Norton 360

[mrdrummer]

I've been trying all day to remove this but it keeps coming back. Can anyone help with a solution please?

Thanks!

[Quads]

What have you done??

Quads

[mrdrummer]

Well I tried to use Malwarebytes and it didn't work. The same with Spyhunter 4 (same as Malwarebytes) and got the same results. This trojan just appeared from nowhere and I even tried to use Norton 360 to get rid of it. I also used Norton Power Eraser and it couldn't fix my problem. So I'm just stuck.

[Quads]

Please do not run any tools unless instructed to do so. 

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Major steps used:

1. Find

2. Break

3. Destroy

4. Cleanup  (including system as a whole)

Please read every post completely before doing anything. 

• Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
  
  
•  Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

 Uninstall Spyhunter 4.

What are the files and locations that Norton is detecting??

Please download SystemLook from one of the links below and save it to your Desktop.

 hxxp://jpshortstuff.247fixes.com/SystemLook.exe   change the xx to tt

Disable Norton for say 30 mins

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:  (don't forget the : in front of :filefind)

---

:filefind
*.@

services.exe

---

Click the Look button to start the scan.

When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Quads

Quads

[mrdrummer]

I have uninstalled SpyHunter 4. Here are the files and locations:

File: 80000000.@ (Trojan.Zeroaccess.B)
Location: c:\windows\installer\{a3744c56-b189-0078-f26d-594021270846}\u\80000000.@

File: 800000cb.@ (Trojan Horse)
Location: c:\windows\installer\{a3744c56-b189-0078-f26d-594021270846}\u\800000cb.@

And here is the SystemLook.txt

[Quads]

Please read carefully Read all of this message first

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix

• Ensure that Combofix is saved directly to the Desktop <--- Very important
  
  
• Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour or more.
• Close any open browsers and any other programs you might have running

Doiwnload the attached CFscript.txt, , For some browsers Right Click the attachment on the forum and select "Save AS" or similar to Download it. See screenshot below.

Now  drag the CFScript.txt into the ComboFix.exe  

• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

[mrdrummer]

Hey Quads, I've got a problem. When I did as you instructed me to, all I got was a ComboFix file and not a txt. Did I do something wrong? I downloaded the file you gave me and I dragged it to the ComboFix.exe on my desktop. It did it's thing and I didn't get a report.

[Quads]

Did it do a scan from 1 to 50, then say it was creating a log??

Quads

[mrdrummer]

I don't think so. Should I try it again?

[Quads]

better not until I figure out how far along it got.

Did it actually start up and open a Window that is Blue and then goes about creating a restore point and wans about the fact it could take more than 10mins

Quads