ICE Cyber Crime Center Scam Virus

[drewilliam]

Hi,

 

My laptop has been infected with the ICE Cyber Crime Center virus.  It's Windows 7 64 bit operating system.  I attached my FRST64.txt file.  Help appreciated!

 

-DrewFRST64.txt

[MrCharlie]

OK, I'm looking at it now.....MrC

[MrCharlie]

Please read the following information first.
 

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan also.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Download the attached fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then.......

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.


New window that comes up.


~~~~~~~~~~~~~~~~~~~~~~~

Note: You Must Run This!!!!!!!!!!!!!!
If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
Internet access
Windows Update
Windows Firewall
If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe. <---------------------------

Verify that they are now functioning normally.


MrC

[drewilliam]

Fixlog.txt

[drewilliam]

I'm having trouble running mbar.exe on my infected computer.

 

I can't use the computer normally. The only way I could run files was by

 

-i downloaded and extracted the mbar folder on my unifected computer

-copied it to my usb flash drive/plug flash drive into infected computer

-tapped f8 on startup of the infected computer

-choose "repair your computer"

-logged in

-choose command prompt recovery tool

-and then typed the command g:\mbar/mbar.exe

 

it gave me the error message: "the subsystem needed to support the image type is not present."

 

this method worked for running the frst64.exe file earlier.

 

help? thanks

[MrCharlie]

Does the computer boot up to safe or normal mode??

MrC

[drewilliam]

No. When the computer is booted in normal mode it only displays the ICE banner with no may of getting out.  When I try to boot it in safe mode it restarts in normal mode

[MrCharlie]

Please run another scan with FRST and post the new log.....MrC

[drewilliam]

ok one sec

[drewilliam]

i ran the frst64.exe file and it gave me this frst.txt file.

 

thanks for your help.  i'm going to be busy for the next few hours, but I'll get back to you later tonight.

 

-DrewFRST.txt

[MrCharlie]

Try this fixlist.txt as you did before,   MrC

[drewilliam]

Fixlog.txt

[drewilliam]

want me to try the mbar now in the same fashion as i did before?

[MrCharlie]

MBAR has to be run in safe or normal mode, does the computer boot into either one??

MrC

[drewilliam]

oh. no. but I can try it again.

[MrCharlie]

OK...MrC

[drewilliam]

i got it to boot in safe mode command mode

[MrCharlie]

This will work if you have a good system restore point and can get to the Command prompt: (If it doesn't work the first time keep trying...you may be able get it)

Step 1: Use F8 to Boot to SafeMode With Command Prompt or Command Prompt

Step 2: Type the word "explorer" in black screen > enter

Step 3: Then Navigate to:

Win XP: C:\windows\system32\restore\rstrui.exe and press Enter

Win Vista/Seven: C:\windows\system32\rstrui.exe and press Enter (double click rstrui.exe)

Step 4: Restore Computer to Date you know you were virus free

Step 5: See if it boots up normally.....post on the forum so we can ensure the computers clean

MrC

[drewilliam]

Thanks! It worked.  Is there anything else I need to do to delete any virus files?

 

-Drew

[drewilliam]

I got an error message upon the restore that reads the following:

 

"System Restore did not complete successfully.  Your computer's system files and settings were not changed.

 

Details:

System Restore failed to extract the file (C:\Windows\inf\setupapi.dev.log) from the restore point.

The Restore point was damaged or was deleted during the resotre.

 

You can try System Restore again and choose a different restore point.  If you continue to see this error, you can try an advanced recovery method.  For more information see 'What is Recovery?' "

 

I restored the computer to how it was the day before the virus.  Should I be getting this error? Is it anything to be concerned about? Sorry, I don't really know what it means and whether it is important.

 

-Drew

[MrCharlie]

Does it boot normally?? MrC

[drewilliam]

yes. sorry. it does boot up normally

[MrCharlie]

Yes, lets run some scans......

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

[drewilliam]

I ran the mbar scan and had it clear all malware.  then i restarted it and tried it again and it found nothing.  I checked the internet access, windows update and windows firewall.  everything seems to be working normally

[drewilliam]

mbar-log-2013-08-24 (18-18-35).txtmbar-log-2013-08-24 (18-52-41).txtsystem-log.txt