Zeroaccess.b within system32/services.exe [Solved]

Hi, I recently had the live platinum security virus on my computer which I seem to have got removed. However I keep getting a virus warning on start up and every few minutes my talk talk security centre says I have infected file by the zeroaccess.b within folder system32/services.exe I have tried many malware removal tools by reading other threads but can't seem to get rid of it. Can someone help please. Thanks

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.
  
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Right-click and Run as Administrator dds to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download aswMBR to your desktop.

• Right click and Run as Administrator the aswMBR icon to run it.
• Click the Scan button to start scan.
• When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

Jeff, Many thanks. Please find my files as requested.

I am waiting on the aswMBR log as at present it is still scanning - seems to be taking a very long time, got stuck on windows lve\installer\catalog\ Will post hopefully when it has stopped

mswMBR txt file now added. Hopefully this will provide you with what you require.

Hi,

Thanks for the logs, but there is no need to zip them and attach. You can just copy/paste the logs directly to the replies here.
———

Download Combofix from the link below, and save it to your desktop.
Link

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.


——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.

———-

Jeff, Thanks think this has fixed it. The talk talk security no longer keeps flashing that there is an issue or a virus. Thanks I am now getting a new error, don't know if you can help I no longer can open my autodesk autoCAD 2004. I try to open and a autocad.exe error comes up saying:- The procedure entry point ?addLinksG1Continuity@AcGeImpComposite3d@@QAEXN@Z could not be located in the dynamic link library AcGe16.dll Can you you help? Thanks

Hi,

Stick with me…..that was a serious infection and we need to make sure it won't respawn.

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

  
  ClearJavaCache::
  
  DDS::
  BHO: Wajam: {a7a6995d-6ee1-4fd1-a258-49395d5bf99c} - c:\program files\wajam\ie\priam_bho.dll
  Trusted Zone: landmarkinfo.co.uk
  Trusted Zone: promap.co.uk
  Trusted Zone: promapserver.co.uk
  Trusted Zone: youtube.com\www
  
  File::
  c:\windows\CC1F6DA021D2425AB1B65B164A598450.TMP
  

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Jeff As requested additional log Thanks

Hi,

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
• Click Scan (This scan can take several hours, so please be patient)
• If there are threats that are found, please press List of found threats and then in the next window that opens press Export to text file…
• Copy and paste/or attach that log as a reply to this topic

**Note** If not threats are found there will not be a log created.
———-

Jeff Malware log attached EST to follow

Jeff, ESET log as requested. Seems I still have a trojan. Can you help please.

Hi, That entry that ESET is showing is already quanrantined by ComboFix. How is your system running?

It seems to be running good thanks. The talk talk is no longer says there is an issue. The only issue now is that I can't seem to open autoCAD as mentioned earlier. Is this something you can help with? Thanks for you help so far.

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt
• Please post the contents of that document.

———-