Zonebac! infection, please help

By johnp2007
Oct 19, 2007
  1. View attachment 23787

    View attachment 23788

    View attachment 23789

    View attachment awf.txt

    View attachment 23791 \

    My Microsoft OneCare virus scan keeps finding Win32/Zonebac! infections and quaranteening them but then another one shows up the next time I start up. I have gone through th preliminary removal instructions. Nothing showed up on my Combofix scan but the log is attached anyway, no rootkits were found by Panda. I am attaching my HJK log file, two AVG files (one before and one after I deleted the found problems) and also a FindAWF scan which shows a number of bak files. What should I do to get rid of this guy.
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system is infected with a trojan called Downloader.Agent.awf. It replaces legitimate files that are common on most computers with an infected file. Then, it moves the legitimate files to a bak or backup folder.

    Right click on this link DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

    Double-click FindAWF.exe to start the tool. Then, do the following
    Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
    A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

    Close the .txt file and click Yes to save the changes.
    When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

    Regards Howard :wave: :wave:

    This thread is for the use of johnp2007 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...