skitahoe5 Posted July 22, 2017 ID:1145042 Share Posted July 22, 2017 I scanned my Win7 with Malwarebytes after it experienced issues. 3 generic Trojans were found& removed. Cleanup / restart took overnight to run. My PC starts now but I always get a BSOD about 5 minutes after startup, even in Safe Mode. I've downloaded FRST & run. It doesn't finish before the reboot, logs are attached. I'd greatly appreciate any recommendations on next steps to recover. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Aura Posted July 25, 2017 ID:1146052 Share Posted July 25, 2017 Hi skitahoe5 My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state. As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens; As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you; The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system; If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!; If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off; Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced; I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules; In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process; I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread; This being said, it's time to clean-up some malware, so let's get started, shall we? Can you provide me the Malwarebytes log where the detection occurred, so I can review them? Link to post Share on other sites More sharing options...
skitahoe5 Posted July 26, 2017 Author ID:1146180 Share Posted July 26, 2017 Aura, Thank you for offering to assist. I will follow the guidelines listed above. I attempted to retrieve the malwarebytes log but my machine did not stay up long enough for the log to export. At this time it will make into safe mode for 3-5 minutes before experiencing a BSOD. On the restart attempt, it won't detect the hard drive. After being turned off for some time, it will detect the hard drive and boot into safe mode for the 3-5 minute window. Is there something besides the log file that can be used? John Link to post Share on other sites More sharing options...
Aura Posted July 26, 2017 ID:1146267 Share Posted July 26, 2017 If you can, .zip the content of the C:\Windows\Minidump folder (it'll contain a bunch of .dmp files), and attach it here. These are your BSOD crashdumps, and I'll see if I can identify what's causing them. Link to post Share on other sites More sharing options...
skitahoe5 Posted July 28, 2017 Author ID:1146877 Share Posted July 28, 2017 I am not able to locate any .dmp files in the above directory. I've attached a BSOD - I don't know that I have seen anything past the Initializing line. On a restart, no Hard Disk Drives are detected. When I wait more than 15 miuntes before attempting to boot, then the PC will detect the hard drive and boot. The other attachment is the directory listing of the C:\root drive. I think I started experiencing issues on 7/6. Link to post Share on other sites More sharing options...
Aura Posted July 28, 2017 ID:1147045 Share Posted July 28, 2017 (edited) Sadly without any logs (FRST) or minidump files (.dmp), there's nothing I can do. If you have access to another computer, are you able to remove the hard drive from the infected computer and plug it as a secondary hard drive on the second computer? Also, regarding your hard drive issue, it is entirely possible that your hard drive is currently failing and needs to be replaced. Have you tried doing a System Restore to an earlier date yet? Edited July 28, 2017 by Aura Link to post Share on other sites More sharing options...
skitahoe5 Posted July 28, 2017 Author ID:1147072 Share Posted July 28, 2017 I can check the hard drive from another pc. Is the FRST log in the initial post of any use for testing? I attempted a system restore but that was not successful. Link to post Share on other sites More sharing options...
Aura Posted July 28, 2017 ID:1147075 Share Posted July 28, 2017 Sadly the logs are incomplete and I cannot work with them. Plug the hard drive in another computer, and use GSmartControl to see if it's failing or not. GSmartControl Follow the instructions below to test your hard drive health with GSmartControl: Download GSmartControl and save it on your Desktop; Extract the content of the GSmartControl .zip archive and execute gsmartcontrol.exe; Identify your drive in the list, and double-click on it to bring up it's window (usually you'll find your drive by it's size or it's brand name); Go in the Perform Tests tab, then select Extended Self-test in the Test type drop-down list and click on Execute (this test can take a few hours to complete); Once the test is over, the results will be displayed at the bottom of the window. Please copy and paste these results in your next reply; Also, go in the Attributes tab and if you have any entries highlighted in red or pink, copy and paste their name in your next reply (or take a screenshot of the GSmartControl window and attach it in your next reply); Link to post Share on other sites More sharing options...
skitahoe5 Posted July 29, 2017 Author ID:1147356 Share Posted July 29, 2017 Aura, GSmartControl did not appear to detect failure / imminent falure by the attached results. GSmartControl_report.txt Link to post Share on other sites More sharing options...
Aura Posted July 29, 2017 ID:1147423 Share Posted July 29, 2017 Good. Now, are you able to run a scan with Malwarebytes against that hard drive, and provide me the log afterwards? Also, .zip the following folder from the problematic hard drive, and attach it here. C:\ProgramData\Malwarebytes\MBAMService\ScanResults Link to post Share on other sites More sharing options...
skitahoe5 Posted July 29, 2017 Author ID:1147472 Share Posted July 29, 2017 Malwarebytes scan results on the drive are attached MBytes-2017_0729.txt e10c4636-7488-11e7-b1f7-002170681d1b.zip Link to post Share on other sites More sharing options...
