System File infected with TR/BProtector.Gen

Page 2 of 4 FirstFirst 1234 LastLast

  1. Posts : 28
    Windows 7 Ultimate x86
       #11

    Oh, I'm sorry! I completely misunderstood your original question :)

    I thought you were showing a list of running processes so someone can see if there is malware running or such.

    A really good tool that I use quite often is Norton Power Eraser. When you run it, accept the license agreement, click "Advanced", and then click "Scan Now" beside "System Scan". It'll pick up basically anything and it recently got rid of Win32\Shellcode.A for me - enjoy :)
      My Computer


  2. Posts : 243
    Windows 7 Professional 64 bit SP 1
    Thread Starter
       #12

    Rixterz said:
    Oh, I'm sorry! I completely misunderstood your original question :)

    I thought you were showing a list of running processes so someone can see if there is malware running or such.

    A really good tool that I use quite often is Norton Power Eraser. When you run it, accept the license agreement, click "Advanced", and then click "Scan Now" beside "System Scan". It'll pick up basically anything and it recently got rid of Win32\Shellcode.A for me - enjoy :)
    Is it save to do so, or should I backup all the files I need before doing this?
      My Computer


  3. Posts : 10,485
    W7 Pro SP1 64bit
       #13

    Mual said:
    Rixterz said:
    Oh, I'm sorry! I completely misunderstood your original question :)

    I thought you were showing a list of running processes so someone can see if there is malware running or such.

    A really good tool that I use quite often is Norton Power Eraser. When you run it, accept the license agreement, click "Advanced", and then click "Scan Now" beside "System Scan". It'll pick up basically anything and it recently got rid of Win32\Shellcode.A for me - enjoy :)
    Is it save to do so, or should I backup all the files I need before doing this?
    Since you ran the tools mentioned in cottonball's post, it would be best if you leave things alone until you hear back from cottonball on what to do next. Running an automated tool (like Norton Power Eraser) might change/negate the files that you attached to post #8.

    In threads like this, it is best to pick one person to follow during the infection cleanup process. The exception being, cottonball and Jacee have a good feel for how the tools that they suggest interact. If both of them enter an infection cleanup thread, then you can safely follow both.

    After you complete the cleanup process, we can work on uninstalling some old flawed software that you probably should not have installed.
      My Computer


  4. Posts : 28
    Windows 7 Ultimate x86
       #14

    As there are important system files infected rather than just extra malicious files being put there, it's best to dump all of your needed files elsewhere and then just let NPE sort the infected ones out.

    -Rixterz
      My Computer


  5. Posts : 17,322
    Win 10 Pro x64
       #15

    Rixterz said:
    As there are important system files infected rather than just extra malicious files being put there, it's best to dump all of your needed files elsewhere and then just let NPE sort the infected ones out.

    -Rixterz
    https://security.symantec.com/nbrt/npe.aspx

    Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. If you accidentally remove a legitimate program, you can run Norton Power Eraser to review past repair sessions and undo them.
    I think sticking to the advice and guidance of cottonball would be best.
      My Computer


  6. Posts : 10,485
    W7 Pro SP1 64bit
       #16

    derekimo said:
    Rixterz said:
    As there are important system files infected rather than just extra malicious files being put there, it's best to dump all of your needed files elsewhere and then just let NPE sort the infected ones out.

    -Rixterz
    https://security.symantec.com/nbrt/npe.aspx

    Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. If you accidentally remove a legitimate program, you can run Norton Power Eraser to review past repair sessions and undo them.
    I think sticking to the advice and guidance of cottonball would be best.
    Assumes that the OS will boot ;-(

    I agree, wait for cottonball.

    @Rixterz,
    Our comments are not meant to discourage you from helping in threads... but the infection of system files (if that is indeed what the OP has) is best handled slowly, by less automated tools.
      My Computer


  7. Posts : 17,322
    Win 10 Pro x64
       #17

    UsernameIssues said:
    Assumes that the OS will boot ;-(

    Exactly.
      My Computer


  8. Posts : 28
    Windows 7 Ultimate x86
       #18

    OK, it was just a suggestion. At least it's best for me.
      My Computer


  9. Posts : 2,470
    Windows 7 Home Premium
       #19

    Mual,

    As far as Zoek goes, try running it from Safe Mode:

    Restart the computer.
    Tap the F8 key to open the Windows Advanced Options Menu
    Select: Safe Mode
    Press: Enter

    On the files showing in the Avira AV scan, they look like legit files, but, let's not take that for granted.

    Please submit the following files for analysis to VirusTotal:
    http://www.virustotal.com/
    Use the 'Choose File' button to navigate to the location of one of the files:

    taskeng.exe
    nvxdsync.exe
    oodag.exe

    In the Choose file to upload prompt, select the file, then, click the 'Open' button.
    The file is now displayed in the blank box of VirusTotal
    Click: Scan It, and wait for the results.
    If you get a message saying: 'File has already been analyzed', click: Reanalyze file now

    Once scanned, please provide the link to the results page in your reply.

    Next, run the other two files through VT and post the results.
      My Computer


  10. Posts : 243
    Windows 7 Professional 64 bit SP 1
    Thread Starter
       #20

    UsernameIssues said:
    Mual said:
    Rixterz said:
    Oh, I'm sorry! I completely misunderstood your original question :)

    I thought you were showing a list of running processes so someone can see if there is malware running or such.

    A really good tool that I use quite often is Norton Power Eraser. When you run it, accept the license agreement, click "Advanced", and then click "Scan Now" beside "System Scan". It'll pick up basically anything and it recently got rid of Win32\Shellcode.A for me - enjoy :)
    Is it save to do so, or should I backup all the files I need before doing this?
    Since you ran the tools mentioned in cottonball's post, it would be best if you leave things alone until you hear back from cottonball on what to do next. Running an automated tool (like Norton Power Eraser) might change/negate the files that you attached to post #8.

    In threads like this, it is best to pick one person to follow during the infection cleanup process. The exception being, cottonball and Jacee have a good feel for how the tools that they suggest interact. If both of them enter an infection cleanup thread, then you can safely follow both.

    After you complete the cleanup process, we can work on uninstalling some old flawed software that you probably should not have installed.
    Yes indeed. Since that cottonball have replied. I should follow his method for now.

    derekimo said:
    Rixterz said:
    As there are important system files infected rather than just extra malicious files being put there, it's best to dump all of your needed files elsewhere and then just let NPE sort the infected ones out.

    -Rixterz
    https://security.symantec.com/nbrt/npe.aspx

    Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. If you accidentally remove a legitimate program, you can run Norton Power Eraser to review past repair sessions and undo them.
    I think sticking to the advice and guidance of cottonball would be best.
    cottonball said:
    Mual,

    As far as Zoek goes, try running it from Safe Mode:

    Restart the computer.
    Tap the F8 key to open the Windows Advanced Options Menu
    Select: Safe Mode
    Press: Enter

    On the files showing in the Avira AV scan, they look like legit files, but, let's not take that for granted.

    Please submit the following files for analysis to VirusTotal:
    http://www.virustotal.com/
    Use the 'Choose File' button to navigate to the location of one of the files:

    taskeng.exe
    nvxdsync.exe
    oodag.exe

    In the Choose file to upload prompt, select the file, then, click the 'Open' button.
    The file is now displayed in the blank box of VirusTotal
    Click: Scan It, and wait for the results.
    If you get a message saying: 'File has already been analyzed', click: Reanalyze file now

    Once scanned, please provide the link to the results page in your reply.

    Next, run the other two files through VT and post the results.
    After I get the result I'll post here. Thanks in advance
      My Computer


 
Page 2 of 4 FirstFirst 1234 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 08:52.
Find Us