Zbot.G everywhere - help

[alexham36]

I am running Win7 installed a few days ago and I use AVG for protection. I cannot use the computer because AVG is constantly showing hundreds of files infected with Zbot.G. I remove them all and that gives me a few minutes peace and then the whole process starts again. AVG is showing that OpenOffice files are infected and I uninstalled that software yesterday. If this virus cannot be removed, I have to learn to live without computers.

Can anyone help?

Thanks,

Alex

[Roz]

Wait for Mikkh or somebody more experienced than me to answer Alex, but from what I can gather it's a particularly bad one and it's probably better to reformat.

Read this thread, including the reply about re-installing any of your personal files. It looks like maybe you reintroduced the trojan from those, so they need to be fully scanned before again putting them back.

www.techspot.com/vb/topic173058.html

But try not to panic, panicking makes us more likely to do the wrong thing in haste I find

[mikkh]

Combofix is worth trying if only to make it stable enough to extract any data you want to keep
AVG is poor protection anyway, certainly the worst of all the free ones and it uses far too many resources which slows you down.

You'll maybe need to run rkill first (via safe mode)

Both files available at majorgeeks

type rkill majorgeeks in google to find it quickly similarly type combofix majorgeeks to get combofix

The least intrusive (resource wise) free virus checker is actually Microsofts MSE (Microsoft Security Essentials)

You should maybe investigate Linux as an alternative because it is all but immune from Windows nasties

[alexham36]

Thank you Mikh. I have downloaded Rkill and run it 3 times, yet AVG still showed 200 infected files. They are mostly in Java\jre6 and Samsung Kies, which is my mobile 'phone interface. Does that mean that my mobile is also infected? How can I check?

I have also downloaded MSE and it is running as I write, but it takes hours.AVG refused uninstall and keeps popping up every few minutes.

It is a madhouse here.

I fully agree with your comments about Linux. I have CDs with Mepis, Ubuntu and Linux Mint. They are all 2009 vintage when I last used them. None of them had "Suspend" or "Sleep" option and as I generally log on 4 or 5 times each day to check emails, I found it tedious to have to go through full logon each time.

But installing Linux on one of my 2 physical drives and using it only to manage my bank account and credit cards may be the only save option.

I'll let you know how I get on, but it does not look good at the moment.

Alex

[elvisuk]

alexham36,

You can get most up to date Linux OS from hear

distrowatch.com/table.php?distribution=mint

[alexham36]

Thank you Elvis.

[alexham36]

Mikkh,
I think I have succeeded in clearing my computer of viruses. Three runs of Rkill followed by a full scan with MSE and the uninstall of AVG. Thank you very much for your advice. I could have formatted and re-installed, but without good antivirus software I doubt that I would have remained clean for long.

To be on the safe side I will not using Win7 for managing my credit cards and bank accounts.

I used Linux Mint V6 this afternoon to pay some accounts. I loaded the demo version off the CD and that gave me Mozilla Firefox and access to Internet. I could not save anything and I did not want to, but I paid the bill OK. Something else that was impressive is that Linux recognized my Canon camera and my mobile without hunting for drivers.

Now, is there a Linux OS that you can recommend?

Regards,

Alex

[elvisuk]

I use Linux Mint 64bit for most things and it picks up every thing.

[mikkh]

I think you got the wrong idea about rkill - it's sole purpose in life is to terminate known bad processes that may already be running in RAM as a first step to using something like combofix or MBAM to remove it for good.

You would never need to run it more than once, it's just a precaution mostly - combofix does the real fixing

[alexham36]

Thank you Mikkh,

I had problems separating Combofix from "free scanners" and one site would not let me download Combofix unless I downloaded System Scan first.

So, I downloaded MSE. I really like it. It has not detected anything on C: for the past 24 hours, but it has found that some CDs and USB sticks had them and it removed them.

Alex

[mikkh]

This is the real link to combofix

download.bleepingcomputer.com/sUBs/ComboFix.exe