Malwarebytes/McAfee protection wont turn on. Desktop.ini show up everywhere

[Darris812]

Hi guys. I read through the recent topic and search option and haven't found a similar issue so allow me to create my own topic. 

 

First of all, I have a new laptop ASUS X441S (Intel 4core 3710 1.6ghz, Win10). It came with a preinstalled McAfee Antivirus premium. I scanned my old external hard drive and found 4 infections. I quarantined it then suddenly all hell broke loose. I started to notice that McAfee cannot run a scan anymore and it cannot turn real-time protection on anymore. I also noticed 2 desktop.ini files that suddenly appeared on my desktop and in all folders.  I downloaded Malwarebytes, which was able to scan my pc but showed no infections; however, malwarebytes cannot turn real-time protection on as well. I think I'm infected with a malware that turns off my antivirus sofwares and spreads this desktop.ini file on my system. Please help me. 

[Darris812]

I've also already tried various tools like adwcleaner, rootkit remover but shows nothing. I can't even restore or reset my PC anymore. I'm pretty sure this is a malware. My PC even significantly slowed. Please help.

 

[kevinf80]

Hello Darris812 and welcome to Malwarebytes,

Quote

A Desktop.ini file is a file that determines the way a folder is displayed by Windows. These files can be found in any folder, anywhere on your computer, as long as that folder has a custom appearance set for it. Desktop.ini files control things like the icon used for that folder and its localized name.

Those files you mention only show when when a default setting has been altered, that may have been altered by software you have downloaded, inadvertently by yourself, or possibly by malware.

https://support.microsoft.com/en-gb/help/14201/windows-show-hidden-files

Run the following scan and post the two produced logs:

Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Thank you, Kevin

[kevinf80]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks