No thumbnails appearing... Might be infected with Trojan.Zbot. Help!

[Zalison]

So a few days ago I started getting notifications from my norton AV saying it blocked an attempted attack by 'Trojan.Zbot'. Not too long after that I started to notice windows explorer acting very strange.

No thumbnails would appear for pictures..

No previews...

Couldn't empty recycling bin by right clicking it anymore

And also it would take longer than usual to load sometimes.

The weirdest thing is SOME thumbnails do show while 99% of them do not. You can see what I mean in the picture I attached.

Please help! I have no idea how to get rid of this Trojan.Zbot thing or if it's even the only culprit.

 

[indianacarnie]

Run a full system scan with your A/V. Then run a full scan with Malwarebytes and/or Superantispyware. With admitedly little research it seems this infection may change some registry entries and those can be hard to "fix", so I would suggest a repair install after finishing those scans. Heres a link to a tutorial on how to do that if you haven't before : http://www.sevenforums.com/tutorials/3413-repair-install.html

Hope this helps.

 

[Jacee]

Please read about Trojan.Zbot here: Zeus (Trojan horse - Wikipedia, the free encyclopedia)

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.

Since you are using Symantec, see if their removal tool works... Trojan.Zbot Removal Tool | Symantec

 

[Layback Bear]

Nice to see you back Jacee, beating up one the bad guys again.
I miss not reading your post.

 

[Zalison]

Please read about Trojan.Zbot here: Zeus (Trojan horse - Wikipedia, the free encyclopedia)

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.

Since you are using Symantec, see if their removal tool works... Trojan.Zbot Removal Tool | Symantec

I've tried to scan with this but I get a registry error every time.

 

[Jacee]

Since this is also a 'Rootkit" I would strongly advise you to wipe and do a clean install.

I don't work on machines that have this type of infection. The computer is badly compromised and I wouldn't guaranty it's stability ever again, without a clean install.

 

[Zalison]

I did the repair install and it didn't help everything is still not showing up. I really don't want to erase all my programs and have to start all over. Is there another way??

P.S. If I DO do a clean install.. will all the programs and files on my secondary HDD be okay?

 

[Layback Bear]

That infection could of got into any drive that was hooked to the rootkit infected computer while it was infected.

Jacee recommended a Clean Install for a reason.
After all she does care this badge.

MS MVP Consumer Security 2006~2015