BleepingComputer.com: Zero Access Worm/Trojan also Crypt

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
←
1
2

You cannot start a new topic
This topic is locked

Zero Access Worm/Trojan also Crypt Cant get rid of it

#16 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,549
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 07 February 2012 - 01:19 PM

Hello

Perform a system restore to before we started that fix

gringo

I will be online from 5-31 to 6-4 in a very limited amount

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->

<-- Don't worry every little bit helps.

#17 andernamen

New Member

Group: Members
Posts: 13
Joined: 13-January 12

Posted 08 February 2012 - 03:39 PM

Okay, did that.

#18 andernamen

New Member

Group: Members
Posts: 13
Joined: 13-January 12

Posted 09 February 2012 - 05:18 PM

FSS log looks the same, though. I noticed that Symantec on my laptop alerted on the Combofix.exe on my USB and deleted it. It said it was infected with Trojan.ANVH or something like that. What options do I have now?

#19 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,549
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 09 February 2012 - 09:21 PM

Hello

I want you to redo the steps in post 14 now

gringo

<-- Don't worry every little bit helps.

#20 andernamen

New Member

Group: Members
Posts: 13
Joined: 13-January 12

Posted 10 February 2012 - 10:43 AM

Okay, did EXACTLY as per the steps. When I get to the part where I am re-installing the TCP/IP protocol and click on "Have Disk", enter c:\windows\inf and enter, I get the same error message that I got before. At the top of the error missage in the blue part it says "Network Connections" Below this is a red x and the words "Could not add the requested component. The error is: an extended error has occurred."

#21 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,549
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 14 February 2012 - 06:48 PM

Hello

Sorry for the delay in responding, they have had me very busy at work lately but I have come back a few times to go over the the thread and I don't know what we could do different at this time, I think the fastest and surest thing to do at this time is to backup everything and do a reinstall of the OS

gringo

<-- Don't worry every little bit helps.

#22 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,549
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 17 February 2012 - 12:28 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.