line above was created on Sept 23rd, same day as the first Avast alerts started happening. Sure which I’d posted here earlier

I think that’s all for now Thanks for any help.

Deb

dbrisendine · 2015-10-03T05:08:05.000Z

FIRST >>>>

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[b] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/b]
Download attached fixlist.txt file and save it to the Desktop: (Note: you may need to relocate FRST64.exe from Downloads to the desktop.)

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

- Right-click on

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
- Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.

SECOND >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

- [b]Vista/7/8 users:[/b] Right click the [b]AdwCleaner[/b] icon on the desktop, click [b]Run as administrator[/b] and accept the UAC prompt to run AdwCleaner.

You will see the following console:

http://i1351.photobucket.com/albums/p785/dbreeze2/Scanners%20screens/AdwCleaner_v4111_zpsn56hzjza.png

- Click the [b]Scan[/b] button and wait for the scan to finish.
- After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: [b]Waiting for action. Please uncheck elements you don't want to remove.[/b]
- Click the [b]Clean[/b] button.
- [b]Everything checked[/b] will be deleted.
- When the program has finished cleaning a report appears.
- Once done it will ask to reboot, allow this

http://1.bp.blogspot.com/-vitKqfMQS4o/UEDylIQ7HJI/AAAAAAAABLc/Hx-IwqKoaxg/s1600/adwcleaner_delete_restart.jpg

- On reboot a log will be produced; please attach that in your next reply. This report is also saved to [b]C:\AdwCleaner\AdwCleaner[C0].txt[/b]

Optional:

NOTE: If you see AVG Secure Search being targeted for deletion, Here’s Why and Here. You can always Reinstall it.

system · 2015-10-03T07:28:39.000Z

Thanks for the quick reply dbrisendine! I ran FRST and AdwCleaner, logs are attached. After running AdwCleaner, the computer did not want to boot into Windows, just a black screen. Pressed reset and got back to the desktop. I thought I’d also mention, the 7 avast alerts are still there.

Deb

dbrisendine · 2015-10-03T07:52:25.000Z

My bad; one more time please …

Open notepad by pressing the Windows Key + R Key, typing in Notepad in the Run dialog and then pressing Enter. Please copy the contents of the Code box below. To do this highlight the contents of the box by clicking [Select] next to Code: , then right click on any of the highlighted text and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt


Start
CreateRestorePoint:
CloseProcesses:
Unlock: C:\Users\Administrator\AppData\Roaming\4FFF169C\bin.exe
C:\Users\Administrator\AppData\Roaming\4FFF169C\bin.exe
cmd: sfc /scanfile=C:\Windows\SysWOW64\explorer.exe
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It’s important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 by right clicking on the FRST64.exe file, selecting “Run as Administrator…”. The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show nothing (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/Press%20the%20FIX%20button_zpsdd5zi3mt.png

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please attach it to your reply post. Also, tell me how your system is running now.

system · 2015-10-03T08:35:13.000Z

Wow, all is quiet so far … 15 minutes after restart and no Avast alerts. Problem seems to be solved! ;D

Log is attached. So running the scans and removing the bin.exe has cleared up the Trojan.Zeroaccess infection?

avastuser3796 · 2015-10-03T15:20:25.000Z

Sorry to ruin your fun here. Please edit your initial post, and break every single one of your links

system · 2015-10-04T02:29:42.000Z

No fun ruined here Michael, thanks for the suggestion. I should have thought about that earlier!

dbrisendine, all is still well here. No alerts so far! I am wondering if running the scans and removing the bin.exe has cleared up the Trojan.Zeroaccess infection?

Thanks for the help, I sure do appreciate it!

dbrisendine · 2015-10-04T03:20:03.000Z

If your system is running fine and Avast is running OK then let’s remove the tools and get you on your way …

Clean up of Malware Removal Tools
Now that we are through using these tools, let’s clean them off your system so that should you ever need to have malware removed again (we hope not) fresh, updated copies will be downloaded.

[]Download Delfix from here to your desktop and double click it to start the program
[*]Ensure Remove disinfection tools is ticked
Also tick:
[]Activate UAC
[]Create registry backup
[]Purge system restore
[*]Reset system settings

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/DelFixSelectall_zps0f04cec4.png

[*]Click Run
[*]The program will run for a few moments and then notepad will open with a log. Note: Please save this log first before rebooting your system (if asked to); DelFix does not save the log as it is trying to remove all traces of our work on your system. Please attach the log in your next reply.

You can delete any log files left on your desktop as these are no longer needed.

system · 2015-10-04T04:58:34.000Z

After running Delfix I noticed the file extensions were now showing. They’ve always been hidden, but no problem. Hid them again

Log attached. Thanks again!

dbrisendine · 2015-10-04T05:50:11.000Z

You’re welcome! ;D

Have a great weekend and come back anytime you need help.

avastuser3796 · 2015-10-05T10:30:30.000Z

You can always enable Extensions: http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions#show-hide-file-name-extensions=windows-7

Announcements