Aura Posted July 29, 2017 ID:1147480 Share Posted July 29, 2017 Hum. Can you .zip the whole MBAMService folder instead and attach it here? If it's too big, let me know. Link to post Share on other sites More sharing options...
skitahoe5 Posted July 29, 2017 Author ID:1147487 Share Posted July 29, 2017 The MBAM Service folder is 63 MB when zipped Link to post Share on other sites More sharing options...
Aura Posted July 29, 2017 ID:1147488 Share Posted July 29, 2017 You can upload it on SendSpace.com and PM me the download link. Link to post Share on other sites More sharing options...
skitahoe5 Posted July 29, 2017 Author ID:1147490 Share Posted July 29, 2017 The other 2 scan results present in the zip file are for other HD's from the machine that I am using Malwarebytes from, link sent via PM Link to post Share on other sites More sharing options...
Aura Posted July 29, 2017 ID:1147497 Share Posted July 29, 2017 From the logs you sent me, it seems that Malwarebytes mainly detected and removed files belonging to SlimCleaner. I don't see any of the 3 generic trojan detection you mentionned. Were the detection names really Trojan.Generic? or Generic.Trojan? Link to post Share on other sites More sharing options...
skitahoe5 Posted July 29, 2017 Author ID:1147498 Share Posted July 29, 2017 I am able to access the original scan files on the other machine, I should have gone to that drive instead of c:\ on the functioning machine. Attached is the log that detected the malware eac603e0-65e4-11e7-bab3-000000000000.zip Link to post Share on other sites More sharing options...
Aura Posted July 29, 2017 ID:1147499 Share Posted July 29, 2017 Yes, that log contain detection for SlimCleaner. It's not a Trojan, but a PUP. Removing it shouldn't prevent your system from running properly. Link to post Share on other sites More sharing options...
skitahoe5 Posted August 1, 2017 Author ID:1148167 Share Posted August 1, 2017 Thank you for the assistance Link to post Share on other sites More sharing options...
Aura Posted August 1, 2017 ID:1148244 Share Posted August 1, 2017 Did you manage to solve your BSOD issues? Link to post Share on other sites More sharing options...
Aura Posted August 4, 2017 ID:1149470 Share Posted August 4, 2017 Hi skitahoe5, Are you still with me? Link to post Share on other sites More sharing options...
skitahoe5 Posted August 6, 2017 Author ID:1150230 Share Posted August 6, 2017 I am, haven't solved the BSOD yet. My twins had swim lessons this week and work days were a little longer so I didn't have time to work with the machine. In Safe mode, the drivers load okay until this point: Loaded driver \SystemRoot\system32\drivers\disk.sys Loaded driver \SystemRoot\system32\drivers\avgbuniva.sys Loaded driver \SystemRoot\system32\drivers\avgbloga.sys Loaded driver \SystemRoot\system32\drivers\avgbidsha.sys Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter Did not load driver @nettun.inf,%teredo.displayname%;Microsoft Teredo Tunneling Adapter Did not load driver @hal.inf,%acpi_amd64.devicedesc%;ACPI x64-based PC Did not load driver @netavpna.inf,%mp-agilevpn-dispname%;WAN Miniport (IKEv2) Did not load driver @netrasa.inf,%mp-l2tp-dispname%;WAN Miniport (L2TP) Did not load driver @netrasa.inf,%mp-bh-dispname%;WAN Miniport (Network Monitor) Did not load driver @netrasa.inf,%mp-ip-dispname%;WAN Miniport (IP) Did not load driver @netrasa.inf,%mp-ipv6-dispname%;WAN Miniport (IPv6) Did not load driver @netrasa.inf,%mp-pppoe-dispname%;WAN Miniport (PPPOE) Did not load driver @netrasa.inf,%mp-pptp-dispname%;WAN Miniport (PPTP) Did not load driver @netsstpa.inf,%mp-sstp-dispname%;WAN Miniport (SSTP) Did not load driver HP Officejet Pro 8620 Did not load driver Fax - HP Officejet Pro 8620 Did not load driver HP Officejet Pro 8620 (NET) If I can get the machine to stay up long enough to disable AVG start up in MS CONFIG I will try that next. After the BSOD the PC doesn't see either HD or the optical drive on the restart Link to post Share on other sites More sharing options...
Aura Posted August 7, 2017 ID:1150626 Share Posted August 7, 2017 Yes, it's weird that Windows would attempt to load third-party drivers (AVG's) in Safe Mode, but couldn't load its own. Link to post Share on other sites More sharing options...
Aura Posted August 10, 2017 ID:1151730 Share Posted August 10, 2017 Hi skitahoe5, Are you still with me? Link to post Share on other sites More sharing options...
Aura Posted August 12, 2017 ID:1152567 Share Posted August 12, 2017 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts