Win32:ZAccess-PB trojan horses

system · July 12, 2013, 8:39pm

I keep getting continuous notifications of the trojan horse mentioned in the subject bar. Each time I turn on my computer the alerts start up about 20 minutes into usage, I receive up to 50 notifications of the same trojan horse in different files, and then the alerts stop. I’m not really sure how to handle this because avast can’t delete them. Each time I run a scan and try to delete the viruses, I get alerts saying the files are only accessible by password.

Pondus · July 12, 2013, 8:44pm

follow guide and attach logs, not copy and paste. http://forum.avast.com/index.php?topic=53253.0

run in order listed
AdwCleaner / Malwarebytes / OTL / aswMBR

when done a removal expert will be notified

system · July 14, 2013, 2:44am

I’ve attached all four logs!

Pondus · July 14, 2013, 4:06am

your AdwCleaner log say search… to remove the crap files listed, run ans click delete

malware removers are notified, check back later…

system · July 14, 2013, 6:40am

Hi,

Remove Norton Antivirus this tool
https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us?product=home&version=1

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.



:Files
C:\Users\Rae\Desktop\Recovered Files\Users\Rae\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}
C:\Users\Rae\Desktop\Recovered Files\Windows\Installer\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}
C:\Windows\assembly\Desktop.ini

:Commands
[emptytemp]
[CREATERESTOREPOINT]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

.

Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.

[*]Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.

Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.

When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
Attach log reports ( ComboFix.txt) back to topic.

system · July 14, 2013, 10:21pm

I’ve attached the logs for OTL and ComboFix.

system · July 14, 2013, 11:05pm

Just a heads up, I’m still getting notifications for trojan horses.

system · July 15, 2013, 8:11am

Open notepad and copy/paste the text present inside the code box below:



File::
c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMNETS.SYS
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\Ironx64.SYS
c:\programdata\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\IPSDefs\20130712.011\IDSvia64.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\ccSetx64.sys
c:\programdata\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\BASHDefs\20130620.011\BHDrvx64.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMDS64.SYS
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMEFA64.SYS
c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\SyDvCtrl64.sys


Folder::
c:\program files (x86)\Symantec\Symantec Endpoint Protection

Driver::
EraserUtilRebootDrv
SepMasterService
SYMNETS
SymIRON
IDSVia64
ccSettings_{3771A34D-2132-48EA-A486-D62ECDF9D553}
BHDrvx64
SymEFA
SymDS
SyDvCtrl

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

Save this as CFScript.txt

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )

.

Please download Farbar Recovery Scan Tool and save it to your desktop.

[color=green]Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · July 17, 2013, 5:51pm

I know the previous instructions asked me to copy and paste the FRST log into this reply, but the log exceeds the allowed number of characters, so I just attached it as well.

system · July 17, 2013, 5:51pm

Here’s the FRST log.

system · July 17, 2013, 6:14pm

The infection is gone but there are two antivirus, Notron and Avast.

system · July 17, 2013, 6:23pm

Uninstall Avast through the Programs and Features and then run the Avast Uninstall tool from Safe Mode
http://www.avast.com/uninstall-utility

Double click dds to run the tool.

* When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

system · July 17, 2013, 10:23pm

I went ahead and uninstalled the avast software, but I don’t actually have Norton on my computer. I have Symantec Endpoint Protection, and I’m aware that Symantec makes Norton, but will the Norton Uninstall Tool work for Symantec Endpoint as well?

system · July 18, 2013, 7:12am

I have Symantec Endpoint Protection, and I'm aware that Symantec makes Norton, but will the Norton Uninstall Tool work for Symantec Endpoint as well?

I think it will remove.

system · July 29, 2013, 7:01pm

Everything I’ve tried to remove Symantec Endpoint has failed. I’ve tried the software you provided, traditional software uninstall procedures, and even a 3rd party software remover. Do you have any ideas of what I should do at this point?

Pondus · July 29, 2013, 7:22pm

a good place to start would be Norton website.

found this
http://www.symantec.com/connect/forums/how-remove-symantec-endpoint-protection-ver-110420275

or google it
https://www.google.no/search?q=how+to+remove+norton+endpoint+protection&ie=UTF-8&oe=UTF-8&hl=nb&client=safari

and video here
http://m.youtube.com/#/watch?v=rbga1t6xmGk&desktop_uri=%2Fwatch%3Fv%3Drbga1t6xmGk

system · July 29, 2013, 7:34pm

Remove icon (Combofix) and download new ComboFix to your desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Run Combofix. When the tool is finished, it will produce a log report for you. Attach log reports ( ComboFix.txt) back to topic.

system · July 29, 2013, 9:04pm

I’ve attahced the new comboFix log.

system · July 29, 2013, 9:33pm