Solved Help with Zbot infection.

[Layback Bear]

Things are just crazy.
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f9fd5091a87fc94d999526271970b004
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-11-04 06:24:33
# local_time=2012-11-04 01:24:33 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 45884179 103595407 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=134259
# found=0
# cleaned=0
# scan_time=1515

 

[Jacee]

CanIHaz that is very good research and I thank you very much for time and concern you have. A few minutes ago I got CIMV2-0X800041003, WMI 10. They all might be caused by the same thing. I will investagate on the MAM site. Thanks again.

See this ... Here's how to Fix WMI Event ID 10, "InstanceModificationEven - MSFN Forum

 

[Jacee]

This is weird!

 

[Layback Bear]

I have already cleared the event log. It was caused by a Marvell driver MV91xx. I have to think on doing a registry edit from 2008.
I think what I'm going to do is reinstall Zbot from MAM quarantine and then run Eset scan again. It might put System Files back as they should be.

 

[Layback Bear]

Okay a little update.
Put back Zbot from MAM quarantine.
Ran Eset online and came up clean.
Updated MAM and ran complete scan, clean.
Cleared event log again.
Used Windows Update and got and installed MSE update.
Ran sfc /scannow 3 times with reboots between each.
Ran Repair disc 3 times with reboots.
Checked sfc /scannow again, still has files that need corrected ever time I ran it.
---------------------------
I don't think I'm infected.
Updating MAM stopped the false positive Zbot.
Windows 7 is just unable to give a clean bill of health using sfc /scannow.
I'm out of ideas and need some more help. I haven't discovered anything that doesn't work as it should except SFC /SCANNOW. so far.
-----------------
I don't have passwords installed on this computer except auto sign in for this site. All my banking excreta are in my pea brain or my Rolodex.
Thanks for worrying.

 

[Jacee]

Just before you found these two ZBots, did you uninstall something or install a game/open a PDFfile or?

 

[Dwarf]

Given how devious and prolific malware writers have become, anti-malware vendors (MSE, Avast!, MBAM, etc.) have had to step up their game as well to keep up with the bad guys. Unfortunately, this does mean that once in a while something slips through the net and is not picked up or something legitimate is picked up and wrongly identified as malware. There have been cases where some AV updates have been pulled by the vendor after being notified by several users that something was wrong.

 

[Layback Bear]

Yes I was on this site when I got Zbot. I ticked on the now removed hyper link that was posted.
http://www.sevenforums.com/general-discussion/261898-what-weight-iso-windows-7-a.html
---------------------
You are correct Dwarf. Malwarebytes corrected the problem the same day with a update.
Now all I have to do clean up the mess it left behind.

 

[NoelDP]

There's one consistent file error in the CBS.log

2012-11-01 20:48:12, Info                  CSI    000002ed [SR] Cannot repair member file [l:20{10}]"_isdel.exe" of Microsoft-Windows-InstallShield-WOW64-Main, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2012-11-01 20:48:12, Info                  CSI    000002ee [SR] Cannot repair member file [l:20{10}]"_isdel.exe" of Microsoft-Windows-InstallShield-WOW64-Main, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing

- which is a single file, where both file itself, and the WinSxS backup are corrupted.


I'll work up a fix for you.

 

[Layback Bear]

Thank you Noel. I seen that but I'm quiet sure I don't want to fool with WinSxS without help. I can give you more logs if need be. Thank you all for coming to my rescue.

 

[NoelDP]

I've put up a file on my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21485
- layback.zip
Please download it to your desktop and extract it to C:\laybackzip

reboot to the Repair Environment
open a Command Prompt
run DIR until you find the laybackzip folder (DIR C:\ , DIR D:\ , )
run the following command....



XCOPY <drive>:\laybackzip <drive>:\Windows\winsxs /y /s /h /i

reboot to Normal Mode
run SFC /SCANNOW
post the new CBS.log file

 

[Jacee]

Reading a topic at the MBam forums ... this is indeed a false positive detection.
According to miekiemoes,

You can restore the file from quarantine. It's fine if only the one from C:\Windows\System32\InstallShield\ is restored.

