Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Norton initially reported Tidserv Activity 2 it now reports ZeroAccess


  • Please log in to reply

#16
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
Hello Ron,

Just got to the computer and noticed a notification from Norton that Trojan.Zeroaccess!kmem Risk Level 1: Very Low has infected my system and that manual removal is required.

Regarding the video driver, the computer is an older model, Dell Dimension 2400.

I'll begin checking for damages...
  • 0

Advertisements


#17
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
System Log

Vino's Event Viewer v01c run on Windows XP in English
Report run at 17/02/2012 9:31:41 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 17/02/2012 7:53:53 PM
Type: error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: OMCI

Log: 'System' Date/Time: 17/02/2012 7:53:45 PM
Type: error Category: 0
Event: 7023 Source: Service Control Manager
The Adpu320 service terminated with the following error: The specified module could not be found.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  • 0

#18
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
Application Log

Vino's Event Viewer v01c run on Windows XP in English
Report run at 17/02/2012 9:35:21 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I had to disable Norton when downloading the Event Viewer Tool. It kept deleting it.
  • 0

#19
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,598 posts
  • MVP
Norton is probably seeing the ZA files down in C:\qoobox. If we remove Combofix it should erase the files at the same time.

To uninstall combofix, copy the next line:

"%userprofile%\Desktop\combofix.exe" /Uninstall

Start, All Programs, Accessories then Command Prompt.
then right click, Paste, then hit Enter.

You seem to be missing an Adaptec driver and some sort of remote control software.

Right click on My Computer and select Manage then Device Manager. View, Show hidden devices. Find the yellow marked devices, right click on them and uninstall. Reboot. Go back into Device Manager. Are they still yellow?
  • 0

#20
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
Command prompt returned "not recognized as an internal or external command, operable program or batch file"
  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,598 posts
  • MVP
Try:

"\documents and settings\Owner\Desktop\ComboFix.exe" /uninstall

or simply

combofix /uninstall

If that doesn't work then just delete the folder C:\qoobox
  • 0

#22
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts

You seem to be missing an Adaptec driver and some sort of remote control software.

Right click on My Computer and select Manage then Device Manager. View, Show hidden devices. Find the yellow marked devices, right click on them and uninstall. Reboot. Go back into Device Manager. Are they still yellow?


Not sure what the remote control driver is but I uninstalled the display adapter and it installed itself on reboot. The resolution is back to normal now. Thank you.

Going to uninstall combofix...

Edited by Jfenz, 17 February 2012 - 09:17 PM.

  • 0

#23
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
When trying to delete the folder Qoobox I get an error stating "Cannot delete BackEnv:Access is denied."
  • 0

#24
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,598 posts
  • MVP
See if you can delete the Quarantine stuff in C:\Qoobox
  • 0

#25
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
I was able to delete the "quarantined" folder and everything else except for the "BackEnv" folder.
  • 0

Advertisements


#26
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,598 posts
  • MVP
Don't worry about the BackEnv stuff. The ZeroAccess that Norton is detecting should be gone now.
  • 0

#27
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
Sounds good. I ran a scan and nothing came up.

So what's next? Did the event viewer logs look OK? They didn't seem to have much content.
  • 0

#28
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,598 posts
  • MVP
Events were good except for the two items I mentioned and they don't sound like anything important. If it's running OK now I think we can cleanup:

We need to clean up System Restore.

Copy the following:


:Commands
[CLEARALLRESTOREPOINTS]
[Reboot]

Run OTL. In the Custom Scans/Fixes box at the bottom, paste in the copied text (Ctrl + v) and then hit Run Fix.

You can uninstall or delete any tools we had you download and their logs.
To uninstall combofix, copy the next line:

"%userprofile%\Desktop\combofix.exe" /Uninstall

Start, Run, cmd, OK then right click, Paste, then hit Enter.

OTL has a cleanup tab so if you run it again and select cleanup it will remove itself and its backup files.

To hide hidden files again (If you do not run OTL cleanup):

XP

# Close all programs so that you are at your desktop.
# Double-click on the My Computer icon.
# Select the Tools menu and click Folder Options.
# After the new window appears select the View tab.
# Uncheck the checkbox labeled Display the contents of system folders.
# Under the Hidden files and folders section select the 'Hide protected operating system files (recommended)' option.
# Check the checkbox labeled Hide protected operating system files.
# Press the Apply button and then the OK button and exit My Computer.

Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.

Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program. There is an exploit out there now that can use it to get on your PC. For Adobe Reader: Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript. OK Close program. It's the same for Foxit reader except you uncheck Enable Javascript Actions.

To help keep your programs up-to-date you should download and run the UpdateChecker:
http://www.filehippo.../updatechecker/
(You don't need to download Betas and if there is a program you don't use you can just uninstall it rather than update it. You can right click on the updatechecker icon (looks like a downward green arrowhead) and select Settings and tell it no betas. If you don't use MSN Messenger I would not upgdate it. MS installs a bunch of stuff when you do. You can tell the program to not show you that update.)
If you use Firefox or Chome then get the AdBlock Plus Add-on. WOT (Web of Trust) is another you might want to try.
The equivalent to AdBlock Plus for IE is called Simple Adblock and you should install it too: Adhttp://simple-adblock.com/

If Firefox is slow loading make sure it only has the current Java add-on. Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox . Click on Speedup my Firefox. When it finishes click on Exit.

Be warned: If you use Limewire, utorrent or any of the other P2P programs you will almost certain be coming back to the Malware Removal forum. If you must use P2P then submit any files you get to http://virustotal.com before you open them.

If you have a router, log on to it today and change the default password! If using a Wireless router you really should be using encryption on the link. Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business. See http://www.king5.com...-120637284.html and http://www.seattlepi...ted-1344185.php for why encryption is important. If you don't know how, visit the router maker's website. They all have detailed step by step instructions or a wizard you can download.

Ron
  • 0

#29
Jfenz

Jfenz

    Member

  • Topic Starter
  • Member
  • PipPip
  • 22 posts
Thank you so much for your help, Ron. It's awesome that your website is here for those of us who don't have the expertise that you guys do. I really appreciate it.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP