Possible malware infection

Hi Robert

Lets take a look at something

Download DDS by clicking on the Download on the Table below

No code has to be inserted here.

Save the file onto your desktop. Right click on the dds icon and choose Run as administrator . On the Settings Window put a check mark in attach.txt and then click on the Start button

Upload both of the logs " DDS.txt and ATTACH.txt " with your reply

robertju1,

Also download RogueKiller:
Tlcharger RogueKiller (Site Officiel)

When you get to the website, go to where it says:
(Download link) Lien de téléchargement:
Select the version with the x64.
Click the dark-blue button to download.
Save to the Desktop.

Close all windows and browsers.

Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the Desktop: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

robertju1,

Please run: aswMBR
http://public.avast.com/~gmerek/aswMBR.exe
Save it to the Desktop.

>>Make sure your AntiVirus is temporarily disabled!!<<

For information on how to disable protective programs, refer to this Info:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com

Right-click aswMBR and select: Run as Administrator

When promped with: This Application can use the Avast! Free AntiVirus for scanning...etc.
Select: Yes

The last line of the run in progress will provide the status of the Avast! scan.
It will say: Downloading Avast! virus definitiond database, etc.

When the Avast! scan is done, the last line changes to: Avast Engine definitions #####

At this point, click the Scan button on the lower left of the aswMBR screen.
The last line will now say "Scanning" while it is in progress.

Upon completion of the scan, click >Save log< and save it to the Desktop.
Note: Please do NOT attempt to fix anything!!
Exit the program.

Please post the aswMBR log in your reply.



Also, notice that another file is created on the Desktop.
It is named MBR.dat

Please submit MBR.dat for analysis to VirusTotal:
http://www.virustotal.com/
https://www.sevenforums.com/tutorials/277740-online-scanners-scan-suspicious-files-your-pc.html

If you get a message saying: 'File has already been analyzed', click: Reanalyze file

Once scanned, and you see the full results page on your screen, go up to the address bar at the top of the browser, and copy the http:\\etc. address there.

Then, provide the http:\\ address to the results page in your reply.

Looks as if you are having a hard time obtaining information from which we can take action.

Let's take a look before Windows starts…

Do you have the Repair your computer option in the Advanced Boot Options menu?
Don't want for you to run this option; just want to know if you have it!!

To find out:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
Is the Repair your computer option listed?

If you do not have the option, do you have your Windows installation CD/DVD available?

And last, do you have a USB flash drive available, and access to another computer that is not infected?

Yes, the repair your computer is listed. (the option on top and above safe mode)

Also I do have an USB of 8gb available and acces to another computer that isn't infected yes.

Also when I pressed f8, I first gain the option from which thing I would like to boot, my SATA or the CDrom, Afterwards I gain the advanced boot options.

robertju1,

You may want to print these instructions so you can have access to follow them.
Also, you may want to read them once before you apply them.

Please plug a USB flash drive into a clean computer.
Go to Start > Computer
Double-click Computer, and select the flash drive.
Right-click and select: Format
Press Start on the Format prompt.
Remove when done.


Now, go to the Farbar Recovery Scan Tool Download page.
Select the 64-bit download.
Save the program to the >> USB flash drive <<

Next, remove the flash drive from the clean computer, and plug it into the problematic computer.

>>>Restart.

• As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select your language settings, and click: Next
• Select your User account and click: OK (If you did not set a password, leave blank.)

On the System Recovery Options menu you get the following options:

• Startup Repair
• System Restore
• Windows Complete PC Restore
• Windows Memory Diagnostic Tool
• Scan your computer's memory for errors.
• Command Prompt

Select Command Prompt

• In the Command window, at the bliking cursor type notepad and press: Enter
• In Notepad, under the File menu select: Open
• Double-click Computer, find the flash drive letter, remember what letter it is, click on it, and press: Open
• Close out of Notepad.
• Click the Command Prompt window
• Type g:\frst64.exe, and press: Enter
  Note: Replace the drive letter g with the drive letter of your flash drive!
• The tool starts and prepares to run. Follow the prompts.
• Click Yes to the disclaimer.
• Press: Scan

When done scanning, the program saves a FRST.txt report on the flash drive.

Close Notepad, then, click the Command prompt window, and type exit, and press: Enter
Remove the USB flash drive.
Back at the System Recovery Options, press: Shutdown

Please provide the FRST.txt in your reply.
It is located in the USB flash drive.