[Resolved] Malware found

Hello.

I have recently had a problem with TR/Zlob.7687160' [trojan]. It started to show on my computer a few days. I use the free AntiVir program and it initially picked up 7 variations of this. I quarantined them all and then deleted them all. I restarted in safe mode and run the check again. It showed only a couple of the same malware. Again, I repeated the mentioned action. When I eventually thought I'd deleted them, I checked again in normal mode and found them all again.

Due to my massive lack of technical wizardry, I decided to format the whole computer and wiped it. I reinstalled Firefox and spyware blaster. I then downloaded Anti Vir again and updated it. It found the following two problems.

1. The file 'C:\System Volume Information\_restore{3645F337-2EB4-4D2C-81FB-5451D08365B1}\RP3\A0000180.exe'
contained a virus or unwanted program 'TR/Zlob.7687160' [trojan]
Action(s) taken:
The file was moved to '494f1046.qua'!

and

2. The file 'C:\Applications\Tool\DIVX\DivXCreate.exe'
contained a virus or unwanted program 'TR/Zlob.7687160' [trojan]
Action(s) taken:
The file was moved to '49950f98.qua'!

I cut and paste these from the log as I quarantined them and deleted them again. They still showed up. I then deleted all of the DIVx programs.
I then downloaded ATF cleaner and Malwarebytes Anti-malware. I run the cleaner and the Malware program. The malware program didn't find anything, yet it still shows them on Anti Vir. I have tried to search for the malware on the Anti Vir site and various others, but can only find Zlob by itself not this particular variant.

I would appreciate if someone can help me….

1. Tell me what this is.
2. Help me get rid of this.
3. Assist in preventing it from coming back.

I am very limited in my experience, so would realy like to be led through this with somone who has some patience.

Many thanks

Craig11350

_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!

• Save and quit any work your doing before beginning the fix.
• All hijackthis logs I ask for should be done in normal mode ( not safe mode)
• These logs should be done last after you have followed my instructions in the previous post.

Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!




_______________________________________________

1. The file 'C:\System Volume Information\_restore{3645F337-2EB4-4D2C-81FB-5451D08365B1}\RP3\A0000180.exe'
contained a virus or unwanted program 'TR/Zlob.7687160' [trojan]
Action(s) taken:
The file was moved to '494f1046.qua'!

Don't worry about this one it is in a restore point. For now as long as you do not use system restore your safe. We will clean that later on.






____________________________________

• Create a folder called HJT either in C: or My documents or some place convienient.
• Download Hijackthis from here. Scroll down just a bit to find it.
  
  Place it in the folder you just created
  
  This will ensure we have back ups made and it doesn't get deleted.
  
  
• Open HJT choose scan and save a log file.
• copy the contents of that log for me in your next reply.

Do not attempt to fix anything with HJT it shows both good and bad entries and files.


http://www.tomcoyote.org/hijackthis/

________________________________________________________





Download and install CCleaner from here


If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.

• Set Cookie Retention.
  Click on the Options block on the left, then choose Cookies.
  Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
  
• Reset Temp File Removal for Regular Use.
  Click on the Options block on the left. Select the Advanced button.
  Check "Only delete files in Windows Temp folders older than 48 hours".
  
  
  Now run the program and click on Run Cleaner
  ( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).

_________________________________

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

_________________________
In your next reply I would like to see:

• A new HJT log
• The report from HiJackthis
• The report from Kasperskys

Sorry for the typo on what I needed. You provided all I asked for. The newer version of HJthis is just fine also. If everything seems to be running OK I don't think you need anymore help. Just let me know if you think every thing seems to be OK.

Thanks again. Everything seem to be running OK. Thanks again for the advice, hopefully I won't need to return here!!!! Cheers Craig11350

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.