[thisisu]

Attaching a log from SAS as this appears to be new.
http://forums.majorgeeks.com/showthread.php?t=259885

Code: Select all

File threats detected     : 119

[B-boy/StyLe/]

Attaching a log from SAS as this appears to be new.
http://forums.majorgeeks.com/showthread.php?t=259885

Code: Select all

File threats detected     : 119

The same here:

http://forum.avira.com/wbb/index.php?pa ... dID=145110



Regards,
Georgi

[Quads]

FRST it to remove the folder.

Quads

[B-boy/StyLe/]

FRST it to remove the folder.

Quads

BlitzBlank by emsisoft should work either. :)



Regards,
Georgi

[Quads]

Not all the time and that includes the desktop.ini files due to the likes of services.exe in behind it all. ESET online scan finds just in the memory as sirefef.EZ

Quads

[B-boy/StyLe/]

Not all the time and that includes the desktop.ini files due to the likes of services.exe in behind it all. ESET online scan finds just in the memory as sirefef.EZ

Quads

I agree. However by using BlitzBlank this should allow Combofix to run properly to finish the job.
FRST is a great alternative indeed.


Regards,
Georgi

[thisisu]

The same here:

http://forum.avira.com/wbb/index.php?pa ... dID=145110

Nice! I'm going to try to move the folder with OTL first and then retry ComboFix (if needed).
Looks like you have the modified services.exe in that thread too. ;)

I haven't used BlitzBlank before. Do you find it more effective than Avenger?

[B-boy/StyLe/]

I haven't used BlitzBlank before. Do you find it more effective than Avenger?

Hi,


I would not compare these two since I find both of them to be pretty good.
However, I found that BlitzBlank is very useful against ZA and Bamital (deleting and replacing explorer.exe and winlogon.exe) from my experience.
I resolved a couple of cases thanks to it. :)


Regards,
Georgi

[B-boy/StyLe/]

malware case update

I ran MBAM with latest sigs - nothing
I ran hitmanpro - it found some irrelevant vundo stuff, ate some cookies and flagged SearchFilterHost.exe as suspicious, but that file resulted to be legit.

I can't run OTL on the infected system - it halts during the scan.

So all tools are breaking their teeth on this zaccess variant aorn

Hi,

Have you noticed from where FRST was started?

Code: Select all

Running from C:\Users\JonEJet\Downloads

Not from a PE environment...

Also this should be the oldest variant:

Code: Select all

C:\Windows\$NtUninstallKB46020$

Break the junction and delete the folder.



Regards,
Georgi

[Quads]

FRST has more power when run from Flash Drive and boot FRST not windows.

Quads