borogorn Posted October 7, 2011 ID:483091 Share Posted October 7, 2011 Hi, I hope you can help me out. My computer has been infected with win32/Zbot , AVG seems to have removed a lot of these files but I suspect my computer is not totally clean. AVG detected the initial virus and blocked it, but somehow it still got in.It has removed over 100 Win32/Zbot.G viruses found in various locations. It also found Trojan horse Hider.MPR which it said has been deleted. This was found in AppData\Local\Temp\vwtpuiwg.sysIt also put an icon on my desktop, the icon was a quill and ink pot and names with random numbers and it wouldn't let me delete it at first. I disconnected from the internet and rebooted. Using windows defender I removed the start up programs that had been added, these were connected to this icon that had been added. I then manually searched through the local temp files and deleted at least 6 identical files that also had this quill and ink pot icon along with some strange text files that had been created on the day of the virus.I have run PC safe doctor and that is clear. I then found this forum posting with similar issues. Attached are the GMER and OTL logs. Malware bytes posted below. I am worried that ports have been opened etc and that security is compromised. If it is clear but the security is still questionable should I format the computer?Malwarebytes' Anti-Malware 1.51.2.1300www.malwarebytes.orgDatabase version: 7893Windows 6.0.6002 Service Pack 2Internet Explorer 8.0.6001.1912007/10/2011 12:56:00mbam-log-2011-10-07 (12-56-00).txtScan type: Quick scanObjects scanned: 241644Time elapsed: 5 minute(s), 24 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)RegardsBorogornark.zip Link to post Share on other sites More sharing options...
Staff screen317 Posted October 10, 2011 Staff ID:483806 Share Posted October 10, 2011 Hi and welcome to Malwarebytes. Please update MBAM, run a Quick Scan, and post its log. Next, download DDS by sUBs and save it to your Desktop. Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply. Link to post Share on other sites More sharing options...
borogorn Posted October 11, 2011 Author ID:484480 Share Posted October 11, 2011 Hi and welcome to Malwarebytes.Please update MBAM, run a Quick Scan, and post its log.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.Hi, Thank you for the reply. I panicked and re-installed Windows.Took ages setting it all back up again. When I finally got it up and running I scanned C: with AVG and it found a root kit in the windows.old file."C:\Windows.old\ProgramData\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log";"Hidden file";"Object is inaccessible."I forced AVG to delete this. Is there a chance that I could still have a problem? If so let me know what to do.Cheers Link to post Share on other sites More sharing options...
Staff screen317 Posted October 13, 2011 Staff ID:485435 Share Posted October 13, 2011 You didn't format your hard drive so your reinstallation of Windows didn't fix anything.See this:http://windows.microsoft.com/en-US/windows-vista/Installing-and-reinstalling-Windows-VistaEnsure that you format the hard drive before reinstalling Windows. Link to post Share on other sites More sharing options...
Staff screen317 Posted October 31, 2011 Staff ID:490500 Share Posted October 31, 2011 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff screen317 Posted November 5, 2011 Staff ID:492044 Share Posted November 5, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts