topic Re: Trojan.ZeroAccess!kmem BIG PROBLEM in Norton Internet Security / Norton AntiVirus

Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 18:46:44 GMT

Hi,

i'm having problems with this virus, i read all the post realted to it, but couldn't remove it. I don't know too much about this, so it's dificult for me to understand all the posts.

I run the removal tool, it said that it removed the virus, but it didin't. I also run the Power Eraser, it removed some other files, including this trojan, but then , when running a scan, it detected on windows/system32 as a fil name NTOS. The action is LOG ONLY and the file is left unchanged, what can i do?

Sorry for my english.

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

SUBASH_PRABU — Wed, 14 Mar 2012 19:36:33 GMT

Welcome. And sorry for the trouble you're having. Please tell us what removal tool you ran "I run the removal tool, it said that it removed the virus"

What kind of scan you ran with Norton Power eraser: Is it without Rootkit or with Rootkit ?

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 20:00:34 GMT

I ran the removal tool that appears on symantec website for this virus, you can find it here http://www.symantec.com/security_response/writeup.jsp?docid=2011-121607-4952-99

This removal tool needs you tu desactivate system restauration.

My antivirus is called Symantec Endpoint Protection.

And the Power Eraser is set with Rootkit Scan, the one that requires system restart.

Thank You.

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 20:06:58 GMT

Start NPE, at the main window go to History . Look at the repair point and click Next, it will show what was removed.
You can click on the Link for each item to see the exact file path.

Do Not Run a scan or Undo .

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

SUBASH_PRABU — Wed, 14 Mar 2012 20:07:00 GMT

Sorry for the inconvenience. The Norton Community is for issues dealing with Norton Products offered by Symantec. And there is a separate community available for our Enterprise Products like Symantec Antivirus, Symantec Endpoint Protection,etc

People in our Symantec Community will surely help you out.

- Subash

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 20:10:00 GMT

Norton (Symantec) Tech Support are having troubles with these rootkits and trying to clean the computers, probably for one because they are stuck using Symantec products only.

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 20:19:30 GMT

Quads, what would you recommend me to do? When i want to see the history on the NPE it opens a window on IE and its full of codes, i don't understand. I want to get this virus removed, any ideas? Is it possible?

By the way, I enter to the other site for Symantec products but couldn't understand where to make my petittion.

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 20:25:15 GMT

Do you remember what files the NPE and Zeroaccess Removal Tool found??

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

JoelStevens — Wed, 14 Mar 2012 20:31:06 GMT

I spent several weeks getting this virus removed. Norton's techs could not do it. The second shop finally got rid of it, but I have also lost my battery meter and cannot get it restored.

I would recomend bitting the bullet and reformating your HD.

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 20:35:47 GMT

Do not reformat, do not take advive like that especially from people who couldn't work their own infection out, I have infected my system with all of these types of families (Pihar, zeroaccess, MaxSS.......................)

I am just trying to work out which one to use to get a log showing what has changes from using NPE and ZA removal tool.

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 20:56:59 GMT

1. Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.

Double click on OTL.exe to run it. Right click OTL.exe and select run as administator for Vista and Win 7.

Click the Scan All Users checkbox.

Change file age to 60 days
Click on Run Scan at the top left hand corner.

Post back the log OTL.txt (attach)

2. Download hxxp://download.bleepingcomputer.com/farbar/FSS.exe (change the hxxp to http) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

I will be back in a couple of hours. Careful there appears to be a Zeroaccess that on a 32 bit system infects 4 drivers.

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 22:39:10 GMT

I have WINWODS XP, is this OTL going to work anyway? Nothing to change?

Here are the files that the NPE discover:

801d12c0-5680.exe (Startup Item)

5689.sys (Driver)

fixzeroaccess (Directory) this is the one that keeps appearing

_ex-68.exe (Process)

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 22:53:36 GMT

Here are the files from OTL (OTL.TXT, EXTRAS.TXT) and FSS (FSS.TXT).

Did i have to press something else? i just made the scans y attach the txt's.

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 23:12:48 GMT

Please have NPE restore (reverse the items it took.

Then you will find I will Private Meesage you, look for the yellow envelope on the upper right hand side.

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 23:24:42 GMT

I aacidentaly open again the OTL and press repair, it said it needeed restart, but i didn't do it.

What you are saying is that i need to UNDO the files with NPE?

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 23:38:36 GMT

what you need to do is go into NPE and in the history Undo

801d12c0-5680.exe (Startup Item)

5689.sys (Driver)

_ex-68.exe (Process)

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 23:40:24 GMT

I keep the zeroaccess file without UNDO?

Any problems with my "accident" with the OTL?

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 23:42:32 GMT

OTL, probably not as there was no script to run.

Quads

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

shevo11 — Wed, 14 Mar 2012 23:47:44 GMT

I Undo all the files including the zeroaccess one?

Re: Trojan.ZeroAccess!kmem BIG PROBLEM

Quads — Wed, 14 Mar 2012 23:51:32 GMT

NPE can't get the folder anyway and it's still there so you don't have to worry about the folder

Quads