Trojan.Gen.2 and Trojan.Gen (Trojan.Zeroaccess)

These keep popping up constantly with Norton blocking them all the time.

 

 

Trojan.Gen

Source
00000008.@

 

File: c:\windows\installer\{8b9e6df5-de14-a0c4-4a33-cebc5ca22e1b}\u\00000008.@
File Thumbprint:


e473a10cee73de92042e2ed8e2c12f0bb2b923a44a583e96a37fa9c4d2cfc21c

 

 

Trojan.Gen.2

Source
000000cb.@

File: c:\windows\installer\{8b9e6df5-de14-a0c4-4a33-cebc5ca22e1b}\u\000000cb.@

File Thumbprint:
4b88042123ad7b319c5d1bbd291a42259007477a1aedfb79a65224b5587e403f

 

 

 

Trojan.Gen.2
Source
00000004.@

File: c:\windows\installer\{8b9e6df5-de14-a0c4-4a33-cebc5ca22e1b}\u\00000004.@

File Thumbprint:
e82a4fcac5871adf5516a2e3de312ef135537a51edc3f2e379b68c6ae90961dd

 

___________________________

I looked through my history and it looks like Trojan.Zeroaccess is responsible.

 

It appeared on my computer as the same time as when "You allowed Adobe Flash Player Installer/Uninstaller 11.0 r1 to access your network resources." Did the zeroaccess get through that way?

 

According to Norton, "This virus[Trojan.Zeroaccess] has been removed. Further action is no longer needed."

''''''
Source
50054293.exe

(Trojan.Zeroaccess!gen7)

File Actions
File: c:\users\lala\appdata\local\temp\50054293.exe
Removed

File Thumbprint:
Not Available

'''''

But Trojan.Gen.2 and Trojan.Gen keep reappearing anyway. What do I do to get rid of them?

 

 

ANY other user other than the thread starter is not to use any instructions, scripts or proceedures,  The work though in cleaning a system is individual and only for that system due to a number of factors.

 


 

Please do not run any tools unless instructed to do so. 

  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask nothing extra or run things twice
  • If I ask a Question just answer it, don't run anything unless it states.
  • Major steps used:

1. Find

2. Break

3. Destroy

4. Cleanup  (including system as a whole)

 

Please read every post completely before doing anything. 

  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

 

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes :smileylol:)

  • Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

 

 

What is your operating system  and include whether 32 bit or 64 bit??

 

Quads

Windows Vista - Home Premium Edition (32 bit)

Do you have a Flash Drive??

 

Quads

yes

Read Slowly and all of it.

 

Please download http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/   You need to download the 32bit version.


Transfer it on to the Flash Drive.

Enter System Recovery Options

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.


On the System Recovery Options menu you will get the following options:

 

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt


  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive.  restart the system and load Windows Please copy and paste it to your reply.

 

Quads

oh wow *punches self* I should have just uploaded the file instead of copy pasting the whole thing. sorry about that

Download the script attached, needs to be the same file name as well (fixlist.txt), Copy across to flash drive

 

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options again. Like previously

  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst.exe or frst64.exe and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press the Fix button just once and wait.
  • The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

 

Quads

Did Windows boot up OK after??

 

Quads

Yeah, should I look out for something?

Step 3.

 

 

Please read carefully Read all of this message first

 

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix


  • Ensure that Combofix is saved directly to the Desktop <--- Very important  (not in the download or temp folders)

  • Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour or more.
  • Close any open browsers and any other programs you might have running

 

Right click the combofix.exe on the desktop and select from the menu "Run as Administrator"  If required.

 

  • If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
  • When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

  • If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
  • If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
  • If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

Disable all security programs? Isn't Norton keeping the trojans at bay? By the way, the Trojan.Gens haven't popped up, but the Trojan.Zeroaccess was auto-blocked.

Follow the instructions it states why to do so.  or you can just keep the rest of the infection(on your system).

 

Notice I said way back 


  • Major steps used:

1. Find

2. Break

3. Destroy

4. Cleanup  (including system as a whole)


 

I would say you have no idea what is going on with your system, what is left and what I have done so far to just  give a question like your last post.

 

Quads

Well **bleep**, "Adobe Flash Updater" kept annoyingly popping up all the time, asking to run, even when I closed it each time. So I stupidly clicked ok and now I got Trojan.Zeroaccess.B -> 80000000.@, 00000004.@ (Trojan.Gen.2), 000000cb.@ (Trojan.Gen.2). We'll probably have to start all over again, and I'm really sorry for causing you this much trouble. I've been too lax about this and I'll try to get over with quickly this time.

There is no point complaining you have not carried on with my instructions,   Now  you are back at step one and needing a new FRST log as we previously had done.

 

All logs and scripts are null amd void.  This is what happens when all the steps are not done for this

 

Quads

Delete the copy of fixlist you have on your desktop and download and use the fixlist attached to this message.

 

As before transfer it to the flash drive and then restart the PC loading FRST and click fix etc.

 

Quads

Step 3.  I have underlined why to disable all running security products.

 

 

Please read carefully Read all of this message first

 

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix


  • Ensure that Combofix is saved directly to the Desktop <--- Very important  (Not in the Download(s) or Temp folders)

  • Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour or more.
  • Close any open browsers and any other programs you might have running

 

Right click the combofix.exe on the desktop and select from the menu "Run as Administrator"

 

  • If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
  • When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

  • If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
  • If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
  • If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

Ok,  as I knew from your two FRST logs and also Combofix log, you have a patched / infected services.exe file,  We will have to manually find the backup copies of services.exe on your system and script for combofix to replace the bad copy with a good copy

 

First,  Norton may still detect the files you had detected when you came to the forum, that is OK, because if all is going well the location would have changed for the detections,  as Combofix and FRST have their own Quarantine folders which I clean up at the end as part of step 4.  (See my first post)

 

Now 

Please download SystemLook from one of the links below and save it to your Desktop.

 

 hxxp://jpshortstuff.247fixes.com/SystemLook.exe   change the xx to tt

 

Disable Norton for say 30 mins

 

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:  (don't forget the : in front of :filefind)



:filefind

\n

\@
*.@

services.exe


 

 

Click the Look button to start the scan.

When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Quads

You don't follow though with instructions you just disappear until Norton or Something states an infection again.

 

Quads

Moved to own thread for better exposure.