[ti]CLOSED[/ti]Trojan.Zlob.Q help needed

kedbear
New Helpee

Posts: 1

[ti]CLOSED[/ti]Trojan.Zlob.Q help needed Sept 3, 2017 9:02:57 GMT -8

Post by kedbear on Sept 3, 2017 9:02:57 GMT -8

Hi,

I have read the welcome rules and tips and am hoping you can help.

I have been getting notifications from Norton about stopping an infection from Trojan.Zlob.Q multiple times a day for weeks now. Norton Power Eraser doesn't actually find anything to remove. Neither does Adaware or Spyhunter. I can't actually export all of the detailed information Norton provides when they block the attack, which I assume would be helpful. But I did run FRST64.exe and have posted the wikisend links below:

wikisend.com/download/257572/FRST.txt
wikisend.com/download/256870/Addition.txt

Last Edit: Oct 1, 2017 9:48:19 GMT -8 by dbrisen

dbrisen
Malware Removalists

Posts: 3,688

[ti]CLOSED[/ti]Trojan.Zlob.Q help needed Sept 3, 2017 19:53:07 GMT -8

Post by dbrisen on Sept 3, 2017 19:53:07 GMT -8

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Yahoo Search Set
QuickTime 7

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

1- Please double-click on FRST/FRST64
2- Press Ctrl+y (Ctrl and y keys at the same time)
3- A fixlist.txt file opens up in notepad.exe. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad.

