00000004.@, 80000064.@, and more

[oldempire]

Hi. I just got a handful of pop-up warnings from avast regarding these threats. From what I've read on this forum and others I seem to have been infected byt a particularly nasty trojan. Can you help me? I really need me computer up and running, am working on a deadline and can't really afford to not use it. Thanks in advance

[Pondus]

seems you may have a ZeroAccess rootkit

follow this guide and attach (not copy and paste) the requested logs   http://forum.avast.com/index.php?topic=53253.0

1. AdwCleaner
2. Malwarebytes
3. OTL
4. aswMBR

when done the removal experts will be notified. It may take hours before they arrive so be patient

[oldempire]

I think I did everything correctly. That guide told to attach the logs to my first post, and the last one (aswmbr) to my reply, don't know if I read that wrong of if it matters, but I did it just the same. The logs for AdwCleaner, Malwarebytes and OTL are attached to my first post, the aswMBR log is attached to this one. Hope everything's alright, I'll wait for now.

[Pondus]

That guide told to attach the logs to my first post, and the last one (aswmbr) to my reply

that would mean if you did see the guide and did this before my reply   

anyway it does not matter what post they are attached to as long as you attach so we can see them   

malware removers are notified.... should be here as soon as they have had there after dinner nap   

[oldempire]

Ok, thansk a lot.

[essexboy]

Could you let me know of any problems on completion of this run

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[oldempire]

I did what you told me. Had some problems with avast, though. It's my only antivirus/anti-spyware, and I deactivated it permanently (there are temporary options), but after the automatic restart made by by the combofix it gave an error, saying that avast was still active. There was no icon in the taskbar, so I opened the task manager and there was indeed an avast process running. I forced it to stop and continued with combofix, but it alerted me that it was still running. At this point I just didn't know what else to do, so despite understanding that there was a risk, I continued with combofix anyway. It did its thing and now the computer seems to be running fine, I've been working for over an hour and there has been no alert from avast so far (before it gave me warnings every 5 minutes or so).

The log is attached to this post.

[essexboy]

That looks good now, any further problems ?

[oldempire]

No, everything's great so far. I'll post again in case anything happens, but I'm crossing my fingers hoping it stays this way. Thank you guys so much for all your help, you are the best.

[Pondus]

he is not done yet..... he will remove the programs used first   

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  
• In the Run box, type in ComboFix /Uninstall
   (Notice the space between the "x" and "/")
  then click OK
  
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

Clear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
When it pops up at the first prompt select OK after it has done some calculations the tabs will appear
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button



: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?Keep safe  :wave:

[oldempire]

Hi. Just wanted to report that I did as you told and my pc's been running fine ever since. Once again, thank you so much for all your help. Cheers 

[essexboy]

My pleasure .. Keep safe