Trojan.ZeroAccess!kmem Infected my system and it won't leave

system · January 27, 2012, 9:46pm

Norton Internet Security reports I am infected, and can’t re4move the virus/rootkit. The Norton forums have referred me here for help.

It is much appreciated. I will post the logs as described in your forum for assistance.

Thank You Kindly for the help.

Log 1 Malwarebytes:

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.27.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Robert :: ROBERT-PC [administrator]

1/27/2012 4:37:30 PM
mbam-log-2012-01-27 (16-37-30).txt

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Asyn · January 27, 2012, 9:50pm

:o ;D

Please attach your logs.
http://forum.avast.com/index.php?topic=53253.0

essexboy · January 27, 2012, 9:51pm

Always glad to help

You might like to run and psot the aswMBR log first

system · January 27, 2012, 9:51pm

I am running OTL now, will post momentarily. Posting OTL.

aswMBR is running, will post asap. Already showing red lines with sirefef infection in tdx.sys.

system · January 28, 2012, 1:08pm

I am having trouble running aswMBR to completion. I have tried 3 times and and some point it stops functioning and I get the Microft message that the program has stopped responding and it will close after looking online for a solution.

Please Advise

I managed to copy the Log of the crash. See Below.

Problem signature:
Problem Event Name: APPCRASH
Application Name: aswMBR.exe
Application Version: 0.9.9.1532
Application Timestamp: 4f216fd3
Fault Module Name: ntdll.dll
Fault Module Version: 6.1.7601.17725
Fault Module Timestamp: 4ec49b60
Exception Code: c0000005
Exception Offset: 00052d24
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional Information 1: 0a9e
Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
Additional Information 3: 0a9e
Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

essexboy · January 28, 2012, 1:46pm

OK that makes me suspicious

Two things to do now

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

THEN

Do the following:

[*]Click on the Start button and then choose Control Panel.
[*]Click on the System and Security link.

Note: If you’re viewing the Large icons or Small icons view of Control Panel, you won’t see this link so just click on the Administrative Tools icon and skip to Step 4.
[*]In the System and Security window, click on the Administrative Tools heading located near the bottom of the window.
[*]In the Administrative Tools window, double-click on the Computer Management icon.
[*]When Computer Management opens, click on Disk Management on the left side of the window, located under Storage.

After a brief loading period, Disk Management should now appear on the right side of the Computer Management window.

Note: If you don’t see Disk Management listed, you may need to click on the |> icon to the left of the Storage icon.
Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.

system · January 28, 2012, 2:33pm

It just finished. Log Attached. It appeared to find something as it was running which it said was difficult to fix.

system · January 28, 2012, 4:06pm

Screen Print attached.

Thanks Again for all the help.

Should I rerun aswMBR ?

essexboy · January 28, 2012, 6:33pm

Yes re-try aswMBR after this small combofix run please

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:

File:: c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ovuvdi.exe

Save this as [b]CFScript.txt[/b], in the same location as ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exeWhen finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

system · January 28, 2012, 7:44pm

Attached is the new Como Fix Run as requested. I am now re-running aswMBR.

Thanks

Update: I reran aswMBR and it once again crashed about an hour or so into it’s scan. Should this be run in safe mode? Here is Log.

Problem signature:
Problem Event Name: APPCRASH
Application Name: aswMBR.exe
Application Version: 0.9.9.1532
Application Timestamp: 4f216fd3
Fault Module Name: ntdll.dll
Fault Module Version: 6.1.7601.17725
Fault Module Timestamp: 4ec49b60
Exception Code: c0000005
Exception Offset: 00052d24
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional Information 1: 0a9e
Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
Additional Information 3: 0a9e
Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

essexboy · January 28, 2012, 10:26pm

Probably a conflict with Norton… Could you try again but in the scan drop down select none

Combofix did not appear to delete that file so I will try OTL

On completion of this can you let me know what the current problems are

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ovuvdi.exe
:Files
ipconfig /flushdns /c

:Commands
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

system · January 28, 2012, 10:53pm

OTL Log attached.

PC seems to be running much smoother, no more IE redirects to strange sites.

I reran aswMBR with the option you suggested. Ran Okay. Log Attached.

Do you know how I can shut down Norton Internet Security 2012 completely so that I can run aswMBR with Virus Chcecking on?

essexboy · January 28, 2012, 11:00pm

That now looks good

A final sweep for orphans I feel… No real need now for the main aswMBR run as the MBR looked OK

Please download Malwarebytes’ Anti-Malware

Double Click mbam-setup.exe to install the application.
[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish, so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

system · January 28, 2012, 11:14pm

Okay it ran through log below.

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.28.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Robert :: ROBERT-PC [administrator]

1/28/2012 6:07:33 PM
mbam-log-2012-01-28 (18-07-33).txt

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

essexboy · January 29, 2012, 12:28pm

Any problems remaining ?

system · January 29, 2012, 12:34pm

No it’s running fantastic.

essexboy · January 29, 2012, 12:38pm

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove ComboFix
.

[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall (Notice the space between the “x” and “/”) then click OK
.

http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg

.
[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled

.
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that

[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.

.

http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
.
Upgrading Java:

[] Go to this site and click Do I have Java
[] It will check your current version and then offer to update to the latest version

.
SPRING CLEAN
.
To manually create a new Restore Point

[*]Go to Control Panel and select System
[*]Select System
[*]On the left select System Protection and accept the warning if you get one
[*]Select System Protection Tab
[*]Select Create at the bottom
[*]Type in a name i.e. Clean
[*]Select Create

.
Now we can purge the infected ones

[*]GoStart > All programs > Accessories > system tools
[*]Right click Disc cleanup and select run as administrator
[*]Select Your main drive and accept the warning if you get one
[*]For a few moments the system will make some calculations
[*]Select the More Options tab
[*]In the System Restore and Shadow Backups select Clean up
[*]Select Delete on the pop up
[]Select OK
[]Select Delete

.
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

http://img233.imageshack.us/img233/7729/mbamicontw5.gif

Malwarebytes. Update and run weekly to keep your system clean
.
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
.
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe

system · January 29, 2012, 1:18pm

I just wanted to Thank You Kindly for taking the time to help fix this problem and for getting my system running again.

Enjoy the rest of your weekend.

essexboy · January 29, 2012, 1:20pm

My pleasure - enjoy ;D

system · February 11, 2012, 8:24pm

Small problem that seems to be related to the Virus removal?

Before the virus I was sharing my printer on the network. File and Network dicsovery were enabled under networks. The other day I tried to print a document from my other pc and it just hung in the print que.

I went to the Network list and tried to access the printer but it did not exist. I tried to add a network printer and it came back none found.

I went to the main PC that we did the virus removal on and tried to re-enable print sharing on the printer but it came back with an error.

I then went to network settings and looked at Network Discovery and file and print sharing and they were both turned off.

I figured it was just one of those things and I turned them back on and checked to see if I could share my printer. No good same error.

I went back and looked and file and print sharing and network discovery were both off again. It seems they won’t stay enabled.

I did a litte research and it seems certain services need to be running for the system to be able to share through the network.

    o Computer Browser
    o DHCP Client
    o DNS Client
    o Network Connections
    o Network Location Awareness
    o Remote Procedure Call (RPC)
    o Server
    o TCP/IP NetBIOS helper
    o Workstation

Some were not started for some reason so I started them, however the Computer Browser will not start. Error is 1060 specified service does not exist as an installed service.

I am at a loss if the above information I found is 100% accurate, but it seems to be a common thread for this issue.

I tried everything I could think off, turned off NIS, reboot in safe mode, changed network card driver etc.

Just to make sure I checked the other PC (which had no virus) and the Computer Browser service is running.

Could the virus removal have done something to the registry causing this issue?

Can we repair this?

Once Again I thank you for any guidance you can provide me.

Trojan.ZeroAccess!kmem Infected my system and it won't leave

Announcements