Ashwin1996 Posted August 3, 2020 ID:1398628 Share Posted August 3, 2020 Hi, I am having free avast antivirus as my antivirus and never sees things popping up in virus chest but in the past two days i have seen this ****temp.exe(gB94f.tmp and gDac5.tmp) file popping up.I don't know what it is and even after deleting it keeps coming after every restart,as it comes up and sits in the temp folder.Kindly help me either remove it or to find whether it is an false alarm Windows 7 Hp laptop Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 3, 2020 Root Admin ID:1398661 Share Posted August 3, 2020 Hello @Ashwin1996 Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes installed yet please download it from here and install it. Once installed then open Malwarebytes and select Scan and let it run. Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know in your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Attach or Copy its content into your next reply. STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here. Please attach the Additions.txt log to your reply as well. Thanks Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 3, 2020 Author ID:1398678 Share Posted August 3, 2020 Hi Team, I have attached the logs(reports) of the completed scan 7 scans detected and all were quarantined Please advice further 3-08-2020.txt Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 4, 2020 Author ID:1398866 Share Posted August 4, 2020 Hi Team, Attached are the logs for Farbar Recovery Scan Tool which was done today FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 4, 2020 Root Admin ID:1398867 Share Posted August 4, 2020 Were you able to run AdwCleaner and get that log @Ashwin1996 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 4, 2020 Root Admin ID:1398868 Share Posted August 4, 2020 The FRST logs are not complete. Please post back original files or run the scan again. Thank you Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 4, 2020 Author ID:1398882 Share Posted August 4, 2020 Hi, I have done the AdwCleaner scan and the logs are attached below( AdwCleaner[C00].txt & AdwCleaner[S00].txt ) I don't know whats wrong with the first logs which was scanned by malwarebytes 4.1.2.73 trial software but it had 7 quarantined file and all were deleted.That might be incorrect as i already ran an scan following one of your forums and i have described it below for your understanding Before all of this i have ran another scan with mbar-1.10.3.1001-nr.exe following the above forum and have got some 73 files detected and deleted.I have attached the logs of that as well( mbar-log-2020-08-03 (14-11-38).txt & system-log.txt ) Finally i ran an scan in Malware bytes this morning and found no threats( 04-08-2020.txt ) Hope this gives an complete and thanks in advance man for all this. FYI.......gB94f.tmp and gDac5.tmp file are not popping up anymore in the Temp folder as before😊 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 4, 2020 Root Admin ID:1398887 Share Posted August 4, 2020 Okay, quite late for me, but please go ahead and run the following antivirus can. Make sure you temporarily disable your current antivirus. It's late for me so I'll check back on you some time tomorrow Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking. I would suggest a free scan with the ESET Online Scanner Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get it started. When presented with the initial ESET options, click on "Computer Scan". Next, when prompted by Windows, allow it to start by clicking Yes When prompted for scan type, Click on Full scan Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button. Have patience. The entire process may take an hour or more. There is an initial update download. There is a progress window display. You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log. If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom). Press Continue when all done. You should click to off the offer for “periodic scanning”. Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 5, 2020 Author ID:1399163 Share Posted August 5, 2020 Hi, i have ran the Scan with ESET and attached the logs below Surprisingly found 8 more files and deleted them Please advise further ESET.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 5, 2020 Root Admin ID:1399168 Share Posted August 5, 2020 Okay, perhaps we should go ahead then and run another 3rd party antivirus scanner from Kaspersky too. Please download and run the following Kaspersky antivirus scanner to remove any found threats Kaspersky Virus Removal Tool Let me know if it finds anything or not I'll check back on you again sometime tomorrow. Cheers Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 7, 2020 Author ID:1399553 Share Posted August 7, 2020 Hi, I have done the kaspersky scan and have got one infected file but have cured it(Don't know whether that's the right thing to do) In the second scan(Full) it found nothing and i have attached the SS of both the scan results Please check and let me know Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 7, 2020 Root Admin ID:1399578 Share Posted August 7, 2020 Great glad it was able to find and remove. Let's go ahead then and re-run all three steps again and get me new logs please. Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes installed yet please download it from here and install it. Once installed then open Malwarebytes and select Scan and let it run. Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know in your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Attach or Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here. Please attach the Additions.txt log to your reply as well. Thanks Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 8, 2020 Author ID:1399826 Share Posted August 8, 2020 Hi, I have followed all 3 steps and shared the logs below Addition.txt AdwCleaner[C01].txt AdwCleaner[S01].txt FRST.txt Malware bytes.