Trojan.0access Removal help

[Ellter]

Hi there,

I ran a full scan yesterday for the first time in a while and the scan came up with one threat: Trojan.0Access which was found in the recycling bin, fast scans did not pick up on this. The scan picked up nothing else and seemed to successfully quarantine it. I have run two full scans after this and they have come back clean. It is very possible that the issue has been resolved and I am therefore wasting someone's time however I wanted to check and see if there was anything else I should do before I go one using my laptop normally.  I have downloaded and run FRST. I am including the logs from that as well as the Addition.txt. I will also included the three scans threat logs just in case they are needed.

The file that reads 'initial scan' was the first scan that picked up the Trojan  then the other two are the scans I have run since. I don't know if these are needed or if they are even the right file.

Other than that I have not notice any slow down or issues with my laptop. Everything has been running normally. 

I appercate any advice that can be offer on action I should take and thanks in advance.

 

Regards,

 

Elliot

 

FRST.txt

Addition.txt

1 scan after.txt

2nd scan.txt

Intital scan.txt

[AdvancedSetup]

Hello @Ellter and

Looks like it was probably just a minor left over entry from a previous infection at one time. Please run the following cleanup routine which will clean a few other minor items including temporary files.

I would also recommend if possible to not use Java. Please uninstall your current version. If you really have to have Java then make sure you keep it up to date at all times.  https://java.com

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Thanks, Ron

 

[Ellter]

Hi there @AdvancedSetup

Thanks for you reply and for helping me on this

I have run the fix and attached the fix log.

I have a question in regards to the previous infection, while I have defiantly had a virus on this machine before I can't remember every have a torjan can I assume that it would have then been downloaded then? Also would you know why it was not picked  up earlier? These are more for my own curiosity than anything else.

Also sorry if I should not have 'At' replied you then

Thanks again,

Regards,

Ellter

Fixlog.txt

[AdvancedSetup]

Hi @Ellter

The 0access was a rootkit from a few years back. It does not mean necessarily that you've downloaded anything new. It could just be that our Researchers have found more file, folder, or registry entries that are or were part of that infection and it was added for general clean up. Please read the following to hopefully grasp in more detail

The complexity of finding, preventing, and cleanup from malware

Are your scans from Malwarebytes and AdwCleaner coming back clean now?
 

[Ellter]

@AdvancedSetup 

So my understanding is that it had been there fore a while and a recent update to Malware bytes enabled it to detect it. If that is the case I dread to think how long it has been there. 

I have run a full scan a few times and they have come back clean. I ran adwcleaner, for the first time( I did not have it), it picked up a few threats mostly PUPs and one threat(adware.Pokki). I cleaned my system and when I scanned again it came up clean. I have attached the log of the first scan just in case. 

Thanks again for you help.

 

Regards,

 

Ellter

AdwCleaner[C00] scan 1.txt

[AdvancedSetup]

No real dread involved. It's sort of like you drop a piece of bread on the floor. You pick it up and wipe up the crumbs. Then a month later you're doing a full floor sweep and mop and find that there is a very small piece of bread there up against the under cabinet wall you missed when you picked the bread up last month. The main piece and other smaller crumbs were picked up and cleaned up already. That little piece of leftover crumb caused no problems or issues.  The same here. Having an element left over does not mean it's a live active infection.

Let me have you go ahead and run the following scans in the order provided and we'll see if there is anything else left over to remove.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Ellter]

Hi @AdvancedSetup

Sorry this took so long I went away for a few days and did not have access to my laptop. I see so, I feel I am making a big deal out of nothing. 

I ran the scans in the order you asked and I have uploaded them under this. I renamed them to distinguished them from other files. 

Thanks again for you help.

Ellter

Addition 2nd.txt

FRST 2nd.txt

First scan.txt

AdwCleaner scan 1.txt

[AdvancedSetup]

The logs look good.

How is the computer running now?

Are there still any signs of an infection?

Quite late for me so I'm heading out, but will check back on you again this weekend

Ron

 

[Ellter]

The computer is running fine. It seems to be running the same as normal. I didn't really notice any drops in performance, that were not out of the ordinary. I don't think there are any signs of an infection. All scans are coming back positive.

Cheers for all the help.

 

Ellter

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks