Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Possible malware infection

16 Apr 2013   #1
robertju1

Windows 7 Home Premium x64
 
 
Possible malware infection

Hey,

I have been having problems with BSODs, and have been redirected to here from the BSOD subforum.
Recent Bsods happening at random

I have no idea what I should post or say here furthermore, but I do need help as it is a very big problem!

Thanks in advance,
Robert


My System SpecsSystem Spec
.
16 Apr 2013   #2
VistaKing

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Hi Robert

Lets take a look at something

Download DDS by clicking on the Download on the Table below

DescriptionDownload
DDSdownload

Save the file onto your desktop. Right click on the dds icon and choose Run as administrator . On the Settings Window put a check mark in attach.txt and then click on the Start button

Upload both of the logs " DDS.txt and ATTACH.txt " with your reply
My System SpecsSystem Spec
16 Apr 2013   #3
cottonball

Windows 7 Home Premium
 
 

robertju1,

Also download RogueKiller:
Tlcharger RogueKiller (Site Officiel)

When you get to the website, go to where it says:
(Download link) Lien de téléchargement:
Select the version with the x64.
Click the dark-blue button to download.
Save to the Desktop.

Close all windows and browsers.

Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the Desktop: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.
My System SpecsSystem Spec
.

17 Apr 2013   #4
robertju1

Windows 7 Home Premium x64
 
 

Done both, did take another DDS file from the internet as the link u provided doesn't work for me.

With the RK, I scanned first, used the delete function after (the one beneatch scan) and the scan function afterwards again, that's why I attached 3 files for RK.


Attached Files
File Type: rar Desktop Robertju1.rar (11.2 KB, 7 views)
My System SpecsSystem Spec
17 Apr 2013   #5
cottonball

Windows 7 Home Premium
 
 

robertju1,

Please run: aswMBR
http://public.avast.com/~gmerek/aswMBR.exe
Save it to the Desktop.

>>Make sure your AntiVirus is temporarily disabled!!<<

For information on how to disable protective programs, refer to this Info:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com

Right-click aswMBR and select: Run as Administrator

When promped with: This Application can use the Avast! Free AntiVirus for scanning...etc.
Select: Yes

The last line of the run in progress will provide the status of the Avast! scan.
It will say: Downloading Avast! virus definitiond database, etc.

When the Avast! scan is done, the last line changes to: Avast Engine definitions #####

At this point, click the Scan button on the lower left of the aswMBR screen.
The last line will now say "Scanning" while it is in progress.

Upon completion of the scan, click >Save log< and save it to the Desktop.
Note: Please do NOT attempt to fix anything!!
Exit the program.

Please post the aswMBR log in your reply.



Also, notice that another file is created on the Desktop.
It is named MBR.dat

Please submit MBR.dat for analysis to VirusTotal:
http://www.virustotal.com/
http://www.sevenforums.com/tutorials/277740-online-scanners-scan-suspicious-files-your-pc.html

If you get a message saying: 'File has already been analyzed', click: Reanalyze file

Once scanned, and you see the full results page on your screen, go up to the address bar at the top of the browser, and copy the http:\\etc. address there.

Then, provide the http:\\ address to the results page in your reply.
My System SpecsSystem Spec
04 May 2013   #6
robertju1

Windows 7 Home Premium x64
 
 

Hey, sorry for the late reaction, I was on vacation.

I have tried to run aswMBR, in normal mode and in safe mode with network possibilities, but I get an error that the program has crashed in both ways. It is a normal windows error, aswMBR doesn't work anymore and there are no solutions, and then I had to click right under to exit the program.

So this doesn't work, is there any other program that I can run which is alike?
My System SpecsSystem Spec
04 May 2013   #7
cottonball

Windows 7 Home Premium
 
 

Looks as if you are having a hard time obtaining information from which we can take action.

Let's take a look before Windows starts…

Do you have the Repair your computer option in the Advanced Boot Options menu?
Don't want for you to run this option; just want to know if you have it!!

To find out:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
Is the Repair your computer option listed?

If you do not have the option, do you have your Windows installation CD/DVD available?

