Jump to content

Programs won't run, I think that my computer is infected

Ger28

By Ger28
in Resolved Malware Removal Logs

 Share

Recommended Posts

Ger28

Ger28

Posted
Posted

A few weeks ago, I installed an app called "Salad.io" which made my computer unusable. I tried to run many programs (Malwarebytes, AdwCleaner), AdwCleaner and FRST were the only ones that worked in Safe Mode. Salad.io didn't want to uninstall, and one time it worked, only to see in the FRST logs remains of it. I can't run anything as administrator. AdwCleaner reported no detection.

Addition.txt

FRST.txt

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Hello   :welcome:

Please start with these steps.  

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[    2    ]

Please download Rkill from this link and save to your Desktop:

http://download.bleepingcomputer.com/grinler/rkill.exe

 

  • Double click on Rkill.
  • A command window will open then disappear upon completion, this is normal.
  • Please post the log   if you can

Just let me know if this did run.

[     3     ]

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  FULL scan.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
  • Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
  • We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.   This step is not a cure-all.  We have much more work to do later.  Stick with me.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • ...things can go very wrong!
  • Backup
  • any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a USB-storage drive or flash/thumb drive
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Please stick with me until I give you the "all clear".

Your topic will be closed if you haven't replied within 4 days!
If I have not replied to your last post after 36 hours, please then send me a P M.

 

Next, a custom script to do other checks & some  cleanups.

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Ger28  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will run the Windows DISM tool to check the system.  It will rebuild the Winsock.  

It will attempt to update the Windows Defender antivirus and to run a quick scan in batch mode & to get a diagnostic readout of its status.

It will remove Salad.exe  if it is found present.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

  •  
  • Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

  • If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
  • Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder

Fixlist.txt                  <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.


RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  This here is not a one-shot-cure-all.  There will be more to do later.  Stick with me.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

There is more cleanup to do. There are 3 folders listed as "exclusions from scanning" on Windows Defender that we need to remove from the list.

Next, a custom script to do other checks & some  cleanups.  Please first, Delete the old-saved file named Fixlist.txt  on Downloads folder.

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Ger28  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  It will attempt to update the Microsoft Defender antivirus and to run a quick scan in batch mode & to get a diagnostic readout of its status.

It will remove 3 exclusions from the list of exclusions on Microsoft Defender.

 

  •  
  • Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

  • If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
  • Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder

Fixlist.txt                 <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.


Double click on FRST64.exe     and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.  This here is not a one-shot-cure-all.  There will be more to do later.  Stick with me.

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted (edited)

a)  Just try to start FRST in Normal mode  without attempting to run as administrator.  Just double click to start then follow my procedure.

B)  IF that is entirely not possible, then Yes run the procedure in Safe mode.

Edited by Maurice Naggar
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Thank you.  That is a good run.  The path exclusions on Microsoft Defender are now all gone.  You should be able to run Microsoft Defender antivirus at your decision. 

This ought to take something in the range of 15 - 25 minutes tops, depending on hardware speed.

get & run the Malwarebytes MBAR anti-rootkit tool to do 1 run with it.

Disregard the title subject of the topic.

 

Run the MBAR tool as listed here 

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes

 

when done, I need the MBAR logs.

Upon completion of the scan or after the reboot, two files named mbar-log.txt and system-log.txt will be created.

Both files can be found in the extracted MBAR folder on your Desktop.

Please attach both files in your next reply.

[   2    ]

This is just a tool to generate an information / diagnostic report.

RSIT (Random's System Information Tool)

Please download RSITx64 by random/random... save it to your desktop.

http://images.malwareremoval.com/random/RSITx64.exe

  • Double click on RSITx64.exe to start it. If Windows UAC prompts you, please allow it.
  • Please read the disclaimer... click on Continue.
  • RSIT will start running. When done... 2 logs files...will be produced.
  • The first one, "log.txt", <<will be maximized... the second one, "info.txt", <<will be minimized.
  • Please attach both... "log.txt" and "info.txt", files with your next reply.

 

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Good morning.  I am adding a additional run here;  Just make real sure you first, complete those 2 I listed above ^ ^ ^ ^ ^  !  

Please download the following scanner from Kaspersky and save it to your computer: TDSSkiller

Then watch the following video on how to use the tool and make sure to temporarily disable your security applications before running TDSSkiller.

PC Winvids - How to run Kaspersky TDSSKiller

  • If any infection is found please make sure to choose SKIP and post back the log in case of a False Positive detection.
  • Once the tool has completed scanning make sure to re-enable your other security applications.

Thank you

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Hello. Thank you. This pc has a very very old & insecure Java 8 Update 51 which we need to uninstall. It also has HitmanPro installed & appears active. To remove potential conflicts, we need to also uninstall that.
1. Press & hold  the Windows key on keyboard & then tap the R key   to open the Run box-window.
2. Type

appwiz.cpl


and tap Enter.
The Programs and Features window will appear.   Locate on the list "Java 8 update 51".

Do a right-click on it.  Then choose Uninstall.   Let it proceed.
Next, Locate on the program list "HitmanPro".
Do a right-click on it.  Then choose Uninstall.   Let it proceed.

Exit Programs and Features, when done.
Now do a Windows Restart.
On your next reply, Be sure to tell me if Windows is now in normal mode.  We will do more. I simply just need to insure we can use normal mode.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Be sure you complete all the steps in my preceding reply.   ^  ^  ^

We start some work to be done while Windows system is in normal mode.  The first parts anyway.
Then, next, study and do the steps on this special guide at this link
https://forums.malwarebytes.com/topic/272765-run-farbar-recovery-scan-tool-frst-from-recovery-mode-on-windows-10/

We need to get & save the Media Creation tool for Windows 10
Do the run to make it on a USB-flash-thumb drive
Then get FRST64.exe onto that same USB
Follow the directions on article to Boot the system off that USB-flash.  This is where you get the system to a Recovery Environment mode.
then run a report run with FRST64
Insure the run completes.
When done, the FRST.txt + Addition.txt  will be on that USB-flash
Then remove the USB from the slot
Then Restart the pc back to normal mode
Then upload ( attach ) the FRST.txt + Addition.txt  into a new reply here on this topic.
This should provide me a fresh more complete report that I hope to use to help you along.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.