"C:\Documents and Settings\All Users\Aplication Data\Isass.exe"C:\DOCIME~1\David\LOCALS~1\Temp\alg.dll.GOF1
I'm sorry... this computer is rather slow with the internet. Took me a bit to get the reply to load and your message about right clicking wasn't showing until after I posted. I did get the right click and replied as quickly as I could. Again... sorry for my confusion.
Beth
That is Ok, and the dead file is in the temp folder so It can stay there for now.
Now for the second suspected zeroaccess variant with filesystem
Normal Mode from now on
Due to the fact you had an ADS, which can mean another infection group or groups
Please read carefully and follow these steps.
Download TDSSKiller from http://support.kaspersky.com/faq/?qid=208280684 click on the TDSSkiller.exe green link.
Double click on TDSSKiller.exe to run the application,
Open the Change Parameters option and select the detect TDL File system
Click OK
Then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
Look for the Filesystem detection
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste into Notepad and attach back here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ ) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please attach the log in the post back.
Quads
Done and done.... found nothing... all clean so far.... file attached
I wonder what this is then.
[2012/07/30 19:21:56 | 000,000,000 | ---D | M] -- C:\WINDOWS\$NtUninstallKB1858$\786639265\L
[2012/07/30 19:21:56 | 000,000,000 | ---D | M] -- C:\WINDOWS\$NtUninstallKB1858$\786639265\U
Please read carefully Read all of this message first
Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix
- Ensure that Combofix is saved directly to the Desktop <--- Very important (not in the download or temp folders)
- Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour or more.
- Close any open browsers and any other programs you might have running
Right click the combofix.exe on the desktop and select from the menu "Run as Administrator" If required.
- If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
- When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review
****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****
Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.
*EXTRA NOTES*
- If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
- If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
- If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)
Quads
Hi.... question... am on my pc because I didn't want to risk messing up the combofix running on my husbands pc
I downloaded and ran conbofix - before running tried to open Norton 360 so I could disable but it wouldn't open, maybe because I installed it under his account and not the admin? - any way closed everything and ran file. Got the recovery pop-up and said yes. Then it wanted to know if I was running XP HOME ED. click yes... since it's not - it's XP Pro I clicked no. It ran and found something then popped up trying to do something with Norton and failed.... then it opened a new window "Window XP Home Edition SP 2 CD Boot Floppies " a user agreement and wants a yes to continue
Do I accept even tho he has XP Pro on his machine?
Thanks
Beth
Don't accept and close Combofix don't run it any further.
I know Norton has problems and will probably have to be removed and fresh installed at the end.
I will see if I can script to get the folder manually.
Quads
Okay... will stop the program and wait for your instructions :) Thanks... wanted to make sure before I clicked anything questionable.
Beth
Start OTL, under 
Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom) and run the script. (Red Run Fix Button)
The output log, should be placed in the C:\ _OTL folder after.
Quads
done... file attached
hope that was the file you wanted... it was the one which opened after running.
looking in the _OTL folder I saw file too so am attaching it as well.
if they are not what you are looking for let me know.
beth
Ok, all we have to do is check for the likes of PUP's, do complete system scans and clean up. Oh and sort out Norton, which may be why the net speen seems slow, if the Firewall (Norton) is playing up
The bigger log is for the first script, the small one is for the script just run.
Quads
Ok... just let me know what and when :) Thanks again... you've been very patient with me and this old, slow machine
downloaded tools run from the desktop location etc.
Download Adwcleaner http://general-changelog-team.fr/fr/downloads/view.download/2 The Green Arrow and run a scan (Search). It will create a log after.
Quads
Done.
Download the Norton Removal Tool
Uninstall Norton, then use the Removal Tool
Even the service is not found
SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe /s N360 /m C:\Program Files\Norton 360\Engine\6.4.0.9\diMaster.dll /prefetch:1 -- (N360)
Quads
Good Morning :)
Ran the Removal Tool and rebooted. After booting IE opened a window on a page for reinstalling Norton.... I take it that I reinstall now.... or is there something else to do first?
Beth
No we wll do the Step 4 parts first, just be careful what sites you go to, you are unprotected at the moment
step 4. (a)
Please read carefully and Slowly
You might have to export the results
Please scan with ESET next
I'd like us to scan your machine with ESET OnlineScan
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the
button. - For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on
to download the ESET Smart Installer. Save it to your desktop. - Double click on the
icon on your desktop.
- Click on
- Check
- Click the
button. - Accept any security warnings from your browser.
- Under scan settings, check
and DON'T (NO) check Remove found threats (reason for this is we don't want something deleted and then Windows won't load). - Click Advanced settings and select the following:
- Scan potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- Attach the resulting log in your next reply
If you think a log should have been generated then go to C:\Program Files\ESET\ESET Online Scanner\log.txt to find it.
Quads
Okay.... here is the log from the ESET scan... it did find several things.
That was fast, your internet speed must be back, or it's the fact a damaged Norton is removed.
Step 4 (b)
Please create a new OTL. txt ( log) like early on, same 60 days all users settings please.
Quads