Jump to content

Suspicious Folders "igfxmtc" and "avrpezi" in my AppData\Local Folder

Krytrephex

By Krytrephex
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @Krytrephex and :welcome:

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted


Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

Thanks

Ron

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please try to restart in Safe Mode with networking or try to copy the program via USB from another working computer.

If that does not work then try do a System Restore before you last night and it should return the computer back to the way it was.

Let me know.

Ron

 

 

Link to post
Share on other sites
Krytrephex

Krytrephex

Posted
  • Author
Posted (edited)

I downloaded the .txt file on another computer, included it in the drive of a USB, and transported it to the infected computer all successfully.

I've moved both the FRST64 and the fixlist to my desktop.

FRST64 notified me that it was up-to-date, and the fix was apparently completed instantly. I suppose no restart was necessary. I've attached the fixlog.txt.

 

Fixlog.txt

Edited by Krytrephex
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

You appear to have the smartservice rootkit on this computer. Do  you have access to a known clean computer?

It's very late for me so I'm heading to bed, but will check back on you in the morning. We will need to boot into the Recovery Safe Mode and run a scan from a USB stick but it will need to be created from a clean computer.

Ron

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted (edited)

You will need at least a 4GB USB stick. One can be had online pretty cheap. But, let me check on some other methods and see what we can do. We might be able to attack it from it's own Safe Mode. If not, then we'll need at least a 4GB USB stick. If getting one though I'd recommend an 8GB price difference is not much.

Will check back tomorrow

Do not use this computer for any type of financial or important transactions.

Ron

 

Edited by AdvancedSetup
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Great, okay. Please do the following.

 

Okay, so I need you to do this from another computer. You cannot use the infected computer as the infection will detect it and mess it up.

In the instructions below you will boot into the Recovery Mode. DO NOT put the USB stick into the infected computer until after you get into the Recovery Mode, then insert the USB Stick.

If you can get into the Recovery Mode on it's own with the infected computer your 2GB USB stick is fine. You only need the FRST program on it from a clean computer.

 

 

Pease download Farbar Recovery Scan Tool and save it to a USB flash drive.

Note: You need to run the version compatible with your system.

You can check here if you're not sure if your computer is 32-bit or 64-bit

Plug the flash drive into the infected PC  AFTER you start the computer into the Recovery Options for Command Prompt.

Windows Vista, 7

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

Windows 8, 8.1
Please see
How to use the Windows 8 System Recovery Environment Command Prompt

Windows 10
Please see
How to Start Windows 10 in Safe Mode with Command Prompt

How to Boot to Advanced Startup Options in Windows 10

Note: In case you can not enter System Recovery Options by using F8 method, you can use a Windows installation disc, or make a repair disc.
Any Windows installation disc or a repair disc made on another computer can be used.
Choose one of the options below to download and create a Windows Repair Disk or Installation Disk. Either one can be used.

How to Create a Windows 7 System Repair Disc
How to Create a System Repair Disc in Windows 10
Microsoft Windows and Office ISO Download Tool

You may also download from Microsoft but you will need to input your license key first. The above links do not require your key

Download Windows 7 Disc Images (ISO Files)
Download Windows 8.1
Download Windows 10

 

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

  • Startup Repair
  • System Restore
  • Windows Complete PC Restore
  • Windows Memory Diagnostic Tool
  • Command Prompt
  • Select Command Prompt

Once in the Command Prompt:

  • In the command window type in notepad and press Enter.
  • Notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
  • Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to the disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

 

Thanks

Ron

 

 

 

 

 

Link to post
Share on other sites
Krytrephex

Krytrephex

Posted
  • Author
Posted

Most methods of entering Advanced Startup were not working (i.e., from Microsoft settings, shift-clicking restart from sign-in screen). All of these methods would simply restart the computer normally without any options for Advanced Startup.

I tried using command prompt as described here (under "OPTION SEVEN"), and that command—which was 

shutdown /r /o /f /t 00

—also didn't work. 

 

I eventually inputted a different command into the prompt as described here, using the commands 

bcdedit /set {default} safeboot minimal
bcdedit /set {default} safebootalternateshell yes

I restarted my computer after inputting these commands, and after I signed in after the restart, only the command prompt was shown—without the desktop. I assumed that this is what is desired.

I ran FRST64.exe (which is the appropriate one for my infected computer) from the directory of the flash drive, and the scan completed. The FRST.txt is attached.

FRST.txt

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

That was the Safe Mode Minimal, it is not the Recovery Environment so the fix was not made.

If none of the options allow you to get into Recovery Mode, then you'll need to build a Windows 10 or Windows 7 bootable USB stick to boot from that will allow you to run the Recovery Environment. Then copy the clean version of FRST onto the USB stick after you make it bootable.

It's possible that the Windows Recovery Environment was not installed on your computer and thus the need for building one of the disk above may be required.

https://www.terabyteunlimited.com/kb/article.php?id=322

If you need more details please let me know.

Ron

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

I know it's a lot of information but how to do it is listed in my post #13. Read through it a couple times and if you still have questions please let me know. I'm going to be on the road for about an hour or so but will check back on you again a bit later tonight.

Ron

 

Link to post
Share on other sites
Krytrephex

Krytrephex

Posted
  • Author
Posted

Understood, I am currently downloading

 

4 hours ago, AdvancedSetup said:

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

Despite the fact that I am using a USB rather than a CD/DVD, I assume that the same instructions apply; is that correct?

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.