gB94f.tmp and gDac5.tmp files after startup

[Ashwin1996]

Hi,

I am having free avast antivirus as my antivirus and never sees things popping up in virus chest but in the past two days i have seen this ****temp.exe(gB94f.tmp and gDac5.tmp) file  popping up.I don't know what it is and even after deleting it keeps coming after every restart,as it comes up and sits in the temp folder.Kindly help me either remove it or to find whether it is an false alarm
Windows 7 Hp laptop

[AdvancedSetup]

Hello @Ashwin1996

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Ashwin1996]

Hi Team,

I have attached the logs(reports) of the completed scan

7 scans detected and all were quarantined

Please advice further 
 

3-08-2020.txt

[Ashwin1996]

Hi Team,

Attached are the logs for  Farbar Recovery Scan Tool which was done today

FRST.txt Addition.txt

[AdvancedSetup]

Were you able to run AdwCleaner and get that log @Ashwin1996

 

[AdvancedSetup]

The FRST logs are not complete. Please post back original files or run the scan again.

Thank you

 

 

[Ashwin1996]

Hi,

I have done the AdwCleaner scan and the logs are attached below( AdwCleaner[C00].txt & AdwCleaner[S00].txt )

 I don't know whats wrong with the first logs which was scanned by malwarebytes 4.1.2.73 trial software but it had 7 quarantined file and all were deleted.That might be incorrect as i already ran an scan following one of your forums and i have described it below for your understanding

Before all of this i have ran another scan with mbar-1.10.3.1001-nr.exe following the above forum and have got some 73 files detected and deleted.I have attached the logs of that as well( mbar-log-2020-08-03 (14-11-38).txt & system-log.txt )

Finally i ran an scan in Malware bytes this morning and found no threats( 04-08-2020.txt )

Hope this gives an complete and thanks in advance man for all this.

FYI.......gB94f.tmp and gDac5.tmp file are not popping up anymore in the Temp folder as before😊

[AdvancedSetup]

Okay, quite late for me, but please go ahead and run the following antivirus can. Make sure you temporarily disable your current antivirus.

It's late for me so I'll check back on you some time tomorrow

 

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

[Ashwin1996]

Hi,

i have ran the Scan with ESET and attached the logs below

Surprisingly found 8 more files and deleted them

Please advise further

ESET.txt

[AdvancedSetup]

Okay, perhaps we should go ahead then and run another 3rd party antivirus scanner from Kaspersky too.

 

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

I'll check back on you again sometime tomorrow.

Cheers

 

[Ashwin1996]

Hi,

I have done the kaspersky scan and have got one infected file but have cured it(Don't know whether that's the right thing to do)
In the second scan(Full) it found nothing and i have attached the SS of both the scan results 
Please check and let me know 

[AdvancedSetup]

Great glad it was able to find and remove. Let's go ahead then and re-run all three steps again and get me new logs please.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Ashwin1996]

Hi,

I have followed all 3 steps and shared the logs below

Addition.txt AdwCleaner[C01].txt AdwCleaner[S01].txt FRST.txt Malware bytes.txt

[AdvancedSetup]

Thank you for the logs. For now, let me have you temporarily uninstall the following software. Once we're done you can decide if you want to reinstall it or not.
Please go to Control Panel, Programs, Uninstall

µTorrent
Avast Free Antivirus
Sophos SSL VPN Client 2.1
 

Your computer platform is listed as:  Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
You have the following Russian software version installed. May I ask why you're using Russian and not English?
 

Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012
That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012
 

Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012
That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012

 

Please temporarily set up Google Public DNS as your DNS servers
https://developers.google.com/speed/public-dns/docs/using

 

 

[AdvancedSetup]

Once you have completed the items above please go ahead and run the following updated fix file

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[Ashwin1996]

Hi,

I have uninstalled all the below software's and changed my DNS to the Google DNS as suggested

Regarding the russian language pack i actually installed an game called Empire : Total war and many said it was in russian language.So i installed the language pack externally or it might have something which came up with the game setup itself(not sure)

Download Link: http://oceanofgames.com/empire-total-war-free-download-8338918/

Is that the root cause of all this issues???Is it fine to keep that russian software or something 

I have attached the logs after the restart as well.Please go through and suggest as therer is no antivirus currently in my system

can i install the Avast back..Can i keep avast and Malware bytes together?
 

 

On 8/9/2020 at 8:52 AM, AdvancedSetup said:

Thank you for the logs. For now, let me have you temporarily uninstall the following software. Once we're done you can decide if you want to reinstall it or not.
Please go to Control Panel, Programs, Uninstall

µTorrent
Avast Free Antivirus
Sophos SSL VPN Client 2.1
 

Your computer platform is listed as:  Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
You have the following Russian software version installed. May I ask why you're using Russian and not English?
 

Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012
That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012
 

Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012
That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012

 

Please temporarily set up Google Public DNS as your DNS servers
https://developers.google.com/speed/public-dns/docs/using

 

 

Fixlog.txt

[AdvancedSetup]

No, it's okay to have the Russian Language Pack. Just wanted to make sure it was installed on purpose and not some fake installer.

From the log: Windows Resource Protection found corrupt files but was unable to fix some of them.
We can review again once we're done cleaning

 

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking. This  time it should come back clean.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

[Ashwin1996]

Hi,

Please find the attached scanned logs of ESET scan and fortunately didn't find anything harmful in the 2 hours scan

11-08-2020.txt

[AdvancedSetup]

Great, that's good news.

How is the computer running now?

Are you still having any issues?

 

[Ashwin1996]

Not that I can think off....It's pretty Good and in temp the files didn't appear back

So it's all good I guess and the speed of the computer is increased a bit Which is a great take away from this

On top of everything please suggest me a good antivirus for free and as of now I have Avast free anti virus..

Let me know if something has to be checked further

Thank you so much for your wonderful support

 

[AdvancedSetup]

On Windows 7 there are not a lot of options. The Windows Defender is not the same product as it is on Windows 8 and 10

I would suggest you go ahead and reinstall a fresh copy of Avast if you have not already.

If  or when you do decide to go with Windows 10 then Windows Defender with Malwarebytes is a pretty good combination

I'll go ahead and close your topic and it will leave you with a link for ways to better protect your system and privacy. Go ahead and bookmark the site and as you have time try to read up on some of the information.

Take care and stay safe out there and thank you for the kind words

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you