Jump to content

I have a computer that is probably infected

huntsin2
 Share

Recommended Posts

Aura

Aura

Posted
Posted

Hi huntsin2 :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
  • As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread


This being said, it's time to clean-up some malware, so let's get started, shall we? :)

zcMPezJ.pngAdwCleaner - Fix Mode

  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    V7SD4El.png
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

RQKuhw1.pngRogueKiller

  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply

Your next reply(ies) should therefore contain:

  • Copy/pasted AdwCleaner clean log
  • Copy/pasted RogueKiller clean log

Link to post
Share on other sites
Aura

Aura

Posted
Posted

iO3R662.pngFarbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

  • Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
  • Right-click on the FRST executable and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Fix button
    NYA5Cbr.png
  • On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
  • Copy and paste its content in your next reply

fixlist.txt

Link to post
Share on other sites
huntsin2

huntsin2

Posted
  • Author
Posted

I realize you probably haven't had a chance to respond just yet but after doing some research I came across a link talking about diagnosing items in the device manager. And a link with someone who has a similar issue that I noticed.

https://www.techsupportforum.com/forums/f19/solved-problems-with-security-processor-loader-driver-999554.html

If it is ok with you I would like to try this fix to see if it works.

Would that be ok?

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Are you referring to this? 

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

If so, we could try. What's the computer/laptop brand and model?

Link to post
Share on other sites
huntsin2

huntsin2

Posted
  • Author
Posted

I uninstalled the Security Processor Loader Driver. I then scanned for changes to hardware, but it did not reinstall that driver. I went ahead and installed the video driver that I downloaded from Dell. However, I did a clean boot and the computer is still frozen like before.

One thing I will note though is that the on screen keyboard came up. This had been coming up in safe mode but not the normal boot.

Link to post
Share on other sites
huntsin2

huntsin2

Posted
  • Author
Posted

I have a video of the startup so you can see if you are interested. It's about 3 min 30 sec long. It is a normal, clean boot. 

In the video the iTunes desktop icon is visible but the graphic for it never shows and the Malwarebytes one doesn't either. I can move the mouse, but if I try clicking on the Start button nothing happens. I am actually surprised the scroll over effect showed up when moving the mouse over the taskbar icons. But as you may see the wireless connection never displayed that it had a connection, it just showed a circle that it was loading.

One thing that I will mention is that I did do a diagnostic test when I first got the machine. There was an error recorded with the hard drive. However, the computer boots and works fine in Safe Mode with Networking. But maybe a normal boot even a clean one is too much for the hard drive.

Link to post
Share on other sites
huntsin2

huntsin2

Posted
  • Author
Posted (edited)

I went into the BIOS on my own and there was a diagnostic tool in there and I selected it and it went through various tests of the machine.

Here is what I wrote down about it

"Error

Error Code 2000-0142

Msg: Hard Drive 0 - S/N 5WX31Q1M

self test unsuccessful. Status = 7"

Results page showed

"Hard Drive 0 - DST Short Test

Test Results: Fail

Error Code 2000-0142

Validation 25993

Msg Hard Drive 0 - S/N 5WX31Q1M

self test unsuccessful. Status = 7"

I did find this page regarding the issue

https://www.dell.com/community/Laptops-General/Hard-Drive-Failed-during-diagnostic-Error-Code-2000-0142/m-p/4010353#M695053

Edited by huntsin2
Link to post
Share on other sites
Aura

Aura

Posted
Posted

Looks like everything points to a faulty hard drive. We can run GSmartControl as well, though I trust a self-test more than a test ran under Windows.

S8ANNnz.pngGSmartControl
Follow the instructions below to test your hard drive health with GSmartControl:

  • Download GSmartControl and save it on your Desktop;
  • Extract the content of the GSmartControl .zip archive and execute gsmartcontrol.exe;
  • Identify your drive in the list, and double-click on it to bring up it's window (usually you'll find your drive by it's size or it's brand name);
  • Go in the Perform Tests tab, then select Extended Self-test in the Test type drop-down list and click on Execute (this test can take a few hours to complete);
  • Once the test is over, the results will be displayed at the bottom of the window. Please copy and paste these results in your next reply;
  • Also, go in the Attributes tab and if you have any entries highlighted in red or pink, copy and paste their name in your next reply (or take a screenshot of the GSmartControl window and attach it in your next reply);
    info_failing.png

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.