AVG detects multi-infections including Zbot.E

Try this scan instead:

🖼Click to load external image (Posted Image) Please run ESET Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start. The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button. The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

On ESET I'm getting "cannot get update is proxy configured?" - which it isn't. AVG killed so many exe and dlls that I think I'm going to have to reformat don't you? …Later Getting further with ESET now…

Not looking good I'm afraid. Would appreciate advice on what kind of files I can copy to external hard drive… C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\All Users\Documents\Server\sphlp.dll a variant of Win32/Bamital.EP trojan C:\Documents and Settings\Default User\Start Menu\Programs\Startup\usoq.exe Win32/Spy.Zbot.YW trojan C:\Documents and Settings\Duncan\Application Data\Ezfiid\_ukix.exe Win32/Spy.Zbot.YW trojan C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\ATI Technologies\ATI.ACE\CLIStartSrvSrvSrvSrvSrvSrvSrvSrvSrvSrvSrv.exe Win32/Ramnit.A virus C:\Program Files\QuickTime\QTTaskSrv.exe Win32/Ramnit.A virus C:\Program Files\tmp\i644486.exe Win32/Spy.Zbot.YW trojan C:\Qoobox\Quarantine\C\Documents and Settings\Duncan\Application Data\Egyp\neopu.exe.vir Win32/Spy.Zbot.YW trojan C:\Qoobox\Quarantine\C\Documents and Settings\Duncan\Application Data\Ivka\nuezi.exe.vir Win32/Spy.Zbot.YW trojan C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\avgmfapxSrv.exe.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\26_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\29_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\41_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\42_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\45_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\46_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\49_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\50_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\58_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\59_tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\bubble_general.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\Facebook_error.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\Facebook_notifier.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\Facebook_status.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\rssreader_simple.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_dangerous.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_questionable.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_risky.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_safe.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_unknown.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\ssb_waiting.html.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\tabswelcome_ie7footer.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared\chrome\content\html\weather_error.htm.vir Win32/Ramnit.A virus C:\Qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir a variant of Win32/Kryptik.FIJ trojan C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\RapportBuka.sys.vir Win32/Olmarik.ZC trojan

elbowpipe:

Your right - that is very bad news. Win32/Ramnit. is a file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files.

With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS. The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit. remains on a computer, the more files it infects and corrupts so the degree of infection can vary. Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

Right now, the best thing you can do is to backup, preferably to CD, all your important data, documents, pictures, movies, and songs, then reformat and reinstall Windows.

DO NOT backup any applications or installers and DO NOT backup any files with the following extensions:

* .exe
* .scr
* .htm
* .html
* .xml
* .zip
* .rar

If you need information on how to carry out a Reformat and Reinstall, please see this page.

I'm sorry we didn't have a better outcome here. Please post once more when you are all set so I can close the thread.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.