q12

Problem solved, it was a folder "ownership" issue.

The install package starts installing and is reaching 12% then remains there for 30s or so and an error window appears: see img attached I uninstalled the old version and (try) to reinstall this version now. I restarted windows for a couple of times, nothing worked. Thank you.

Yes, thank you.

So, you can't play with what i send you ? To try to discover a way to repair it? You should do it way better than me, you have more knowledge and more tools to zoom in it, than me. But i understand you in the same time, and i thank you for the help you give me so far. You did very good already.

i was curious how many executables i have in D drive - 700 executables/installers (not all are installers). and they make 14Gb and im afraid this virus is affecting zip files too.

I scanned D drive and 93 infections found. The majority is [ Generic.Malware/Suspicious ] but is this thing that is creating svchost.exe. I saved the log from MB of the scan. mbScan_Ddrive.txt Here some small infected installers too, if you can test them. I really wish they are ok and no virus is [attached] to them - you can confirm it for me if is like so. But do it in a safe environment - a new windows installation on a single hard drive. To be safe. it's what im doing here for 2 weeks already, but i don't have your knowledge or your equipment. You can ask me for other infected installers that you can see in the list, if you can think it will help you more. infectedInstallers.zip infectedInstallers.zip

i have a good idea: I think this virus write its own code to the installer. Can i send you some [infected] installers? You can quarantine them or put in a sandbox or whatever you have there...ideally a fresh windows like i have here. And see how its behaving, and fins a solution. I think if you find it's code injected into installer you can find the solution to clean it. I am scanning D drive now and make you a zip file with some small installers that i find infected.

This is after your cleaning. But its the only way i can test. mbScan.txt

yep, svchost.exe is back after executing bsplayer installer. This means that my installers, are truly infected with this virus? I have like 300 installers or more there. Im so dead. It looks that there are some random number of installers that are affected. Not all of them are touched. I tested them by execution.

i will try to run some (known infected) installers to see if svchost.exe is re spawned.

my only thought is to watch this virus, to see what is doing, where is writing its stuff, how is performing, find its real source. it's effects that i observed so far: Effects: 7zip(error while running after install), bsplayer(crash after install), chrome(facebookLoginFailed - facebook thought every time i am hacked and put me to reset password), SuspiciousServices() - errors and system crashing PowerManager service mantaining svchost.exe, *complete execution STOP of any installer after 2-3 uses making it unusable - basically, after i install a certain software repeatedly after 2 -3 times, that particular installer is blocked. I managed to unblock it by deleting it, and taking its original from a zip and running it again but the same routine was true, after 2-3 executions, it got blocked again. I can change it with it's original from zip again after that again and again.

remember, the point here is not to clean windows, but to find the source of the virus in D drive. My windows7 was clean 8 times after windows7 installation but he got infected in the first 2 minutes like that every time.

or at least what preventive measures i can take? To install a firewall or option ON the active defense from malwarebytes while im executing my installers?

well... thats the thing. How can i test if is dead? My only way to test it, is to install something from D drive. It's the only source. I was thinking, maybe indeed there are some already infected installers, that i already downloaded some weeks ago infected like that OR they got mutated OR some kind of "system" file that is read automatically by some "shell" program from windows... my imagination got wild here but is all i can think of. Should i try the same installers now? Or just wait for you and do absolutely nothing? What are my options? I will definitely not download anything from internet these days. But to test your solution, i have to execute my "routine" installers.

Mello mister Ron, and thank you for your help. I did exactly what you ask me to do. I will listen to you and wait these days without installing anything. Here is the result: Fixlog.txt

how i manually unvirus it: in Services - "Power Manager" i make it Disabled i search in regedit after "PowerManager" and delete the whole folder with it. Restart PC C:\Windows\svchost.exe (hidden) and delete it. But even if i do that, after a new execution of (i want to believe CERTAIN) installers from D drive, all this cleaning i did is worthless. All reapear again as before like phoenix from the ashes. The same goes for MB. After it finds and clean, a new installer from D drive will fill back the virus locations with the same files. It should be a root of the virus. Can you explain to me what [CAN] it be? I really want to understand the mechanics behind it, and im certain you encounter this kind of thing in the past.

MBupdates = done MBThreat Scan = done MBscanLog = yes AdwCleaner download/install = done AdwCleaner update = no such option* AdwCleaner scan - restartPC- clean. Farbar downloaded = ok scanLog = yes 5_1MBscanLog.txt 5_2AdwCleaner[S00].txt5_2AdwCleaner[C00].txt FRST.txtAddition.txt

In d:\System Volume Information\ i find this file tracking.log, heavily encrypted that my procmonitor point it to my totalcomander NOW, but im sure i've catch svchost.exe reading/writing from it like 50 times per second. But im afraid this virus is using poor totalcomander like a puppet now. I think is the virus making it because in my life i never seen that "tracking.log" in that folder, and i use totalcomander for a long time. Ai ai ai.... This is black majik, i tell you. 4_tracking.log hidden from System Volume Information.zip

here is when is firing - i mean, after i just executed an installer (in this case 7z vers1602.exe archiver) what is curious is that is 1- creating File, 2-Query information; or Set Information, 3-read file, 4-close file. And is loading some "images" - most probably some copies of himself in different directories. . . . Also, imediatly after i executed the installer, its using some sort of command line inside an environment... at this point im lost... but i kind of getting it. He is using some sort of shell thing. I really hope all this is helping you somehow.

it will be BEST for us to be able to edit the posts we are making here, because if i mistake something ill have to add another answer and it will aglomerate the page. Not very smart not having that option. 2_windowsBasicVirus MB-ScanLog.txt Here is the scan log from that first windows scan:

mode in depth action i did so far, please look at All the pictures i made. This is a screenshot of basic scan immediately after i just installed a fresh windows. But also after i installed the malwarebytes from D drive too and is very probable this action was initiating the virus. But i managed to effectively clean the C drive, restart computer, and scan again. It takes 20seconds to find this 4 findings. I also manually looked into c:\windows folder to spot if its anything there and it was clean. But, if i installed some other (random) installer from D drive... the svchost.exe reappeared in c:\windows folder again, under my eyes. I dont have to scan it, i just keep that folder open and see when something is reappearing there. This is 1 step i did to learn more about this virus.