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 9, 2020 Root Admin ID:1399944 Share Posted August 9, 2020 Thank you for the logs. For now, let me have you temporarily uninstall the following software. Once we're done you can decide if you want to reinstall it or not. Please go to Control Panel, Programs, Uninstall µTorrent Avast Free Antivirus Sophos SSL VPN Client 2.1 Your computer platform is listed as: Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States) You have the following Russian software version installed. May I ask why you're using Russian and not English? Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012 Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012 Please temporarily set up Google Public DNS as your DNS servershttps://developers.google.com/speed/public-dns/docs/using Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 9, 2020 Root Admin ID:1399945 Share Posted August 9, 2020 Once you have completed the items above please go ahead and run the following updated fix file Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work. Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more. NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. fixlist.txt Thanks Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 10, 2020 Author ID:1400187 Share Posted August 10, 2020 Hi, I have uninstalled all the below software's and changed my DNS to the Google DNS as suggested Regarding the russian language pack i actually installed an game called Empire : Total war and many said it was in russian language.So i installed the language pack externally or it might have something which came up with the game setup itself(not sure) Download Link: http://oceanofgames.com/empire-total-war-free-download-8338918/ Is that the root cause of all this issues???Is it fine to keep that russian software or something I have attached the logs after the restart as well.Please go through and suggest as therer is no antivirus currently in my system can i install the Avast back..Can i keep avast and Malware bytes together? On 8/9/2020 at 8:52 AM, AdvancedSetup said: Thank you for the logs. For now, let me have you temporarily uninstall the following software. Once we're done you can decide if you want to reinstall it or not. Please go to Control Panel, Programs, Uninstall µTorrent Avast Free Antivirus Sophos SSL VPN Client 2.1 Your computer platform is listed as: Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States) You have the following Russian software version installed. May I ask why you're using Russian and not English? Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012 Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 That translates to: Language Pack to Support Hosting of the Microsoft Visual Studio Tools for Working with Applications 2012 Please temporarily set up Google Public DNS as your DNS servershttps://developers.google.com/speed/public-dns/docs/using Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 10, 2020 Root Admin ID:1400272 Share Posted August 10, 2020 No, it's okay to have the Russian Language Pack. Just wanted to make sure it was installed on purpose and not some fake installer. From the log: Windows Resource Protection found corrupt files but was unable to fix some of them. We can review again once we're done cleaning Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking. This time it should come back clean. I would suggest a free scan with the ESET Online Scanner Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get it started. When presented with the initial ESET options, click on "Computer Scan". Next, when prompted by Windows, allow it to start by clicking Yes When prompted for scan type, Click on Full scan Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button. Have patience. The entire process may take an hour or more. There is an initial update download. There is a progress window display. You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log. If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom). Press Continue when all done. You should click to off the offer for “periodic scanning”. Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 11, 2020 Author ID:1400431 Share Posted August 11, 2020 Hi, Please find the attached scanned logs of ESET scan and fortunately didn't find anything harmful in the 2 hours scan 11-08-2020.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 11, 2020 Root Admin ID:1400587 Share Posted August 11, 2020 Great, that's good news. How is the computer running now? Are you still having any issues? Link to post Share on other sites More sharing options...
Ashwin1996 Posted August 12, 2020 Author ID:1400612 Share Posted August 12, 2020 Not that I can think off....It's pretty Good and in temp the files didn't appear back So it's all good I guess and the speed of the computer is increased a bit Which is a great take away from this On top of everything please suggest me a good antivirus for free and as of now I have Avast free anti virus.. Let me know if something has to be checked further Thank you so much for your wonderful support Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 12, 2020 Root Admin ID:1400614 Share Posted August 12, 2020 On Windows 7 there are not a lot of options. The Windows Defender is not the same product as it is on Windows 8 and 10 I would suggest you go ahead and reinstall a fresh copy of Avast if you have not already. If or when you do decide to go with Windows 10 then Windows Defender with Malwarebytes is a pretty good combination I'll go ahead and close your topic and it will leave you with a link for ways to better protect your system and privacy. Go ahead and bookmark the site and as you have time try to read up on some of the information. Take care and stay safe out there and thank you for the kind words Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 12, 2020 Root Admin ID:1400621 Share Posted August 12, 2020 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts