I have tried a full scan with Symantic antivirus as well as the downloadable rootkit tool from nortan, but I keep getting the same messages every time I restart. Any ideas?
I get a new set of messages about Trojan.Gen.2 and Hacktool.Rootkit around every 5 minutes. At the same time Malwarebites blocks something trying to access outside IP addresses.
ok, I stopped malewarebytes but I am still recieving the massages from symantec. Thank you for replying Quads. I just read a post that you helped another user with a similar issue. I'm afraid to try running the things you suggested though because of all the warnings.
I can't find it in any user account. I only have my own, Default and Public. I verified that hidden files and folders are visible. I tried typing it directly into explorers toolbar and it was not found.
Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.
Double click on OTL.exe to run it. Right click OTL.exe and select run as administator for Vista and Win 7.
Disable Norton for say 30 minutes
Start OTL, under Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom) and run the script. (Red Run Fix Button)
The output log, should be placed in the C:\ _OTL folder after.
Thank you for your reply. I have run OTL with the script. The output is attached. After my computer rebooted Symantic Endpoint Protection restarted and the messages popped up again. Should I disable SEP again? Should I disable it for 30 minutes before I run OTL?
I just noticed that the content of the messages has changed. Now there are two different ones:
Scan type: Auto-Protect Scan Event: Risk Found! Security risk detected: Trojan.Zeroaccess File: C:\Windows\assembly\GAC_32\Desktop.ini Location: C:\Windows\assembly\GAC_32 Computer: DAVID-PC User: SYSTEM Action taken: Pending Side Effects Analysis : Access denied Date found: Thursday, May 31, 2012 12:13:57 AM
and
Scan type: Auto-Protect Scan Event: Risk Found! Security risk detected: Trojan.Gen.2 File: C:\Windows\assembly\GAC_64\Desktop.ini Location: C:\Windows\assembly\GAC_64 Computer: DAVID-PC User: SYSTEM Action taken: Pending Side Effects Analysis : Access denied Date found: Thursday, May 31, 2012 12:13:57 AM
Does this new information change anything or should I still leave SEP off for 30 minutes and then run a clean up? Am I at risk of the trojan downloading other nasty things if I leave the protection off?
Thanks. Glad we're making progress . I ran the new script with SEP disabled. Upon reboot I got the same messages:
Scan type: Auto-Protect Scan Event: Risk Found! Security risk detected: Trojan.Gen.2 File: C:\Windows\assembly\GAC_64\Desktop.ini Location: C:\Windows\assembly\GAC_64 Computer: DAVID-PC User: SYSTEM Action taken: Pending Side Effects Analysis : Access denied Date found: Thursday, May 31, 2012 12:35:42 AM
and
Scan type: Auto-Protect Scan Event: Risk Found! Security risk detected: Trojan.Zeroaccess File: C:\Windows\assembly\GAC_32\Desktop.ini Location: C:\Windows\assembly\GAC_32 Computer: DAVID-PC User: SYSTEM Action taken: Pending Side Effects Analysis : Access denied Date found: Thursday, May 31, 2012 12:35:43 AM
There are two more that come up several seconds later that say the same thing, but the location is listed as "Unknown Storage." I only get these 4 messages when I boot up, they no longer recur every 5 minutes. I've attached the log file from the script.
It may now be because the threat listing are now stuck in the unresolved threats list, which I know how to fix with Norton Products, But not Symantec SEP (Corp) products.
ok, I used the cleanup button. I still got the 4 SEP popups when the computer restarted. There is no log to post this time. I guess the cleanup got rid of all the OTL leftovers? Is there a way for us to check whether the files came back again or if it is just stuck like you suggested?
I updated and ran malwarebytes without finding any threats. However, I still recieved the Auto-protect messages upon reboot so I ran the 2nd OLT script again. The log file again says that the two files were successfully moved. Does that mean that there's something that got missed that is creating those files every time I boot the computer? I really appreciate all your help on this.
Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom) and run the script. (Red Run Fix Button)
. I ran the new script with SEP disabled. Upon reboot I got the same messages: