Jump to content

I tried everything but the virus is still present

AzizKharbouchi
 Share
Go to solution Solved by Maurice Naggar,

Recommended Posts

AzizKharbouchi

AzizKharbouchi

Posted
Posted

Hello everyone!

so my pc has a virus and i can't identify the type of virus

I know C:\WINDOWS\sysWOW64\explorer.exe is a normal Windows application but I think the virus might have changed it to malware

so mrt scan stops exactly at this explorer.exe (picture below)

i tried doing a malware bytes scan but it also stops at one file as well

Microsoft Update and Microsoft Defender not working at all (buggy)

i also tried lots of malware removal tools but nothing worked (rkill, norton power eraser, hitman pro....)

btw my brother pc is also having the same issues (we are connected to the same wifi)

I have also tried reinstalling windows without deleting my personal files, as soon as the installation is complete I tried doing a scan with windows defender and malware bytes (it worked and it said I didn't had nothing on my pc) but when i connected my pc to the internet and tried to update windows, it started downloading updates at first but after a few minutes it stopped and started bugging and not working .

also Since the virus entered my system, the fans started spinning faster than normal

i have put down bellow a zip file with all the logs from MB support (if it can help someone !)

any help will be so much appreciated !

thanks in advance !

image.png

mbst-grab-results.zip

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Hello :welcome: @AzizKharbouchi

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.
  • Like 1
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Stop making changings on your own. No more Windows re-install or such. You had mentioned you ran 3 or so other different tools. Please no more. I will guide you. AND NO we cannot consider a upgrade to Windows 11 in a situation such as this. Please wait for my guidance. I typically have folks run a known and trusted set of tools. Have INIFINITE patience. There is NOT a magical single-silver-bullet solution ! 

If possibly you have a browser issue, can you try using a different web browser?
But in any event, always SAVE the downloads I guide you to. Then after download is complete, you go to the file using File Explorer.
and only then, launch it from there.

Let's do one special run  with Malwarebytes Adwcleaner. 
 
It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button.
 
First download & save it
 
Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. There are a few first choices to set as I have listed below.
 
Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.
 
When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status 
Delete IFEO keys
Delete tracing keys
Delete Prefetch files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock
Reset HOSTS file
 
ADW-s-1.png.c32838f45f840beb2b835ad51f0a1b7c.png
 
 
ONLY after you have set the selections above ....only after that .....
Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.
 
 
This can take several minutes.
When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.
 
AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.
Click on the “Continue” button to finish the removal process.
 
 
 
Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt
There is much more to do even after this. There will be much much more to do. Have plenty of patience. Also be aware that I am a volunteer and ( 2) I am not on all the time.
  • Like 1
Link to post
Share on other sites
AzizKharbouchi

AzizKharbouchi

Posted
  • Author
Posted
8 minutes ago, Maurice Naggar said:

Stop making changings on your own. No more Windows re-install or such. You had mentioned you ran 3 or so other different tools. Please no more. I will guide you. AND NO we cannot consider a upgrade to Windows 11 in a situation such as this. Please wait for my guidance. I typically have folks run a known and trusted set of tools. Have INIFINITE patience. There is NOT a magical single-silver-bullet solution ! 

If possibly you have a browser issue, can you try using a different web browser?
But in any event, always SAVE the downloads I guide you to. Then after download is complete, you go to the file using File Explorer.
and only then, launch it from there.

Let's do one special run  with Malwarebytes Adwcleaner. 
 
It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button.
 
First download & save it
 
Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. There are a few first choices to set as I have listed below.
 
Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.
 
When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status 
Delete IFEO keys
Delete tracing keys
Delete Prefetch files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock
Reset HOSTS file
 
ADW-s-1.png.c32838f45f840beb2b835ad51f0a1b7c.png
 
 
ONLY after you have set the selections above ....only after that .....
Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.
 
 
This can take several minutes.
When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.
 
AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.
Click on the “Continue” button to finish the removal process.
 
 
 
Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt
There is much more to do even after this. There will be much much more to do. Have plenty of patience. Also be aware that I am a volunteer and ( 2) I am not on all the time.

thanks for your time !

AdwCleaner[C02].txt

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

No need to click on the "Quote" spot when you begin a Reply. Just start your typing directly on the white-box-reply area. The Adwcleaner run is helpful But there is a bunch of fixing to do. At this point, there is 2 too-many antivirus from 3rd-party companies other than Microsoft.

Avast Antivirus Gratuit

Kaspersky Internet Security

Kaspersky VPN

There are way too many conflicting security services. IF Avast is not paid-for ( and I can also see that Avast is having aborts) I would ask you to UNINSTALL Avast.

What about Kaspersky ? is it a trial ? or is it paid for ?
And you must realize that by installing either Avast or Kaspersky that what happens is they disable Microsoft Defender antivirus from the Windows system.
I would like to settle down to only just 1 antivirus before we proceed to the next cleanup procedure. Advise me of your actions, and be sure to do 1 Windows RESTART. Then wait until my next reply.

  • Like 1
Link to post
Share on other sites
AzizKharbouchi

AzizKharbouchi

Posted
  • Author
Posted

thanks for your answer i won't use quote anymore 😅

i have deleted avast (i have used revo unistaller because it was impossible to delete it from the windows unistaller)

and i aslo deleted kaspersky internet security and kaspersky VPN (all this programs are not in paid version)

I just let malwarebytes premium trial for now and did a restart 

waiting for your reply (thanks a lot !)

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

as to this machine having had Avast antivirus, we need to run the Avast cleanup tool to insure all traces of it are gone. ( You gotta do something like this each time you switch from a non-Microsoft-branded antivirus ).

get & first SAVE & then run the AVASTCLEAR tool

Get, Save & Run the Avast clear tool.

https://support.avast.com/en-us/article/Uninstall-Antivirus-Utility/

Save the tool first; then run it.

[ 2 ]

Then do a Windows RESTART from the Start menu.

  • Like 1
Link to post
Share on other sites
  • Solution
Maurice Naggar

Maurice Naggar

Posted
  • Solution
Posted

Yes, I am well aware that this machine has a unwanted "restriction" on Windows Update.. We will be doing other tasks. One of the things that this next run will do is help on Windows Update. Please run the following custom script. Read all of this before you start. Please Close all open work.

Once the script-run has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program :  is FRSTENGLISH.exe

Please download the attached fixlist.txt file and save it to C:\Users\Lenovo\Downloads

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select 

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will reset the Winsock. It will attempt to clear all Cache and history on web browsers. Depending on the speed of your computer this fix may take 40-50 minutes or more.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.  👈

NEXT I would highly encourage to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

  • Like 1
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Good. Thank you. As a next step, I suggest the following:

This is for a scan with ESET Onlinescanner (free). ESET is a well-respected, well-known entity and tool.

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run.

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on CUSTOM scan  and select C drive to be scanned
  • Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"
  • and click on Start scan button.

Have patience. The entire process may take an hour or more. There is an initial update download.
There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours.

  • At screen "Detections occurred and resolved" click on blue button "View detected results"
  • On next screen, at lower left, click on blue "Save scan log"
  • View where file is to be saved. Provide a meaningful name for the "File name:"
  • On last screen, set to Off (left) the option for Periodic scanning
  • Click "save and continue"
  • Please attach the report file so I can review
  • Like 1
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Very good. Thanks. 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first
https://definitionupdates.microsoft.com/download/DefinitionUpdates/safetyscanner/amd64/MSERT.exe

Upon completion of the save, Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.


This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

  • Like 1
Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.