Infected with zero access/abnow if I uninstall

If I uninstall a program - I get a virus blocked message from Panda Cloud. Comsrv.dll. Did a MBAM scan, it picked up a couple of files in the GAC (something like tmp\U in the path). Rebooted afterwards and bang - I then get the %hs file missing blue screen.

I have a recent windows image backup - so restored, after a restore MBAM doesn't pickup anything, but if I uninstall (a different program this time). Panda pops up again, and if I check the registry I find an entry pointing to comsrv (if I change back to winsrv the system can re-boot).

Have restored from back up again now, so don't seem to be "actively" infected at present - no re-directs, MBAM says all OK. But I know as soon as I try to remove a program it will come back (have disabled windows update in case that triggers it).

Anyway DDS logs attached as requested (these are after restore when the machine seems fine, MBAM reports nothing and no redirect are going on)

GMER says no system modification found - so no logs to attach - although all the first options from system to libraries were greyed out?

Ran ComboFix (yes against the guidelines above, but have used before on friends machines)- logs attached - it removed the following.

c:\users\Steve\AppData\Local\546faaa4\U
c:\users\Steve\AppData\Local\546faaa4\U\80000000.@
c:\users\Steve\AppData\Local\546faaa4\U\800000cb.@
c:\users\Steve\AppData\Local\546faaa4\U\800000cf.@
c:\users\Steve\AppData\Local\assembly\tmp
c:\users\Steve\sox.exe

Top 4 match the file MBAM found in the GAC after, trying to uninstall a program.

Anything else I should do before going back to uninstall the things I was going to when this started?

Steve

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

• Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.
  
  
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  
  
• Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks

I'm here!

As above Combofix seems to have done the trick - been checking with process monitor and netmon every now and again and can't see any unusual activity and uninstalls now work without Panda picking anything up. Is there anything else I should check>

Feeling a bit of a fraud asking for help now - used to be able to disinfect Xp machines at the drop of hat, but never had cause to do so on Win 7 (and never my own machine) so was a bit puzzled when I couldn't track it down.

There's still the possibility that the termsrv.dll file may be infected. ZeroAccess likes to do this and its been picked up by Combofix as unsigned

Please run the file through Jotti for me

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Go to Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

c:\windows\system32\termsrv.dll

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at VirusTotal

termsrv.dll reported as clean - I suspect the unsigned warning is related to the fact that that this is the termsrv.dll from Win 7 Ultimate, on Home Premium - a hack to get Remote Desktop working on Home Premium (date on the file matches when I did this as well).

Okay, that would be it then. In that case I agree with your diagnosis that you are clean.

This topic will be closed in five days.

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.