ok i reinstalled windows
i downloaded an image from Heidoc from a clean pc i burned the iso
i used "clean all" on my harddisk i reinstalled windows
i didn't install nothing and the virus came back
while windows was searching for updates i went to youtube.com and the virus was still there
i think it might be some "hardware virus" could it be?
thanks for your patience
Unplug from network while installing, wipe and reinstall, see if infection is there before connecting.
Did you clean the other PC's on your network with MBAM?
See if the same infection is found on this PC with MBAM.
Wait for more experienced help for this.
ok i'll try
but how can i know if my pc is infected without connecting to the internet?
i checked the other pcs with MBAM and also the .iso file and the dvd after it was burned before using it for the new install
(MBAM detected and cancelled something on the other pcs but nothing serious anyway those pc work well)
There is such a thing as hardware or BIOS infection but I've not seen one before, and can't say for sure that's what you might have. Does MBAM find the rootkit now?
I'd wait for more advanced security help as this is above my pay grade.
1.) Okay.
First, I am going to need to get your full system specs.
See this tutorial here and do what is instructed:
Speccy - Advanced System Information Tool
(Make sure to edit your windows key out of the log)
Then upload the log here as instructed.
2.) Second, You have done a complete format of your drive correct? Using clean all? What kind of Drive do you have? A hard drive or solid state drive? (ssd)
3.) When you reinstall windows, are you copying your data back from a backup? Like pictures, documents and stuff? Or are you immediately trying the browser and the issue still exists?
4.) Are you now using opendns on your router?
Please answer and do all above so I can get enough info to help you.
Good point Greg.
Perhaps resetting BIOS to defaults might help.
@Winter: You're getting some good help here, so I'll make two suggestions, then return to the sidelines.
Follow Greg's advice on a clean install and do not go to any website until the machine is clean of the infection. If you follow Greg's advice, that will be impossible because he asked you to disconnect from the Internet.
The Necurs infection originates on a website - once it gets rooted, it takes over your machine.
Disconnect all hard drives except the drive you're installing windows (I think Greg already suggested that, perhaps it was Andrew).
Run the machine with just the one drive for a while.
Notes:
- Your hosts files is the default, but it puts the loopback control on the router. Normally this is ok. Prior to Win7, the loopback would be on the local machine
127.0.0.1
::1
The above lines are not commented out (#127.0.0.1)- The bogus Flash update :https://www.sevenforums.com/attachmen...ing-second.png
Always install software from the publisher site or a trusted aggregator site (Bleepingcomputer, filehippo, ...)
The screen you posted show Flash pro and the text below the pop-up explains why you should avoid these things.- Usernameissues makes a good observation too - re: DNS
Ok, I'm out and will leave you to the other folks who are giving you great advice.
now i'm installing again without connecting to internet
1) do you think i should download speccy on my pc even if greg told me not to connect to internet?
2)i have a hard drive and i've done a complete format using clean all
3)i don't copy nothing from a backpup i immediately open the browser and after 2 or 3 sites correctly visualized i get the issue
4) i donw know if im using opendns but i dont think so
Winter when you are done you might try this if you need to
http://support.kaspersky.com/4162 it will scan from boot.
ok i've just re-installed windows now im disconnected from internet wht do i do?
do i have to install MBAM check for malwares and then try to surf the web?
Do NOT connect until you are asked to do so.
Do NOT connect any external drive (thumb or HD) until asked to do so.
You have been chasing this thing around and around, wait for assistance. I'm sitting this one out, there are many good folks helping and my input other than cautionary will only confuse the matter.
Please be patient and wait for assistance.
Thanks.
Quote