Win32:ZAccess-PB trojan horses

[destineeraej]

I keep getting continuous notifications of the trojan horse mentioned in the subject bar. Each time I turn on my computer the alerts start up about 20 minutes into usage, I receive up to 50 notifications of the same trojan horse in different files, and then the alerts stop. I'm not really sure how to handle this because avast can't delete them. Each time I run a scan and try to delete the viruses, I get alerts saying the files are only accessible by password.

[Pondus]

follow guide and attach logs, not copy and paste.    http://forum.avast.com/index.php?topic=53253.0

run in order listed
AdwCleaner / Malwarebytes / OTL / aswMBR

when done a removal expert will be notified

[destineeraej]

I've attached all four logs!

[Pondus]

your AdwCleaner log say search.... to remove the crap files listed, run ans click delete

malware removers are notified, check back later...

[argus]

Hi,

Remove Norton Antivirus this tool
https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us?product=home&version=1





Re-run OTL.exe.

• Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
  
  

Code: [Select]


:Files
C:\Users\Rae\Desktop\Recovered Files\Users\Rae\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}
C:\Users\Rae\Desktop\Recovered Files\Windows\Installer\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}
C:\Windows\assembly\Desktop.ini

:Commands
[emptytemp]
[CREATERESTOREPOINT]




• Then click the Run Fix button at the top.
  
• Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

.





> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

• Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  
• In the window that opens on the top right corner, click Settings.
  
• In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
  
  
• Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.

[destineeraej]

I've attached the logs for OTL and ComboFix.

[destineeraej]

Just a heads up, I'm still getting notifications for trojan horses.

[argus]

Open notepad and copy/paste the text present inside the code box below:

Code: [Select]


File::
c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMNETS.SYS
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\Ironx64.SYS
c:\programdata\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\IPSDefs\20130712.011\IDSvia64.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\ccSetx64.sys
c:\programdata\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\BASHDefs\20130620.011\BHDrvx64.sys
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMDS64.SYS
c:\windows\system32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMEFA64.SYS
c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\SyDvCtrl64.sys


Folder::
c:\program files (x86)\Symantec\Symantec Endpoint Protection

Driver::
EraserUtilRebootDrv
SepMasterService
SYMNETS
SymIRON
IDSVia64
ccSettings_{3771A34D-2132-48EA-A486-D62ECDF9D553}
BHDrvx64
SymEFA
SymDS
SyDvCtrl

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]



Save this as CFScript.txt



Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

.






Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Under Optional Scan ensure "List BCD" and "Driver MD5" are ticked.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

[destineeraej]

I know the previous instructions asked me to copy and paste the FRST log into this reply, but the log exceeds the allowed number of characters, so I just attached it as well.

[destineeraej]

Here's the FRST log.

[argus]

The infection is gone but there are two antivirus,  Notron and Avast.

[argus]

Uninstall Avast through the Programs and Features and then run the Avast Uninstall tool from Safe Mode
http://www.avast.com/uninstall-utility

Next:

 Install and uninstall Norton IS and then run Uninstall tool
https://support.norton.com/sp/en/us/home/current/solutions/kb20080828154508EN_EndUserProfile_en_us?product=home&version=1

Next:


Download DDS and save it to your Desktop from here:
http://download.bleepingcomputer.com/sUBs/dds.scr

Double click dds to run the tool.

    * When done, DDS will open two (2) logs:
        1. DDS.txt
        2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

[destineeraej]

I went ahead and uninstalled the avast software, but I don't actually have Norton on my computer. I have Symantec Endpoint Protection, and I'm aware that Symantec makes Norton, but will the Norton Uninstall Tool work for Symantec Endpoint as well?

[argus]

I have Symantec Endpoint Protection, and I'm aware that Symantec makes Norton, but will the Norton Uninstall Tool work for Symantec Endpoint as well?

I think it will remove.

[destineeraej]

Everything I've tried to remove Symantec Endpoint has failed. I've tried the software you provided, traditional software uninstall procedures, and even a 3rd party software remover. Do you have any ideas of what I should do at this point?