Jump to content


  • Content Count

  • Joined

  • Last visited

About q12

  • Rank
    New Member
  1. So, you can't play with what i send you ? To try to discover a way to repair it? You should do it way better than me, you have more knowledge and more tools to zoom in it, than me. But i understand you in the same time, and i thank you for the help you give me so far. You did very good already.
  2. i was curious how many executables i have in D drive - 700 executables/installers (not all are installers). and they make 14Gb and im afraid this virus is affecting zip files too.
  3. I scanned D drive and 93 infections found. The majority is [ Generic.Malware/Suspicious ] but is this thing that is creating svchost.exe. I saved the log from MB of the scan. mbScan_Ddrive.txt Here some small infected installers too, if you can test them. I really wish they are ok and no virus is [attached] to them - you can confirm it for me if is like so. But do it in a safe environment - a new windows installation on a single hard drive. To be safe. it's what im doing here for 2 weeks already, but i don't have your knowledge or your equipment. You can ask me for other infected installers that you can see in the list, if you can think it will help you more. infectedInstallers.zip infectedInstallers.zip
  4. i have a good idea: I think this virus write its own code to the installer. Can i send you some [infected] installers? You can quarantine them or put in a sandbox or whatever you have there...ideally a fresh windows like i have here. And see how its behaving, and fins a solution. I think if you find it's code injected into installer you can find the solution to clean it. I am scanning D drive now and make you a zip file with some small installers that i find infected.
  5. This is after your cleaning. But its the only way i can test. mbScan.txt
  6. yep, svchost.exe is back after executing bsplayer installer. This means that my installers, are truly infected with this virus? I have like 300 installers or more there. Im so dead. It looks that there are some random number of installers that are affected. Not all of them are touched. I tested them by execution.
  7. i will try to run some (known infected) installers to see if svchost.exe is re spawned.
  8. my only thought is to watch this virus, to see what is doing, where is writing its stuff, how is performing, find its real source. it's effects that i observed so far: Effects: 7zip(error while running after install), bsplayer(crash after install), chrome(facebookLoginFailed - facebook thought every time i am hacked and put me to reset password), SuspiciousServices() - errors and system crashing PowerManager service mantaining svchost.exe, *complete execution STOP of any installer after 2-3 uses making it unusable - basically, after i install a certain software repeatedly after 2 -3 times, that particular installer is blocked. I managed to unblock it by deleting it, and taking its original from a zip and running it again but the same routine was true, after 2-3 executions, it got blocked again. I can change it with it's original from zip again after that again and again.
  9. remember, the point here is not to clean windows, but to find the source of the virus in D drive. My windows7 was clean 8 times after windows7 installation but he got infected in the first 2 minutes like that every time.
  10. or at least what preventive measures i can take? To install a firewall or option ON the active defense from malwarebytes while im executing my installers?
  11. well... thats the thing. How can i test if is dead? My only way to test it, is to install something from D drive. It's the only source. I was thinking, maybe indeed there are some already infected installers, that i already downloaded some weeks ago infected like that OR they got mutated OR some kind of "system" file that is read automatically by some "shell" program from windows... my imagination got wild here but is all i can think of. Should i try the same installers now? Or just wait for you and do absolutely nothing? What are my options? I will definitely not download anything from internet these days. But to test your solution, i have to execute my "routine" installers.
  12. Mello mister Ron, and thank you for your help. I did exactly what you ask me to do. I will listen to you and wait these days without installing anything. Here is the result: Fixlog.txt
  13. how i manually unvirus it: in Services - "Power Manager" i make it Disabled i search in regedit after "PowerManager" and delete the whole folder with it. Restart PC C:\Windows\svchost.exe (hidden) and delete it. But even if i do that, after a new execution of (i want to believe CERTAIN) installers from D drive, all this cleaning i did is worthless. All reapear again as before like phoenix from the ashes. The same goes for MB. After it finds and clean, a new installer from D drive will fill back the virus locations with the same files. It should be a root of the virus. Can you explain to me what [CAN] it be? I really want to understand the mechanics behind it, and im certain you encounter this kind of thing in the past.
  14. MBupdates = done MBThreat Scan = done MBscanLog = yes AdwCleaner download/install = done AdwCleaner update = no such option* AdwCleaner scan - restartPC- clean. Farbar downloaded = ok scanLog = yes 5_1MBscanLog.txt 5_2AdwCleaner[S00].txt5_2AdwCleaner[C00].txt FRST.txtAddition.txt
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.