ZBOT OUT

[Hermie]

Hi guys, yesterday I did a scan with Malwarebytes Anti Malware which found spyware Zbot.out.
Three files I have put in guarantaine, and restarted the computer.
Then I did a start-up scan with Avast Free, nothing was detected.
This morning I deleted the MAM guarantianed files.
Is this enough, can I be sure that ZBOT OUT has been completely removed from my computer?
How to check to be sure?
 

[true indian]

were the 3 zbot files detected by avast! ??

[Hermie]

No, the three files were detected by Malwarebytes Anti Malware.
What to do next, plse advice, thanks. (to get rid of any trojan)

[bob3160]

@ Hermie,
I've alerted jeffce who is one of our resident malware removal specialists.
With a little patience on your part, he should be helping you soon.
Attaching the detection log from Malwarebytes would also be of help to jeffce

[polonus]

Hi Hermie,

If you were lucky, Spyware.Zbot.OUT was quarantined and deleted by MBAM. But we have to wait for a qualified removal expert to check your logs to see if this is indeed so,

polonus

[jeffce]

Please post the MBAM log and we can go from there. 

[Hermie]

I wanna say thanks to bob3160, polonus and jeffce for their replies.
I have deleted the files detected by MAM, so I'm unable to post the files.
Positive: files detected by MAM were located at:
C:\Toshiba\Drivers\HD-DVDPlayer\DirectX\tdxinstall.exe
C:\Toshiba\Drivers\HD-DVDPlayer\nVdia\tdxinstall.exe
C:\Toshiba\Drivers\HD-DVDPlayerATI\tdxinstall.exe
Rescanning with MAM and Avast Free start-up scan did not detect any virus/trojan. Hurrah? Who knows.

[Pondus]

When you open malwarebytes you find a log tab at the top
Find the log that show wat was detected an removed.....post that log

[Hermie]

Hi Pondus, here we go:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Databaseversie: v2012.08.05.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Herman :: PC_VAN_EVI [administrator]

5-8-2012 14:34:26
mbam-log-2012-08-05 (14-34-26).txt

Scantype: Volledige scan (C:\|E:\|G:\|)
Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM
Uitgeschakelde scanopties: P2P
Objecten gescand: 421983
Verstreken tijd: 1 uur/uren, 50 minuut/minuten, 53 seconde(n)

Geheugenprocessen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Registerdata gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0
(Geen kwaadaardige objecten gedetecteerd)

Bestanden gedetecteerd: 3 (THE THREE SETECTED FILES)C:\Toshiba\Drivers\HD-DVD Player\DirectX\tdxinstall.exe (Spyware.Zbot.OUT) -> Succesvol in quarantaine geplaatst en verwijderd.
C:\Toshiba\Drivers\HD-DVD Player ATI\DirectX\tdxinstall.exe (Spyware.Zbot.OUT) -> Succesvol in quarantaine geplaatst en verwijderd.
C:\Toshiba\Drivers\HD-DVD Player nVidia\DirectX\tdxinstall.exe (Spyware.Zbot.OUT) -> Succesvol in quarantaine geplaatst en verwijderd.

(einde)

[Pondus]

To me that looks like it may be false positive........
But no way of checking that when you have deleted the files from malwarebytes quarantine

Wait and see what jeff have to say...

[Hermie]

I'm now receiving spam like this one:

From: 杰 何 <hejie007200@yahoo.com.cn>
Message: hxxp://arab4x4.com/wp-content/themes/city/z6p39qkg.php
8/6/2012 7:23:12 AM

Chinese spam?

[polonus]

Hi Hernie,

Break that live link. Put in hxtp for http, please. IDS alert here: http://urlquery.net/report.php?id=116632
Malicious external elements: http://zulu.zscaler.com/submission/show/5741d26ade9a0561f49c76017683060f-1344278123
Script given, see: http://www.mywot.com/en/scorecard/greatworkinfo.com?utm_source=addon&utm_content=popup-donuts
spam site and spamming mail address specially created, see: http://www.mmm168.info/add/q442.txt

polonus

[Hermie]

Of course I don't respond to any email messages from unknown persons.
Now up to the Zbot issue, how to check I'm still effected, how to eventually remove the trojan?
Thanks in advance I shall be looking forward hearing from you guys.

[jeffce]

Hi,

Those look ok but lets send one to Virus Total.

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click  VirusTotal

Browse to the following and press Open  (one at a time if more than one file is listed)

C:\Toshiba\Drivers\HD-DVD Player ATI\DirectX\tdxinstall.exe


Click "Scan It", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.
----------

[Hermie]

Thanks jeffce for your reply.
Strange, I can't find the exe files found by MAM anymore under the path listed on my computer.
Therefore I'm unable to check files with virustotal.com.