[ShawnGCS]

I have an infected computer that I pulled the hardrive out of then scanned with norton on another computer. Here are the quarantine results:

Date & Time,Risk,Activity,Status,Recommended Action,Path - Filename
2012-10-24 18:05:21,High,gnwplqbyizhghdxiyqwq.exe (Trojan.Gen.2) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:04:15,High,bsgwitiqjobiulva.exe (Trojan.Gen) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:02:50,High,"Risks in compressed file \"5b0baa7e-38f23dab\" detected by Virus scanner",Quarantined,Resolved
2012-10-24 18:02:45,High,vsk.exe (WS.Malware.2) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:02:28,High,fvjcrgr.exe (Packed.Generic.388) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:02:17,High,v.class (Trojan.Maljava) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:02:05,High,attw.exe (Downloader.Parshell) detected by Virus scanner,Quarantined,Resolved
2012-10-24 18:01:53,High,jar_cache5148952933477242148.tmp (Trojan.Maljava!gen23) detected by Virus scanner,Quarantined,Resolved
2012-10-24 17:24:40,High,80000000.@ (Trojan.Zeroaccess.B) detected by Virus scanner,Quarantined,Resolved
2012-10-24 17:24:26,High,000000cb.@ (Trojan.Zeroaccess.C) detected by Virus scanner,Quarantined,Resolved
2012-10-24 17:24:12,High,00000008.@ (Trojan.Gen) detected by Virus scanner,Quarantined,Resolved
2012-10-24 17:24:00,High,00000004.@ (Trojan.Gen.2) detected by Virus scanner,Quarantined,Resolved
2012-10-24 17:23:49,High,n (Trojan.Zeroaccess!g16) detected by Virus scanner,Quarantined,Resolved

After replacing the harddrive I booted into safe mode and tried to install MBAM & SAS but was instead asked what program to use to open this file. From reading some of the other posts it appears as though file associations have been changed. What steps can I take to correct the association problem?

Thank!

[Advertisements]

Hi and welcome to Geeks to Go...I have bad news I'm afraid.

One or more of the identified infections is a variant of the extremely severe Zero Access Rootkit plus undoubtedly other comprising malware!

OK since we are dealing with the aforementioned infection(s) I would be providing your good self with a disservice if I did not make you aware of the ramifications below:

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Although an attempt could be made to clean this machine, it could never be considered to be truly clean, secure, or trustworthy. We could not say definitively that unknown and unseen malware will have been removed, nor will your system be restored to its pre-infection state. We cannot remedy unknown changes the malware may likely have made in order to allow itself access, nor can we repair the damage it may possibly have caused to vital system files. Additionally, it is quite possible that changes made to the system by the malware may impact negatively on your computer during the removal process. In short, your system may never regain its former stability or its full functionality without a reformat. Therefore, your best and safest course of action is a reformat and reinstallation of the Windows Operating System, and that is the course I strongly recommend.

Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

Next:

I can attempt to clean this machine(anything I try may not be successful and the machine may loose internet connectivity) but I can't guarantee that it will be at all secure afterwords.

Should you have any questions, please feel free to ask.

Please let myself know what you have decided to do in your next post.

[Dakeyras]

Hi and welcome to Geeks to Go...I have bad news I'm afraid.

One or more of the identified infections is a variant of the extremely severe Zero Access Rootkit plus undoubtedly other comprising malware!

OK since we are dealing with the aforementioned infection(s) I would be providing your good self with a disservice if I did not make you aware of the ramifications below:

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Although an attempt could be made to clean this machine, it could never be considered to be truly clean, secure, or trustworthy. We could not say definitively that unknown and unseen malware will have been removed, nor will your system be restored to its pre-infection state. We cannot remedy unknown changes the malware may likely have made in order to allow itself access, nor can we repair the damage it may possibly have caused to vital system files. Additionally, it is quite possible that changes made to the system by the malware may impact negatively on your computer during the removal process. In short, your system may never regain its former stability or its full functionality without a reformat. Therefore, your best and safest course of action is a reformat and reinstallation of the Windows Operating System, and that is the course I strongly recommend.

Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

Next:

I can attempt to clean this machine(anything I try may not be successful and the machine may loose internet connectivity) but I can't guarantee that it will be at all secure afterwords.

Should you have any questions, please feel free to ask.

Please let myself know what you have decided to do in your next post.

[ShawnGCS]

Dakeyras,

Thank you for the reply! I was afraid of that. Let me talk to the owner of the computer and express your concerns to see how he would like to proceed. I'll reply back early this afternoon.

-ShawnGCS

[ShawnGCS]

Dakeyras,

I'll be taking your advice and reformatting & installing the operating system.

I appreciate your assistance!

-ShawnGCS

[Dakeyras]

Hi.

I'll be taking your advice and reformatting & installing the operating system.

Fair play.

I appreciate your assistance!

You're welcome, below is some generic advice for after the reformat and reinstallation of the Windows Operating System...

--------------

Install all critical updates and relevant service packs via Windows Update. For Vista the latest is SP2.

I would also ensure Internet Explorer is up-to date also. For Vista based machines it is IE9. Reason being even if you opt not to use IE as a main browser, having a out of date version installed can leave any one machine vulnerable to malware.

The aforementioned should be available via Windows Update, if not can be downloaded from here.

Once the machine is updated and fully patched, I do advise visiting Windows Update periodically as Microsoft releases patches for Windows and other products regularly.

Plus check Automatic Updates is enabled.

--------------

Then install a Anti-Virus software solution, only ever have one of such installed and active in system memory at any one time.

Either of the below will suffice:-

• Avast Home Edition.
• Microsoft Security Essentials.

Which ever of the above you choose to install, automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.

I advise running a complete scan with this at least once per week.

--------------

Installing a specific Anti-Spyware application would be prudent, myself I recommend:-

Malwarebyte's Anti-Malware

During the installation process you will be offered the Malwarebytes' Anti-Malware Trial. Your choice to enable or not...

After installing, I advise check for updates and run a scan at least once per week.

--------------

Emergency Recovery Utility NT. I advice you consider installing this, as a means to keep a complete backup of the registry and restore it when needed. Instructions can be read here.

Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!

--------------

A custom Host-File is a further layer of protection whilst browsing online.

Either of the below will suffice:-

• MVPS Hosts File
• hpHosts

Only use one of the above!

--------------

Consider installing WinPatrol. This application alerts you about possible system hijacks, malware attacks and critical changes made to your computer without your permission.

Download it from here.

You can find information about how WinPatrol works here.

--------------

Finally, periodically visit the Secunia Online Software Inspector to ensure all third party software is upto date. As many such as Adobe and Java related applications for example if out of date can be exploited by malware.

Or alternatively download/install and use FileHippo Update Checker...

[Dakeyras]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.