Solved Can't seem to get rid of virus

[nostaw5]

Hi guys,

I found a trojan on my computer after all my files (games, videos,) have been wiped off.


I noticed as well my HDD light was always on like the trojan is trying to slow down my HDD?.

I have removed the virus or (or it says i did) and the HDD light still on, never stops to blink or anything. So i ran scan again and downloaded malwarebytes.

Tests show 100% clean. >.<

Will i need to reinstall windows or is there a better way?

 

[CommandoBob]

You sure it wasn't blinking a lot prior the trojan? Maybe you're just running a lot of applications in the background or something.

 

[nostaw5]

yes even if im not doing anything (idle) the light is still on. It never normally did this, if idle it wouldnt even blink.

 

[Britton30]

Give your drive a test to see if it may be failing.

Hard drive(s):
Pick one for your HDD brand or use Seatools.
7 Free Hard Drive Testing Software Tools

If you think you have an infection try http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html#post1424613
Also this might find crap too. http://www.eset.com/us/online-scanner/

 

[nostaw5]

Give your drive a test to see if it may be failing.

Hard drive(s):
Pick one for your HDD brand or use Seatools.
7 Free Hard Drive Testing Software Tools

If you think you have an infection try http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html#post1424613
Also this might find crap too. Free Online Virus Scanner | ESET

I havnt run a windows defender scan at all, i thought my antivirus would do the work,

would that find anything? and would seatools work with a WD HDD?

thanks for your sugestions, the hdd has normal operation, after i log in something is making the light run 24/7, on boot screen it blinking like it normally does...

 

[nostaw5]

update:

just now it was blinking for about a minute then went back to full on, the only apps i had open was chrome (shut down everything i was running in taskbar/.

after i ran defender this occured

 

[Britton30]

Seatools can diagnose a WD drive but won't fix it.
Scroll down to number 5, there is the WD Life guard, try that.

Ye the Offline scanner may find what your AV missed, it work before Windows is booted up. The Eset work in Windows but may also find something. One AV scan is never enough.

 

[Borg 386]

It might be a good idea to check if you have a rootkit. Run TDSSKiller to check for that.

http://support.kaspersky.com/5350

Windows Defender Offline should be made on a clean PC (not on a suspected infected machine) as making it on a infected PC can compromise the integrity of the scanner.

What was the name of the Trojan that was found on your system?

 

[Britton30]

Windows Defender Offline should be made on a clean PC (not on a suspected infected machine) as making it on a infected PC can compromise the integrity of the scanner.

Good point Borg.

 

[ICIT2LOL]

Am just curious just what is still on as mine blinks away as a normal matter.

If you are really worried re that virus why not try this How to Know If Your Computer Is Infected to check

 

[Jacee]

Please download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.

 

[nostaw5]

Thank you for your suggestions i will do the ones that i have not mentioned below after

SO:

i dled tdsskiller no threat found

and will continue with the other options.

and about what i said earlier, the light started blinking (meaning not full on activity) for a while but on next reboot is back on. I will try the WD tools but a failure is ery unlikely for a new drive.

the only 2 processes working on the disk (in resource monitor under disk tab) are svhost and system (then chrome if its open)

I delete the trojan and cant find the history for adaware av.

any other options before i do a restore?

 

[Britton30]

Yes, finish the tests and scans. Just because a drive is new does not rule out a failing one.

You have some smart people here to help you now, so if you want to get your system up and running, follow their suggestions.

 

[nostaw5]

You have some smart people here to help you now, so if you want to get your system up and running, follow their suggestions.

i know that, as i contribute too, i have tried everything so far, seatools came up error free,

i am trying dds now

 

[ICIT2LOL]

Yes, finish the tests and scans. Just because a drive is new does not rule out a failing one.

You have some smart people here to help you now, so if you want to get your system up and running, follow their suggestions.

+ one mate like anything else cos it's new eh??

 

[nostaw5]

here are the logs

 

[nostaw5]

Bump!!!

 

[Borg 386]

Error: NetBT [4321] - The name "ALEX-PC :0" could not be registered on the interface with IP address 192.168.1.128. The computer with the IP address 192.168.1.135 did not allow the name to be claimed by this computer.

Error: Server [2505]The server could not bind to the transport \Device\NetBT_Tcpip_{68193385-9AA2-4764-A971-FFE3595795FC} because another computer on the network has the same name. The server could not start.

Are you running on a home network with other PC's attached? It looks like you are having quite a few problems with your net connections. This message can be caused by either two PC's having the same name or corrupted software (Which is a possibility considering you had a virus)

Fix Netbt Error 4321 Windows 7 Fix Errors – Windows XP, Vista & Windows 7

Source: NetBT Event ID: 4321 (Windows Operating System 5.2) - Technet Events And Errors Message Center: Message Details

You may wish to run a SFC /Scannow on your system to see if this fixes any damaged files. Make sure to run it 3X as it doesn't always fix all files the first couple times if there are a lot to fix.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Or a repair install.

http://www.sevenforums.com/tutorials/3413-repair-install.html

Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.

Event ID 13 Source ACPI Error

 

[Jacee]

Download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

 

[nostaw5]

Error: NetBT [4321] - The name "ALEX-PC :0" could not be registered on the interface with IP address 192.168.1.128. The computer with the IP address 192.168.1.135 did not allow the name to be claimed by this computer.

Error: Server [2505]The server could not bind to the transport \Device\NetBT_Tcpip_{68193385-9AA2-4764-A971-FFE3595795FC} because another computer on the network has the same name. The server could not start.

Are you running on a home network with other PC's attached? It looks like you are having quite a few problems with your net connections. This message can be caused by either two PC's having the same name or corrupted software (Which is a possibility considering you had a virus)

I think that is just our router, ever coupele of days we all drop connection, and we dont know why, it might be this.

I will also do the other options