Zonebac.b Infection

[dr.popcorn99]

I have the zonebac.b trojan horse showing up with my Windows Defender scans. Searching the internet for this virus brought me to TechSpot OpenBoards (here!), and I'm hoping for your kind assistance.

From reading other posts here on the same topic, I came to realize that you all would be requesting the info from the 15 Steps How-to thread, so I started the process and got as far as Step 10. When I went to use Tool1 for the second iteration, which is recommended to be done in Safe Mode via F8, my computer went into a start-up loop and never could get into Safe Mode. I cut the power, waited 10 minutes, then was able to reboot to my regular XP SP2 start-up (BTW, I am the only user, therefore I am operating in administrator mode by default). Then down in Step 13 in the first link I read the caution about NOT using Sys Config Utility to get to Safe Mode if F8 was causing trouble.

So my question now is, what should I do to complete the 15 steps? I know that one or two others of them will require the Safe Mode.

Thanks in advance for your help with this confounding infection!


------ dr.popcorn99

 

[howard_hopkinso]

Hello and welcome to Techspot.

Since you can`t get into safe mode, follow the instructions from normal mode.

Regards Howard :wave: :wave:

This thread is for the use of dr.popcorn99 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dr.popcorn99]

Hello again!

I completed the 15 Steps and have attached the 3 log files. The Panda rootkit analysis showed NO rootkit problems.

What's next?



--------- dr.popcorn99

 

[howard_hopkinso]

Your system is infected with a trojan called Downloader.Agent.awf. It replaces legitimate files that are common on most computers with an infected file. Then, it moves the legitimate files to a bak or backup folder.

Please go HERE and follow the instructions exactly. The instructions are specific to that infection only.

Regards Howard

This thread is for the use of dr.popcorn99 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dr.popcorn99]

awf following Zonebac.b problem

Hello Again!

Thanks to Howard's help my problem was identified as Downloader.Agent.awf and I implemented the fix that was suggested. However, the FindAWF.exe program did not completely clean up all the bak files -- there still seem to be 2 of them remaining.

Attached are the new FindAWF Option 1 file and the new HJT file.

Thanks in advance for helping me out with this. It feels like we are (you are, actually) getting really close to fixing my infection.


--------- dr.popcorn99

 

[howard_hopkinso]

I don`t know why you posted in a new thread, but I have merged it into this one.

We need to remove those files manually.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

raid_tool.exe

Close task manager.

Locate and delete the following bold files and/or folders(if there).

C:\Program Files\HP\hpcoretech\data\EvntData-2016045435.xml
C:\Program Files\HP\hpcoretech\bak
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\VIA\RAID\bak

Reboot into normal mode and rehide your protected OS files.

Post a fresh awf.txt after running option1 of the FindAWF tool.

Regards Howard

This thread is for the use of dr.popcorn99 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dr.popcorn99]

Once again, hello!

I followed your steps:

a. raid_tool.exe was NOT shown on the Processes list in Task Manager, so nothing was done there.

b. I located and deleted the 4 files/folders you listed.

I also un-hid (before these steps) and re-hid (after these steps) my protected OS files

Here is the new awf file from running option 1 -- it appears that the troublesome bak files are gone.

Does this mean the infection is fixed (hope so!)?



Millions of thanks for your patient assistance.......




-------- dr.popcorn99

 

[howard_hopkinso]

Your awf.txt is now clean and your main infection is now gone.

However, we still have some things to do in order to make sure your system is clean.

Please do the following exactly.

Right click on this link DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

Go HERE, download and install the latest version of Java.

Once it`s installed, go to add remove programmes in your control panel and uninstall all previous versions of Java, except version 6 update 3. Close Control panel.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

PowerReg Scheduler.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - Global Startup: PowerReg Scheduler.exe

O15 - Trusted Zone: *.doginhispen.com

O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/SCJohnson/Coupons.c ab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

PowerReg Scheduler.exe<Search your system for this files and delete all instances found.

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log and let me know if you`re still having problems.

Regards Howard

This thread is for the use of dr.popcorn99 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dr.popcorn99]

Greetings once again!

I followed your most recently posted instructions:

a) PowerReg Scheduler.exe did NOT appear on the Task Manager Processes list, so nothing was done there.

b) The HJT scan showed NO items for O15. The O4 and O16 items were check-marked and fixed.

c) PowerReg Scheduler.exe did NOT appear in any folder on any of my drives. What DID appear was:

i) "PowerReg Scheduler.exe-33C79B20.pf" originally from c:\windows\prefetch, and
ii) "backup-20071025-232439-946-PowerReg Scheduler.exe" originally from c:\program files\HJT\backups

For completeness sake, these were both deleted.

The protected OS files were re-hidden afterwards, and a fresh HJT log was run and attached.

Since I haven't been doing anything else with this computer for the last 9 hours but deal with this infection, I'm not aware of any new problems. If I run into any, I will respond again on this thread.

Billions of thanks!


-------- dr.popcorn99

 

[howard_hopkinso]

Your HJT log is clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of dr.popcorn99 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dr.popcorn99]

Howard:

I turned off and then turned on System Restore, and checked to verify that all previous restore points were deleted.

I take it that your efforts have been successful and are now concluded. Without a doubt, your help has been amazing --- thanks jillions!



-------- dr.popcorn99

This thread is now closed: If you need this thread unlocking, please pm a moderator with a link to the thread.

Only the original thread starter can do this. Anyone else, will be ignored.