Win32:ZAccess-PB and Win32-Malware-gen

system · April 27, 2013, 8:25pm

Hello,
today I started getting messages about trojans named as mentioned in the subject title few minutes apart. I tried scanning with avast, it found the threads but couldn’t remove them. It also required a restart so it could do a complete scan before windows starts, but also couldn’t remove or repair the files. I found Logs to assist in cleaning malware and started doing some of the instructions without fully understanding them, so later I did another scan. The first time I was connected to the internet, OTL.exe wasn’t on the desktop and I had other folders open. The second time I had disabled the connection to prevent further damage, OTL.exe was on the desktop and I didn’t have any other windows open. I also ran AdwCleaner and Malwarebytes’ Anti-Malware both times, but then I saw that I should only attach the logs from OTL.exe, so I don’t know if I should have ran the scans. I hope this doesn’t provide additional difficulties.
The files OTL_1_ANSI and Extras_1_ANSI are from the first scan. The second scan didn’t provide Extras.txt. I was warned that converting to ANSI may result in loss in data, so I can provide the Unicode versions of the logs if necessary.

Pondus · April 27, 2013, 8:29pm

since it seems you have a rootkit…also attach aswMBR log

malware expert is notified

system · April 27, 2013, 9:01pm

Here it is.
The device is still disconnected from the internet, if it matters.
If you need anything else, like Malwarebytes’ Anti-Malware logs, tell me if I have to do the scans again, or the current ones will do.

essexboy · April 27, 2013, 9:51pm

Hi lets clear it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
[2013.04.27 19:06:29 | 000,004,608 | -HS- | M] () -- C:\Windows\assembly\GAC_32\Desktop.ini
[2013.04.27 19:06:29 | 000,006,144 | -HS- | M] () -- C:\Windows\assembly\GAC_64\Desktop.ini

:Files
C:\Windows\Installer\{fed56073-dc4d-3978-648c-46942f887592}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · April 27, 2013, 10:55pm

After OTL finished the fix and rebooted the PC it produced a log. I’ve included it just in case, it’s 04282013_010048.log
The OTL log after the quick scan is converted to ANSI with a warning for usage of Unicode symbols.
I permanently disabled avast, but ComboFix insisted it was still working. I pressed OK. Even though the shields were permanently disabled they were up again after restarting.
So far there aren’t any pop-ups and the only noticeable change is that the files’ extensions are no longer visible, which can be easily fixed.

Pondus · April 27, 2013, 11:03pm

Essexboy is in bed now, so check back tomorrow

essexboy · April 28, 2013, 10:32am

Combofix sets the file system to default as a part of its cleanup procedure, any further problems ?

system · April 28, 2013, 1:20pm

I haven’t encountered any further problems, thank you.

essexboy · April 28, 2013, 2:22pm

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove ComboFix
[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall
(Notice the space between the “x” and “/”)
then click OK

http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg

[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

Clear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
When it pops up at the first prompt select OK after it has done some calculations the tabs will appear
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button

https://dl.dropbox.com/u/73555776/disc%20clean.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe

system · May 1, 2013, 7:33pm

Hello, I have the same problem :-\ I send you the logs. Could you help me?

essexboy · May 1, 2013, 7:36pm

I will go direct to Combofix for this one

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · May 1, 2013, 8:09pm

Thank you for the quick reply. Here you are!

essexboy · May 1, 2013, 9:11pm

Could you confirm the alerts have ceased

Please download Malwarebytes Anti-Malware to your desktop.

[*]Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
[*]At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select Perform quick scan, then click Scan as shown below.

http://i1224.photobucket.com/albums/ee380/jeffce74/MBAM-2.jpg

[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

The log can also be found here:

Windows 2000 & Windows XP:
C:\Documents and Settings<USERNAME>\Application Data\Malwarebytes\Malwarebytes’ Anti-Malware\Logs

Windows Vista & Win7:
C:\Users<USERNAME>\AppData\Roaming\Malwarebytes\Malwarebytes’ Anti-Malware\Logs

system · May 1, 2013, 9:20pm

Thanx! Right now the alerts have ceased!!

Thank you very much!!!

essexboy · May 2, 2013, 1:13pm