47 replies to this topic

[pinpouet]

Hello,

I've detected infection and try to remove it with different tools :

• Malwarebytes
  
• CCleaner
  
• Hijackthis
  
• SuperAntispyware
  
• SpyBot
  
• BitDefender Rescue cd
  
• Kaspersky Virus Removal Tool
  
• Kaspersky Resource Kit (boot cd)
  
• Windows Security Essentials

I've cleaned different type of infections :

• Trojan HorseCrypt.AQLW
  
• Trojan Dropper.Win32/Sirefef.B
  
• Trojan Download.Win32/Obdov.H

Since, my Windows Firewall and my local area connection won't work.

ComboFix alert me that I was infected by RootKit ZeroAccess.

In attach, the logs of dds and HiJackThis

Attached Files

•  Attach.txt   47.9K   19 downloads
•  DDS.txt   17.7K   20 downloads
•  hijackthis.log   9.83K   20 downloads

[Elise]

Hello and

Can you please post me also the combofix log? It can be found at c:\combofix.txt

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
  
• Please copy and paste the log to your reply.

[pinpouet]

Hi Elise,

Here are the logs as requested

Attached Files

•  ComboFix.txt   19.84K   23 downloads
•  FSS.txt   4.91K   25 downloads

[Elise]

Hello again, still quite some work to do here.

Please download http://download.blee.../RestoreBFE.exe
Double click on the downloaded file. It should only take a few seconds to run.
When complete, it will say .. "Done! Please check if BFE service is running now"

Please download and run this file (this will restore the other missing service): http://download.blee...es/7/MpsSvc.reg

OTL
-----
Please download OTL from one of the following mirrors:

• This is THE Mirror
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the NONE button.
  
• Copy and Paste the following code into the textbox.
  

  netsvcs

• Push
  
• A report will open. Copy and Paste that report in your next reply.

[pinpouet]

Damned ! I hate shit like that

Here is the follow up :

• RestoreBFE : Error! This tool does not apply to you
  
• MpsSvc : Keys & values successfully added to the registry
  
• OTL : see attached

Regards,

Attached Files

•  OTL.Txt   4.15K   21 downloads

[Elise]

Can you please rerun combofix (update if asked) and post me the new log?

[pinpouet]

I rerun combofix but nothing happens
Is it normal ?

[Elise]

What do you mean, it doesn't start at all? In that case, delete the copy and download a new one.

[pinpouet]

Bad news so ...

I've download a new copy of Combofix, same reaction !

I agree to the disclaimer, Combofix install itself and ... nothing.
No blue window of Combofix

[Elise]

Can you try to run it from safe mdoe?

[pinpouet]

Still the same

Maybe uninstalling combofix ? or just rename the folder C:\ComboFix ?

[Elise]

How are things running at this point? Please rerun DDS and post me the new log.

[pinpouet]

Well, I've found on internet a workaround for ComboFix.
I renamed ComboFix.exe in Combo_Fix.exe and that worked.

As resquested, I've rerun also DDS.

At this point, still not internet connection.

Attached Files

•  Combo_Fix.txt   18.3K   22 downloads
•  DDS.txt   18.32K   16 downloads
•  Attach.txt   56.02K   13 downloads

[Elise]

Hi again,

CF-SCRIPT
-------------
We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

MIA::
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\tdx.sys

Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[pinpouet]

are we on the good way ?

Attached Files

•  Combo_Fix.txt   18.54K   25 downloads

[Elise]

Unfortunately we need to replace two missing files. No copies seem present. Can you do the following and then rerun combofix and post me the new log?

Click Start > All Programs > Accessories, right click Command Prompt and select "run as administrator".

Type sfc /scannow and press enter. Let the system file checker run unhindered.

[pinpouet]

Windows Resource Protection couldn't perform the requested operation.
Same message at 25% of process, in normal mode and in safe mode.

[Elise]

Do you have another computer with Windows 7 32 bit on it that you could use to manually copy the files over?

[pinpouet]

Yes, I've !

[Elise]

Please navigate to the following files, right click them and select Copy. Then go to an usb drive, right click in an empty space and select Paste.
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\tdx.sys

Now on the problem computer, insert the usb drive, select the files and right click > Copy. Navigate to c:\windows\system32\drivers and right click in an empty space > click Paste.

After that rerun combofix and post me the new log.