topic Re: infected with trojan.zeroaccess!inf in Norton 360

infected with trojan.zeroaccess!inf

jsold406 — Sat, 31 Mar 2012 18:59:16 GMT

I started having problems and I could not open any programs so I started my computer in safe mode and ran a scan. It had 3 errors all the same trojan.zeroaccess!inf which it said I had to remove myself. I did some research and I found the Fix Zeroaccess tool from Norton. When i ran that I recieved the error message "Pre-Boot operation failed, unable to continue. Error=1084"

Ideas anyone?

I am running windows xp sp2

AMD athlon 64 processor 3200+ 2.21GHz

2GB of ram

Thanks

Re: infected with trojan.zeroaccess!inf

K_Ramachandran — Sat, 31 Mar 2012 22:57:36 GMT

Hi Jsold406,

-----------------------------------------------------------------------------------------------------------

When i ran that I recieved the error message "Pre-Boot operation failed, unable to continue. Error=1084"

-----------------------------------------------------------------------------------------------------------

As to your problem, You have infected with a critical OS file, but in your case you can manully just delete the Infected file by go through the file path given for the infected file in the Norton Security Risk (making sure to double check you have the correct file) and delete from the Recycle Bin. You may have to disable Norton Auto-Protect to allow you to do this.

Then you will have to go into the Norton Security History--> Unresolved Threats list and click the "Clear Entries" button.

To findout the path for the infected file, please go through this link - as it will helps you to run a stand alone Norton Power Eraser Tool and will help you to find out.

http://community.norton.com/t5/Tech-Outpost/TDSSkiller-TDL4/m-p/467396/message-uid/467396/highlight/true#U467396

Re: infected with trojan.zeroaccess!inf

jsold406 — Sun, 01 Apr 2012 18:23:10 GMT

I ran the power eraser and deleted the file as you instructed. Now i restarted and i still recieve the same error=1084

the file that the power eraser wanted me to delete was

c;\windows\system32\drivers\redbook.sys

also once deleted the file and restarted. the computer had some error that it fixed itself.

Also i cannot do much when i start the computer normally so all of the things i am doing is through safe mode

Re: infected with trojan.zeroaccess!inf

cgoldman — Sun, 01 Apr 2012 20:48:00 GMT

I am concerned at the instructions already advised to you. Redbook is an essential file. It may be infected. Removing it is only advised if you have an uninfected replacement and know how to obtain and copy same over.

Re: infected with trojan.zeroaccess!inf

jsold406 — Sun, 01 Apr 2012 22:03:02 GMT

ok so what do you suggest i do?

Re: infected with trojan.zeroaccess!inf

Quads — Sun, 01 Apr 2012 23:35:08 GMT

Did the removal tool actually remove redbook.sys??

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Mon, 02 Apr 2012 00:03:26 GMT

no the removal tool only said that it was a problem and should be deleted but it would have to be deleted manually

Re: infected with trojan.zeroaccess!inf

Quads — Mon, 02 Apr 2012 00:15:05 GMT

Please read carefully and follow these steps.

Download TDSSKiller hxxp://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop. (replace the hxxp with http)
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please attach the log in the post back

Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Mon, 02 Apr 2012 01:07:56 GMT

the TDSSKiller did not find any errors and had not option for a report

Re: infected with trojan.zeroaccess!inf

Quads — Mon, 02 Apr 2012 01:27:08 GMT

We have a problem you are running XP SP2 you should be SP3 for Norton and other programs

download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix

Ensure that Combofix is saved directly to the Desktop <--- Very important

Before saving Combofix to the Desktop re-name to Gotcha.exe as below:
Disable all security programs as they will have a negative effect on Combofix,
Close any open browsers and any other programs you might have running
Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Wed, 04 Apr 2012 00:54:40 GMT

here is the output

Re: infected with trojan.zeroaccess!inf

Quads — Wed, 04 Apr 2012 01:42:11 GMT

you may have a corrupt netsvcs but you also have a missing driver

1. Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.

Double click on OTL.exe to run it. Right click OTL.exe and select run as administator for Vista and Win 7.

Click the Scan All Users checkbox.

Change file age to 60 days

under Copy and paste what is below between the lines

drivers32

netsvcs
"%WinDir%\$NtUninstallKB*$." /30
%SYSTEMDRIVE%\*.exe
/md5start
volsnap.sys
atapi.sys
explorer.exe
winlogon.exe
wininit.exe
intelppm.sys

redbook.sys
tdx.sys
afd.sys
/md5stop

Press the

Quads

Post back the log OTL.txt (attach)

2. Download hxxp://download.bleepingcomputer.com/farbar/FSS.exe (change the hxxp to http) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

With all thouse files I might have to find a free upload site so I can get the zipped quarantine.

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Wed, 04 Apr 2012 02:42:13 GMT

here are the outputs

Re: infected with trojan.zeroaccess!inf

Quads — Wed, 04 Apr 2012 12:53:51 GMT

You have 2 drivers missing not one, that I will have to figure is the best way to place them back.

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Thu, 05 Apr 2012 00:25:21 GMT

alright keep me posted

Re: infected with trojan.zeroaccess!inf

Quads — Thu, 05 Apr 2012 02:01:59 GMT

Can you get a copy of redbook.sys out of the archive C:WINDOWS\ServicePackFiles\i386\sp3.cab redbook.sys

And the same for :intelppm.sys C:\WINDOWS\ServicePackFiles\i386\sp3.cab intelppm.sys

and place the copies in the C:\Windows\System32\drivers\ folder

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Fri, 06 Apr 2012 01:01:19 GMT

alright i got both files copied into that folder. now what?

Re: infected with trojan.zeroaccess!inf

Quads — Fri, 06 Apr 2012 01:13:22 GMT

Do the same as from these few messages on this thread http://community.norton.com/t5/Norton-Internet-Security-Norton/GOOGLE-REDIRECTS-TO-http-abnow-com/m-p/686159/highlight/true#M199243

Download Netsvcs reg fix etc. to correct the data.

Quads

Re: infected with trojan.zeroaccess!inf

jsold406 — Fri, 06 Apr 2012 01:43:15 GMT

ok i downloaded the file and ran the registry fix. do i have to do the combofix thing too?

Re: infected with trojan.zeroaccess!inf

Quads — Fri, 06 Apr 2012 01:48:51 GMT

OK, Restart your PC, then with the same instructions do this, post, http://community.norton.com/t5/Norton-360/infected-with-trojan-zeroaccess-inf/m-p/692387/highlight/true#M69575

If all with the drivers comes back correct then we can start to look at a full system scan and cleanup script.

Quads