• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs

Not what you are looking for? Ask the experts!

Kudos0

Trojan.gen 2 80000000.@ removal help

Hi there i hope someone can help with removal of this. Symantec endpoint discovered this virus/trojan and it cant delete it and and keeps giving me this messege every 5min

Scan type: Auto-Protect Scan

Event: Risk Found!

Security risk detected: Trojan.Gen.2

File: C:\Windows\Installer\{4835385a-b096-9719-2ea1-2fbcaaa3cc2e}\U\80000000.@

Location: C:\Windows\Installer\{4835385a-b096-9719-2ea1-2fbcaaa3cc2e}\U

Computer: AAYO-HP

User: SYSTEM

Action taken: Pending Side Effects Analysis : Access denied

Date found: 6. juni 2012 14:43:06

Hope someone can help i have been looking for an answer for hours. But none the wiser.

Replies

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Hello,

May I ask what version of Symantec Endpoint Protection you have installed? There was an issue like this that is addressed in RU7 MP2. If you are running an older version, I recommend upgrading at your earlist convenience.

http://www.symantec.com/business/support/index?page=content&id=TECH102953&locale=en_US

SEP 11 Release Notes - http://www.symantec.com/business/support/index?page=content&id=TECH103087&key=54619

In the future, it would be best to post SEP product issues in the Connect forums, as this is a consumer product (Norton) forum.

https://www-secure.symantec.com/connect/security/forums/endpoint-protection-antivirus

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

We are talking about Zeroaccess Rootkit here.

I will get to you in the line of other, don't touch the PC with trying to remove it from now on.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Ok waiting for your reply

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Please do not run any tools unless instructed to do so. 

  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please read every post completely before doing anything. 

  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )

  • Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Download OTL   hxxp://oldtimer.geekstogo.com/OTL.exe   (change the hxxp to http) save it to your Desktop.

Double click on OTL.exe to run it.  Right click OTL.exe and select run as administator for Vista and Win 7.

Disable Norton for say 30 minutes

Start OTL,  

Click the Scan All Users checkbox.

Change file age to 60 days

under  Copy and paste what is below between the lines



msconfig
activex
drivers32
netsvcs
C:\Program Files\Common Files\ComObjects\*.* /s
%systemroot%\*. /mp /s
%systemroot%\*. /rp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%SYSTEMDRIVE%\*.exe
/md5start
volsnap.sys
atapi.sys
explorer.exe
winlogon.exe

mswsock.dll
wininit.exe
services.exe

svchost.exe
tdx.sys
afd.sys
cdrom.sys
i8042prt.sys
netbt.sys
redbook.sys

mrxsmb.sys

/md5stop

HKEY_CURRENT_USER\Software\Classes\CLSID\{64135f0b-49a7-7b9c-302c-e16326399828} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64135f0b-49a7-7b9c-302c-e16326399828} /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs


Press the 

An OTL.txt will be created.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Hi again Quads i reply a little late because of our timezones im in EU. Thanks again for your help. I uninstalled Search and destroy and disabled Norton/Symantec. And ran OTL as instructed. Here is the file thanks in advance

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Hmm the above file looks funny try this one

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

You also have the services.exe variant of zeroaccess

Firstly we have take the first layer, the CLSID

Disable Norton for say 30 minutes

Start OTL,   under   Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom)  and run the script. (Red Run Fix Button)

The output log, should be placed in the C:\ _OTL folder after.

Quads

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Hi again did as instructed here is the outputfile

File Attachment: 
Kudos1

Re: Trojan.gen 2 80000000.@ removal help

You may find Symantec us now detecting the files in a different or now different files now that layer is broken, That is Ok

Please read carefully Read all of this message first

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix


  • Ensure that Combofix is saved directly to the Desktop <--- Very important

  • Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour.
  • Close any open browsers and any other programs you might have running

Doiwnload the attached CFscript.txt, , For some browsers Right Click the attachment on the forum and select "Save AS" or similar to Download it. See screenshot below.

Now  drag the CFScript.txt into the ComboFix.exe  


  • If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
  • When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

  • If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
  • If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
  • If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Did as instructed here is the combo fix notes. Computer is rebooted and no notifications recieved in the last 30min or so. It would seem that the threat has been removed. Your help is very much appreciated and i wish you the best.

Your Super Virus Trouncer title is vey appropriate:)

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Haven't finished 

I laugh when people have no idea when their PC is infected or not.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Oh then i am still awaiting instructions:D

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Use the same instructions for Combofix that I previously posted BUT instead use this new script I have attached to this post not the old one.

Quads

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Did as instructed here is the outputfile from combofix.

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

What I had combofix do was unlock regisrty keys and swap a good legit copy of services.exe  to overwrite the bad zeroaccess patched copy, You just can't delete services.exe in the drives folder as Windows requires it..  Zeroaccess should now be dead.

Now we will scan the PC of everything to see if there are any leftover files anywhere it uses up to date databases back at the servers before I do the final logs and script (hopefully) to clean up the programs used and leftover items.

Please read carefully and Slowly

 Please scan with ESET next 


I'd like us to scan your machine with ESET OnlineScan

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the  button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on  to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the  icon on your desktop.
  • Check 
  • Click the  button.
  • Accept any security warnings from your browser.
  • Under scan settings, check  and DON'T (NO) check Remove found threats (reason for this is we don't want something deleted and then Windows won't load).
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • Attach the resulting log in your next reply


If you think a log should have been generated then go to C:\Program Files\ESET\ESET Online Scanner\log.txt to find it. 

In the meantime maybe I can get some sleep while it is scanning.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Its back, it reappreded during scanning.

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

FYI i have a bunch of these files in quarentine in Norton/symantec

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

But norton / Symantec does not give me any notifications still only appeared on the online scanning.

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

That's OK it's in a different location and not running.

Now I need an up to date OTL log showing files folders and programs I have used for the clean up script

Disable Norton for say 30 minutes

Start OTL,  

Click the Scan All Users checkbox.

Change file age to 60 days


Press the 

No script this time

An OTL.txt will be created.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Sry for the late reply but its my work computer and i had the weekend off. Here is the log.

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

While I think about it.

If you go to this location C:\Qoobox\Quarantine\C\Windows\System32\drivers  do you see a file named services.exe.vir??

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Yes the file is there.

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Please zip the file the file  Right click and select Send To in the menu   from there it gives you the option to compress the file.

I will send you a private message, look out for the yellow envelope on the upper right hand side.

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Compressed and waiting

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Disable Norton for say 30 minutes

Start OTL,   under   Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom)  and run the script. (Red Run Fix Button)

The output log, should be placed in the C:\ _OTL folder after.

Quads

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Ran the scribt here is the log

File Attachment: 
Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Is your PC running smooth and happy??

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Its running very smooth. Is the problem solved?

Accepted Solution
Kudos3

Re: Trojan.gen 2 80000000.@ removal help

Disable Norton

Start OTL again but this time click the Black CleanUp button, then make sure the C:\_OTL folder is deleted.

After that you are free to go on your merry way.  You are now fixed / Solved.

If you want Malwarebytes download the Free version to install and don't click the Trial button

If you want to, you can turn off System Restore wait for it to clear the Restore Points and then Turn it back on

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Thank you very much Quads your help is greatly appreciated i wish you the best.

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

No Problem

Quads

Kudos0

Re: Trojan.gen 2 80000000.@ removal help

Moved to own thread for better exposure.

Replies are locked for this thread.