Start::
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction <==== ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-1384883532-177175000-2232093405-500 -> {5427701D-43B0-409C-804A-72E4F1EBE94F} URL = hxxps://search.yahoo.com/search?fr=mcafee&type=C010US91037D20120419&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1384883532-177175000-2232093405-500 -> {C7717BF5-7FFF-4146-9362-CE9F89A5690D} URL = hxxps://search.yahoo.com/search?p={searchTerms}&intl=us&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
FF SearchPlugin: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\85ffr741.default-1459306254573\searchplugins\McSiteAdvisor.xml [2017-08-16]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2015-04-05]
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?fr=mcafee&type=C210US91037D20120419&p={searchTerms}
CHR DefaultSearchKeyword: Default -> McAfee
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Extension: (Chrome Web Store Payments) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-18]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-14]
CHR Extension: (Yahoo Partner) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoalfhodgifhbkgmbbdafcihjpdldpll [2017-01-18]
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoalfhodgifhbkgmbbdafcihjpdldpll
CHR HKLM-x32\...\Chrome\Extension: [eoalfhodgifhbkgmbbdafcihjpdldpll] - hxxps://clients2.google.com/service/update2/crx
CustomCLSID: HKU\S-1-5-21-1384883532-177175000-2232093405-500_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
ContextMenuHandlers2: [LavasoftShellExt] -> {DCE027F7-16A4-4BEE-9BE7-74F80EE3738F} => C:\Program Files (x86)\Lavasoft\Ad-Aware\ShellExt_64.dll -> No File
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File
ContextMenuHandlers6: [LavasoftShellExt] -> {DCE027F7-16A4-4BEE-9BE7-74F80EE3738F} => C:\Program Files (x86)\Lavasoft\Ad-Aware\ShellExt_64.dll -> No File
Task: {005B17C5-3B5B-4981-9260-5A031F0C40A1} - System32\Tasks\{670D07F8-18BA-41F3-9B6E-B598FAFA171B} => C:\Windows\system32\pcalua.exe -a C:\Users\Administrator\Downloads\Adaware_Installer(2).exe -d C:\Users\Administrator\Downloads
Task: {0BC4CDB3-F6C9-4E52-B288-CC15C8477402} - \{B1AB9816-0600-2FBD-297D-C39471E13CC4} -> No File <==== ATTENTION
Task: {10846AAA-D639-4E8E-81B2-9DB4F875B5F4} - System32\Tasks\{739A7532-16D9-440D-BE6C-026368A3F7C3} => C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe [2015-12-15] (Apple Inc.)
Task: {12261E41-4940-4267-A7DE-702B55E22829} - \{CFA67BE0-780D-CC4B-43A6-E6529982A008} -> No File <==== ATTENTION
Task: {1EDD54B7-C385-463E-95FB-3F460339302E} - \{C23C4250-7597-F5FB-2009-BAB389B7C04C} -> No File <==== ATTENTION
Task: {208F601F-1114-4892-B8E4-9FFB14D04080} - System32\Tasks\{D914816D-A073-465C-A159-3C5A1946FBBB} => C:\Windows\system32\pcalua.exe -a D:\SETUP.EXE -d D:\
Task: {28F4472F-91A2-437C-A5CC-42DABB498C9C} - \{1DD4E803-AA7F-5FA8-6678-5500DCB03D64} -> No File <==== ATTENTION
Task: {2AE64BE5-B88F-4CA7-A691-A7AD794F37F2} - \{3DF4D894-8A5F-6F3F-6C61-DF8FC4A8D880} -> No File <==== ATTENTION
Task: {2E3F5D3E-5DE0-472B-B726-48183D88759C} - \Microsoft\Windows\Media Center\StartRecording -> No File <==== ATTENTION
Task: {35BE4FE0-DFB9-4D39-B3E0-25C3E08FB167} - \{2BA415A5-9C0F-A20E-C417-A9389C7BAFE4} -> No File <==== ATTENTION
Task: {364BBECC-43D6-48F6-A435-B9430DB6C3EF} - \{A2BC1AD2-1517-AD79-47CA-2F3A9F16D854} -> No File <==== ATTENTION
Task: {37E1DC84-1FF1-4958-A9CB-12CB7AF91FFD} - \{6DB25917-DA19-EEBC-7EB6-94A9D6906EC8} -> No File <==== ATTENTION
