Hello Daniweb,
I would be very grateful if someone could have a look at these scans and recommend a course of action to clean my computer of this virus. I have followed the instructions in the sticky to produce the following logs.
The symptoms I am experiencing are that iexplorer.exe starts running mysteriously despite me never using the application. Sometimes multiple instances are running and when I terminate them they reappear. It is making the system unstable not to mention the recurring trojan flag from comodo firewall.
These symptoms are still apparent after running the recommended scans as well as running a full Avast AV scan.
Here are my logs and I hope someone can help me out.
BTW I am running Win XP.
Thanks
MalwareBytes Log
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.15.10
Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.6001.18702
Sabre2th :: SUFFICIENT [administrator]
16/07/2012 18:30:57
mbam-log-2012-07-16 (18-30-57).txt
Scan type: Full scan (D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 317832
Time elapsed: 42 minute(s), 38 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Quarantined and deleted successfully.
Registry Values Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Data: D:\Documents and Settings\Sabre2th\Local Settings\Application Data{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\n. -> Quarantined and deleted successfully.
Registry Data Items Detected: 1
HKCR\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32| (Trojan.Zaccess) -> Bad: (\.\globalroot\systemroot\Installer{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\n.) Good: (wbemess.dll) -> Quarantined and repaired successfully.
Folders Detected: 0
(No malicious items detected)
Files Detected: 6
D:\System Volume Information_restore{84B6AE5E-DC92-41E0-A1AE-874CDD045680}\RP346\A0091760.ini (Trojan.0access) -> Quarantined and deleted successfully.
D:\System Volume Information_restore{84B6AE5E-DC92-41E0-A1AE-874CDD045680}\RP346\A0091799.ini (Trojan.0access) -> Quarantined and deleted successfully.
D:\WINDOWS\Installer{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\U\00000004.@ (Rootkit.0Access) -> Quarantined and deleted successfully.
D:\WINDOWS\Installer{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.
D:\WINDOWS\Installer{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\U\000000cb.@ (Rootkit.0Access) -> Quarantined and deleted successfully.
D:\WINDOWS\Installer{156cc7ff-8a28-25e2-b67c-d02b1d0250a9}\U\80000000.@ (Trojan.Sirefef) -> Quarantined and deleted successfully.
(end)
Gmer1
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-07-16 16:14:17
Windows 5.1.2600 Service Pack 3
Running: 7dghdmy5.exe; Driver: D:\DOCUME~1\Sabre2th\LOCALS~1\Temp\pwtcapob.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
---- EOF - GMER 1.0.15 ----
Gmer2
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-16 18:26:22
Windows 5.1.2600 Service Pack 3
Running: 7dghdmy5.exe; Driver: D:\DOCUME~1\Sabre2th\LOCALS~1\Temp\pwtcapob.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
---- Processes - GMER 1.0.15 ----
Library c:\windows\system32\n (*** hidden *** ) @ D:\windows\Explorer.EXE [1276] 0x013D0000
Library c:\windows\system32\n (*** hidden *** ) @ D:\windows\system32\svchost.exe [1352] 0x014C0000
---- EOF - GMER 1.0.15 ----