Hello again. I want the discussion to continue please. We had another discussion about the same thing, but much earlier, before i decided to clean D drive and to reinstall windows7. I will explain summarily here what i did so far after that discussion. I really thought i could solve it with a clean windows installation. I installed 8 windows-es so far, one after another. 4 times the same as original i had before, and 2 other new w7's. I learned to spot when C:\WINDOWS\SVCHOST.EXE appeared. I truly believed the windows i had was infected from the start. I scanned very early after installation of windows , and i saved the log too(i put it here in this post). I made my own log to keep track of what the hell is going on. The conclusion is worse than i imagined. It looks like all the installers i have on D drive are "infected" somehow, INDIFERENT of the Operating system!!!! Every time i execute any installer from D drive, virus is loose in the freshly (10 seconds finished ago) windows installation, (i only installed from windows7 family). - not xp or w10. My brain is on complete pause now. I am hopeless. This is the most aggressive virus i had ever and i usually didn't give them too much attention since i can clean them manually or from a simple scan with any AV... But still my preferred AV is malwarebytes so far. I really have no idea how is functioning this one. After a fresh windows installation, and also after 20 seconds of scanning, MBav finds the folowing: Process: 1 Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE Module: 1 Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE Registry Key: 1 Trojan.Agent.E.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PowerManager File: 1 Trojan.Agent.E.Generic, C:\WINDOWS\SVCHOST.EXE (But i installed malwarebytes antivirus from my D drive so... now i understand that C got infected from this simple execution.) Oh, i put inside a zip file (hopefully) an infected installer that i watch it generate the SVCHOST.EXE when i execute it. I observed some installers are creating the svchost.exe, and some don't...or worse, it's a delay execution maybe? I can send it to you for analyzing when you have the pleasure. Also, i find in D drive System Volume Information folder a "tracking.log" file that is created by svchost (im sure its from it - i watch it with ProcessMonitor) and unfortunatly is encrypted but i made also a zip file with it in it. Also i thought is good to send it to you for analyze. I can screenshot everything i said here to prove im not talking from imagination. All that i want is very simple. To be able (as before) to execute any one of my installers from D drive, and not get virused from that action. Also, to keep all my installers intact. I dont want to delete them. I copy all the folder named "Programe" that contains all the installers, to a external hard drive as a backup and it helped immensely because i sometimes dont think at all and just press delete. After that i am very sorry i did it. But with a backup, im again at peace. I think this virus is behaving like a shell somehow... and i think you mention it in our first forum discuttion. We must neglect the "infections" that the antivirus finds, and somehow spot the root that is causing these infections. I dont know, it's a thought. You are way more qualified to decide what i should do. Thank you so much for your kind support so far.

Yah, I am actually a Firefox user from it's beginings. Chrome is for childrens, but very good for immediate problems to resolve if you dont have the 'master' browser installed. I just find out about Firefox Developer Edition. Its version 68 now and its allowing Extensions, that i'm actually after, to make it as personal as before, but i do a big fight with this aspect since they literally changed all the old file extensions. I barely could import my old data into the new 'format' if you like. But too much about firefox on a AV forum. I will take your advice and look into NoScript and uBlock Origin that you mentioned, soon enough! And I am backing up all my software now. I got a memorable experience and i have space too on my ext hdd. You didnt told me about "mutating viruses". True or false? or in the middle somewhere? Because if its True, we are truly in real danger with our files. Just saying. Yah. thats it. I will (maybe) reply after reading your sugested literature. We'll see.

Thank you so much mister Ron. Your help is really an eye opening and it was a pleasure to get advice from you. Really. But i was panicking more and more, since this infection i got was much aggressive by the minute. Truly, I had to react quickly enough since everything i was doing was starting to be intercepted and I was overwhelmed and very scared too. Scared for my D drive installers, not for windows files. I talked with some programmers on a forum i circulate, and i trust them enough. They suggest me to reinstall windows quickly and not dangle around too much. I knew it too, but i tried to understand it better. Virus 1, me 0. So... I reinstalled my windows now, all the software from D drive are very fine. I mean, some have some cracks in them and (MAYBE) they are a bit corrupted but super easy to scan and clean after them if is the case. I will give you a personal quest to try. In my search for an alternative Firefox, like 1 year or so ago, i installed Waterfox browser. From that moment, i've always had a ton of weird movement in my system. I observe it little by little, in time. Nothing serious for a long time. But i think that thing is a portal from a hacker. Its my subjective impression and i can be wrong. I think i am not but, thats the quest for you. Try to find out if its something dubious with that application or not. If im wrong, then shame on me not seeing too well the obvious. But... all my money on that, yes. And also other risky stuff i installed too, but that thing, ah... I swear. Another wild curiosity... is there such a thing like a " mutating virus" ? That is not only atacking/or/attaching to some installers/executables, but read the target, analize it, and modify its structure from inside? Is this a possibility today or is a nice imagination meant to scare the crap out of undocumented? Again, it was a pleasure to communicate with you, and im sorry to interrupt our little hunt.