Task: {391274B6-D175-4957-866E-CE67AF483611} - \{08CC4F6A-BF67-F8C1-17B8-0376B86DB055} -> No File <==== ATTENTION
Task: {3A86290E-37A5-4BDE-818C-330A37D58119} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {3B92952D-B951-4C17-926D-3D023310E5E2} - \{3D904635-8A3B-F19E-3998-8431612B1F9A} -> No File <==== ATTENTION
Task: {3F540239-FCDA-489D-8965-375813D2E13D} - \{6C7DE468-DBD6-53C3-6297-223B85863B4E} -> No File <==== ATTENTION
Task: {42448FC7-165B-4945-8B55-B27826AFCB79} - \{40BB87B2-F710-3019-F053-412C7192F576} -> No File <==== ATTENTION
Task: {48D7C13F-0CE3-4CFB-96C1-6B948FC64A19} - \{44259FDA-F38E-2871-679C-3A62D8424135} -> No File <==== ATTENTION
Task: {4AA3D6EF-7077-4608-B277-6B01A2A171DA} - \{CBAEE547-7C05-52EC-E7AE-1A734BE79FC2} -> No File <==== ATTENTION
Task: {4B694B9B-822D-4B4B-9994-C5457B33127F} - \{1F3F20A8-A894-9703-7F0D-223D1EE35741} -> No File <==== ATTENTION
Task: {4C0049CA-A4B2-4AD7-B983-36394B9A83B1} - \{D7BB715D-6010-C6F6-DB2A-E17756EE9674} -> No File <==== ATTENTION
Task: {4CC0AF75-D3B0-4BCD-BAC2-9CF0026806C9} - \{4D22CC20-FA89-7B8B-8C4C-A715370EF452} -> No File <==== ATTENTION
Task: {4FA089F1-4E32-4770-A45F-94B8F545EB06} - \{BDDAE122-0A71-5689-0B57-76C701437227} -> No File <==== ATTENTION
Task: {5531F435-01B2-406A-AA71-5499A84B5050} - \{41CCA34E-F667-14E5-CCBA-27930B6972BA} -> No File <==== ATTENTION
Task: {5AAE592A-4118-451A-BE0C-0FB21FE47540} - \{779C99B4-C037-2E1F-7A90-2D9F9498DD3E} -> No File <==== ATTENTION
Task: {5D087652-9585-4265-9B6B-B0B1C1A3AB2C} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {5E7DBE04-8AE6-4EAF-B867-056AE79A122F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {6D88C676-FAC3-418D-B9EC-87B3E8EA7811} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {6F8A37CB-CD25-46A7-9365-C0C080846349} - \{748EDAB2-C325-6D19-48A0-51A33EF56DFD} -> No File <==== ATTENTION
Task: {711E28F5-7713-4A91-85D7-D4307713D7A4} - \{DDA8DC35-6A03-6B9E-B13C-B5C368636F03} -> No File <==== ATTENTION
Task: {7D48652A-F2CF-49B9-802D-99BC5DFE3643} - \{95832880-2228-9F2B-0180-6546188B4F3D} -> No File <==== ATTENTION
Task: {7F9EA8A6-CF73-4532-A431-B6FC48233341} - \{A25E48DD-15F5-FF76-BE5B-F373D5BD71A8} -> No File <==== ATTENTION
Task: {8098C4E1-22A3-481D-BEFE-E912DE00C160} - \{194A65E7-AEE1-D24C-6152-4D716A6A508F} -> No File <==== ATTENTION
Task: {84927E95-62FE-42C9-9FED-DF27970FE025} - \{3E258D43-898E-3AE8-2F59-6F4F092BADCE} -> No File <==== ATTENTION
Task: {939EFC4C-F1F5-4D16-9E0B-2E2867B37B74} - \{809CAA94-3737-1D3F-F770-EF3FD4909ABF} -> No File <==== ATTENTION
Task: {9D0E2FEE-5095-4FCC-861F-E09AC3F7B204} - \{1EA935B0-A902-821B-0E16-4E6537656262} -> No File <==== ATTENTION
Task: {A2B00712-A44C-4639-B809-64BEAD5EF1B2} - \{1DA22201-AA09-95AA-3F20-4CF9B4F62175} -> No File <==== ATTENTION
Task: {A553E4E8-7AC7-41C3-9218-B74414629E62} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {A70BAF28-4C1E-4FB8-9CEB-92A0E24850BD} - \{23B943CD-9412-F466-B70A-7239863F4850} -> No File <==== ATTENTION
Task: {A90DE147-E6B5-465A-BF28-ED6FF3B8ECC0} - \{97638190-20C8-363B-72D0-3641A37DC9AC} -> No File <==== ATTENTION
Task: {AD1AFC46-AE82-4220-9928-9DAED73807D6} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {B0A649F0-2E2E-4419-8969-583FE8912410} - \{E46A99DD-53C1-2E76-86EE-BD03EB5DAB4F} -> No File <==== ATTENTION
Task: {B2522F5D-8BF6-4FB2-BFAC-5DCF3192669C} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {B4D138A1-2BCF-4049-BE87-25E13CCD439D} - \{FDFCD114-4A57-66BF-E68E-AE99B54BE850} -> No File <==== ATTENTION