Update MBam, the problem should be fixed with new definitions.

 

[ganjiry]

a bit of info for others
malwarebytes also flagged this on my pc 2 days ago, i had'nt seen this thread then though. malwarebytes removed it and ive since ran scans with nod32/ eset online scanner and trend micro's house call which have all come back clean. as soon as mbam had removed it i purged all restore points and ran tfc by old timer. passwords changed and everything else i could think of.
while looking to for info on zbot i found this info on it How to remove Zeus (Zbot) – Zeus (Zbot) Removal | Malware Help. Org


Variant 1

C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
Variant 2

C:\WINDOWS\system32\oembios.exe
C:\WINDOWS\system32\sysproc64\sysproc86.sys
C:\WINDOWS\system32\sysproc64\sysproc32.sys
Variant 3

C:\WINDOWS\system32\twext.exe
C:\WINDOWS\system32\twain_32\local.ds
C:\WINDOWS\system32\twain_32\user.ds
Variant 4

C:\WINDOWS\system32\sdra64.exe
C:\WINDOWS\system32\lowsec\local.ds
C:\WINDOWS\system32\lowsec\user.ds

ive checked n found none of them and all scans are still coming up clean. aparantly it is designed to steal only banking details. american banks.
hope it helps if peeps come across this and its not a false positive

 

[Jacee]

Scroll down to #14 post by sUBs here Trojan.zbot FP? - Malwarebytes Forum if anyone has trouble restoring these files from MBam's quaranteen.

 

[Layback Bear]

I've put up a file on my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F!485
- layback.zip
Please download it to your desktop and extract it to C:\laybackzip

reboot to the Repair Environment
open a Command Prompt
run DIR until you find the laybackzip folder (DIR C:\ , DIR D:\ , )
run the following command....



XCOPY <drive>:\laybackzip <drive>:\Windows\winsxs /y /s /h /i

reboot to Normal Mode
run SFC /SCANNOW
post the new CBS.log file

----------------------
Noel it is not working. What I'm I doing wrong.
1. Download your file and unzipped to C:\laybackzip
2Rebooted F2>F8>Repair your computer>Jack>CMD Prompt.
2. Typed in DIR and was unable to find laybackzip. Nothing for the year 2012.
Note: There/their is only 1 drive/partition (C)
3. Typed in C:\DIR and still didn't get anything (laybackzip)

 

[Layback Bear]

Scroll down to #14 post by sUBs here Trojan.zbot FP? - Malwarebytes Forum if anyone has trouble restoring these files from MBam's quaranteen.

Thank you for the finding that. I did that this afternoon but I downloaded it again and ran it. Now I will do another sfc.
-------------------------
View attachment 239962

 

[NoelDP]

----------------------
Noel it is not working. What I'm I doing wrong.
1. Download your file and unzipped to C:\laybackzip
2Rebooted F2>F8>Repair your computer>Jack>CMD Prompt.
2. Typed in DIR and was unable to find laybackzip. Nothing for the year 2012.
Note: There/their is only 1 drive/partition (C)
3. Typed in C:\DIR and still didn't get anything (laybackzip)

You'll probably find that it's in D:\ - the Repair environment enumerates also the System Reserved partition, which is usually allocated the C: drive if it exists.

Note - the command is
DIR C:\
or
DIR D:\

 

[Layback Bear]

My mistake typing in the last post.
I did type in DIR C:\ and couldn't find it but I didn't type in DIR D:\ because I don't have a D drive.
This time I use the DIR D:\ and found laybackzip folder.
Is this the exact i should type. A space before every (/)

XCOPY D:\laybackzip D:\Windows\winsxs /y /s /h /i

 

[NoelDP]

That's it .

 

[Layback Bear]

On the second sfc /scannow. Doing a third now.
Third one is great also. Noel that worked thank you.
I don't understand coping something from D to D when I don't have a D worked.
Thanks to everybody for their/there help and the time you all spent.


Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\System32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\System32>