And last, do you have a USB flash drive available, and access to another computer that is not infected?
My System SpecsSystem Spec
04 May 2013   #8
robertju1

Windows 7 Home Premium x64
 
 

Yes, the repair your computer is listed. (the option on top and above safe mode)

Also I do have an USB of 8gb available and acces to another computer that isn't infected yes.

Also when I pressed f8, I first gain the option from which thing I would like to boot, my SATA or the CDrom, Afterwards I gain the advanced boot options.
My System SpecsSystem Spec
04 May 2013   #9
cottonball

Windows 7 Home Premium
 
 

robertju1,

You may want to print these instructions so you can have access to follow them.
Also, you may want to read them once before you apply them.

Please plug a USB flash drive into a clean computer.
Go to Start > Computer
Double-click Computer, and select the flash drive.
Right-click and select: Format
Press Start on the Format prompt.
Remove when done.


Now, go to the Farbar Recovery Scan Tool Download page.
Select the 64-bit download.
Save the program to the >> USB flash drive <<

Next, remove the flash drive from the clean computer, and plug it into the problematic computer.

>>>Restart.
  • As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select your language settings, and click: Next
  • Select your User account and click: OK (If you did not set a password, leave blank.)
On the System Recovery Options menu you get the following options:
  • Startup Repair
  • System Restore
  • Windows Complete PC Restore
  • Windows Memory Diagnostic Tool
  • Scan your computer's memory for errors.
  • Command Prompt
Select Command Prompt
  • In the Command window, at the bliking cursor type notepad and press: Enter
  • In Notepad, under the File menu select: Open
  • Double-click Computer, find the flash drive letter, remember what letter it is, click on it, and press: Open
  • Close out of Notepad.
  • Click the Command Prompt window
  • Type g:\frst64.exe, and press: Enter
    Note: Replace the drive letter g with the drive letter of your flash drive!
  • The tool starts and prepares to run. Follow the prompts.
  • Click Yes to the disclaimer.
  • Press: Scan
When done scanning, the program saves a FRST.txt report on the flash drive.

Close Notepad, then, click the Command prompt window, and type exit, and press: Enter
Remove the USB flash drive.
Back at the System Recovery Options, press: Shutdown

Please provide the FRST.txt in your reply.
It is located in the USB flash drive.
My System SpecsSystem Spec
04 May 2013   #10
robertju1

Windows 7 Home Premium x64
 
 

Did all your steps and attached the text file!


Attached Files
File Type: txt FRST.txt (34.4 KB, 3 views)
My System SpecsSystem Spec
Reply

 Possible malware infection




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Possible malware infection
Sorry if ths is in the wrong section,,i wasn't sure where to put itl. My cother computer wont let me visit any pages at all with any browser and it also wont let me run hardly any programs either. I have cleeaned the system with Malwarebytes Anti Malware and tried to use superantispyware but...
System Security
Malware infection might have come back
I reinstalled GIMP recently for something, although I now prefer to use photoshop. Anyway, I thought the source I was getting it from was legit and I thought I had ticked/unticked all the right boxes when I installed it, only it ended up giving me a load of crapware along with it. Redesigned my...
Performance & Maintenance
Malware infection.
Hi, so this all started when I clicked on a Shipment Label.exe that arrived on my email, impersonating FedEx, a minute later, I get hit by a Malware denying me internet. So, I start by running Avira which didn't find anything. So, I go onto my laptop to see what I can do, after that, I restart my...
System Security
Malware Infection
hello everyone, got a problem here, i use Avast! Free AV and Malwarebytes free, i already scan everything and nothing was detected, but once in a while Avast always detect this malware infection :( Infection Details URL: ...
System Security
Malware Infection?
I'd appreciate any advice on the following Malware problem. My girlfriend's computer was 'hijacked' a couple of days ago by some malware which claimed to have 'locked' the computer and demanded payment for 'unlocking'. It was obviously a scam though looked 'official', stating her IP address and...
System Security
Malware.Trace infection
Good Morning. I woke this morning to see that my normal nightly full system scan by SUPERAntiSpyware found a registry malware called Malware.Trace with this information: HKUS\S-1-5-21-2418211180-2028737814-1402298196-1003\SOFTWARE\MICROSOFT\WINDOWS NT\Current Version\WinLogOn\ (SHELL...
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 13:53.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App