Task: {B4D3E393-BE0A-42F8-AEE3-14CC21BAD834} - \{C6F897D8-7153-2073-87AF-DF19C7A0EE88} -> No File <==== ATTENTION
Task: {BDA2D0BA-74F2-4E17-91EB-49B089677D68} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C446CCE1-CCC7-46D9-AAAA-323BD3302B0F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {C57E9554-697E-46C9-B476-403CBE5C432F} - \{069FDB87-B134-6C2C-4337-7B87ED71E8FA} -> No File <==== ATTENTION
Task: {C78DD6CC-F457-43E4-8949-E139B0F0FDBF} - \{623CCAA4-D597-7D0F-2A3C-0D8300DED9E5} -> No File <==== ATTENTION
Task: {C8347B57-5809-46F7-AFF1-CBE6DFC1D3A3} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {D770C561-192F-4BAA-9E3F-29995C9851B5} - \{C0E4E06F-774F-57C4-0864-1F12998DF360} -> No File <==== ATTENTION
Task: {DA1F44EC-5784-4CF9-AC7E-85C9751D48A8} - \{8C59F48E-3BF2-4325-657D-8B0850E245BF} -> No File <==== ATTENTION
Task: {DBFC32D2-27B3-4FCC-97AB-58BDFE1D2D3D} - \{188AED26-AF21-5A8D-E582-6AAD00B75D11} -> No File <==== ATTENTION
Task: {DF6C6161-C74D-4978-B8F7-5385072E9AF5} - \{6E28552E-D983-E285-F0EA-8BA49AE4F39F} -> No File <==== ATTENTION
Task: {E3942962-5EF7-4001-B5EB-25D6A4001321} - \{B23EB655-0595-01FE-8BE8-72171E5AEE65} -> No File <==== ATTENTION
Task: {E594559C-9A88-478D-B9F9-23095366E540} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {E780A4BB-F7C2-4A00-98DD-9CB175013CEC} - \{D5CF78D7-6264-CF7C-D85C-20ACCDA3855D} -> No File <==== ATTENTION
Task: {F2241BC3-83D0-4961-B77B-7732082E11D5} - \{3E676CAE-89CC-DB05-90F9-23A20FDD6374} -> No File <==== ATTENTION
Task: {F4920049-8735-45CA-B150-12B3BA40D9E7} - \{574229F0-E0E9-9E5B-08E3-C73772059BCF} -> No File <==== ATTENTION
Task: {F508FA8A-8593-4E2C-B5EA-A9B136FD54B6} - \{090F7F47-0F0E-790A-7D11-7F7E780E1108} -> No File <==== ATTENTION
Task: {F5B6100E-0CD9-42D5-A544-48F4C3318422} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {FA4E76EC-590A-430C-B03C-45DF09D36AAF} - \{CB6F62B8-7CC4-D513-4C18-E1B6C121A63D} -> No File <==== ATTENTION
Task: {FA5093E3-C21F-46ED-84AB-2FE03DF83BE6} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {FA65D3E0-279D-4D73-ABDF-F0AD851EFF5A} - \{8C7CB79A-3BD7-0031-C483-E7290BC1F047} -> No File <==== ATTENTION
Task: {FB5E63AE-9368-4AB5-A812-07229DC62264} - \Microsoft\Windows\Setup\GWXTriggers\Logon-URT -> No File <==== ATTENTION
Task: {FC4C63C7-6E86-4AD0-A142-DF0062D9BB79} - \{3E9BF438-8930-4393-02D4-CBBBCA8EDFC0} -> No File <==== ATTENTION
Task: {FCB2A2C8-873F-46CC-B606-30031E85C991} - \{4FCB6819-0881-D833-E01A-E8BAA403641D} -> No File <==== ATTENTION
Task: {FDD7638C-2D38-4A80-A6F0-AC4B051E52CC} - \{1BA53020-AC0E-878B-14CC-EF627F12D114} -> No File <==== ATTENTION
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
End::

4- Press Ctrl+s to save. Close the fixlist.txt file.
5- Press the Fix button just once to start the script processing.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

LAST >>>>

How is your system running now?

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

dbrisen Malware Removalists Posts: 3,688	[ti]CLOSED[/ti]Trojan.Zlob.Q help needed Oct 1, 2017 9:48:02 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Oct 1, 2017 9:48:02 GMT -8 Due to lack of responce, this thread has been closed. If you are the original poster and wish this thread re-opened, please PM an Staff Member to have it re-opened. Thank you.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

[ti]CLOSED[/ti]Trojan.Zlob.Q help needed

Post by kedbear on Sept 3, 2017 9:02:57 GMT -8

Post by dbrisen on Sept 3, 2017 19:53:07 GMT -8

Post by dbrisen on Oct 1, 2017 9:48:02 GMT -8