07-14-2012 06:36 PM
Dell Studio 540S, Vista SP2 32 bit. New (paid) user to Norton 360.
Fake Flash installer was first symptom, followed by popups and browser redirects.
Ran Malware Bytes, which detected ZeroAccess.B, but removal ineffective and infection detected repeatedly. Norton 360 cannot remove it entirely, but it blocks it /most/ of the time. One variant does not respond to deletion by Norton AV. Norton manual removal tool does not remove. Norton PowerEraser does not remove.
Fake flash installer runs every few minutes, followed by a flurry of Norton detections, mostly blocked, but not all. One variant of ZeroAccess.B remains. Norton now detects Trojan.Gen and Trojan.Gen.2
Does anyone have insight into removing these stubborn variants? It seems like the team is hard at work!
07-14-2012 09:43 PM - edited 07-14-2012 09:45 PM
ANY other user other than the thread starter is not to use any instructions, scripts or proceedures, The work though in cleaning a system is individual and only for that system due to a number of factors.
Please do not run any tools unless instructed to do so.
4. Cleanup (including system as a whole)
Please read every post completely before doing anything.
Read Slowly and all of it.
Please download http://www.bleepingcomputer.com/download/farbar-re
Transfer it on to the Flash Drive
Enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
On the System Recovery Options menu you will get the following options:
Windows Complete PC Restore
Windows Memory Diagnostic Tool
07-14-2012 11:49 PM
Many hours ago. I believe it found evidence of a rootkit, and I took its recommendation. A suspicious pair of files appeared in \windows around the time of the infection FlashPlayerApp.exe and FlashPlayerCPLApp.cpl. I manually moved these into a safe folder.
SFC found integrity problems with services.exe and restored. At this point I committed to N360. N360 found one "@" file it identified as a Trojan.Gen and suggested single file delete as probably fix. Then I found your forum. Had I seen your forum first, I would have stopped there immed. of course and done nothing further.
In the last 2.5 hours, N360 has blocked only one thing, an attempt by SVCHOST to set a registry security key: