Norton Internet Security / Norton AntiVirus

[Baf1]

I have recently found that my computer is infected with the Trojan.Zeroaccess!inf threat.  I have tried using Nortons FixZeroaccess tool, Nortons Power Eraser, and Nortons Bootable recovery tool. Neither have been able to remove this threat.  Any Ideas??

Thank you

[Quads]

What is the location and file name of what Norton has detected in the History  details??

Quads

[Baf1]

The last scan from the Bootable recovery tool found them in:

c:\windows\system32\gt891lx.dll

c:\windows\system32\z800mdfl.dll

[Quads]

OK what operating system including whether 32 bit (x86) or 64 bit (x64)??

Quads

[Baf1]

its a gateway computer using windows vista and a Intel Core 2 processor.  32 bit

is that what you are requesting??

[Quads]

Please do not run any tools unless instructed to do so. 

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please read every post completely before doing anything. 

• Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
  
  
•  Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!

Please read carefully

Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back, Don't have the program fix anything.

Quads

[Baf1]

here is the log from the scan.

[Quads]

 Read all of this message first

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix

• Ensure that Combofix is saved directly to the Desktop <--- Very important
  
  
• Disable all security programs as they will have a negative effect on Combofix,
• Close any open browsers and any other programs you might have running before running Combofix 

Doiwnload the attached CFscript.txt, , For some browsers Right Click the attachment on the forum and select "Save AS" or similar to Download it. See screenshot below.

Now  drag the CFScript.txt into the ComboFix.exe  

• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

[Baf1]

How do i disable my security programs.  I know Norton is my main software but i also believe i have Webroot for my firewall and i believe windows security runs as well. I am not sure the proper way to disable them so that combofix will work properly.

[Quads]

The firewall is not so bad.

For Norton open Norton and you will see sliders to turn on and off Antivirus, AntiSpyware and Sonar,  when you turn them off it will popup asking for how long, with a drop down menu that gives you options for how long.

Choose say 5 hours,   NOT  until restart as Combofix may restart the PC and Norton would kick in while Combofix is running.

Quads