I am using windows 7. I have a virus symsrv.dll. I can't delete it

[Yahya_Saleh]

12 minutes ago, JSntgRvr said:

Lets check the disk:
  
Boot in the Recovery Environment

 

• To enter the Recovery Environment with  Windows 7, follow the instructions below:
  • Restart the computer
  • Once you've seen your BIOS splashscreen (the computer manufacturer logo), tap the F8 key repeatedly until the Advanced Boot Options menu appears
  • Use the arrow keys to select Repair your computer, and press on Enter
  • Select your keyboard layout (US, French, etc.) and click on Next
  • Click on Command Prompt to open the command prompt
  • At the command prompt type the following and press Enter.
     
    BCDEDIT | Find "osdevice"
     
    Take note of the drive letter shown as the "osdevice", then type the following and press Enter:
     
    CHKDSK X:\ /R
     
    Replace the X with the osdevice letter and press Enter. Once completed take a photograph of that window and upload it for us to see. 

What's wrong

[JSntgRvr]

There is something very wrong with that drive. I believe that the only option will be to backup your personal files, replace the disk and reinstall Windows.

Run this command at an administrator command prompt to obtain the product key. You will need this to reinstall Windows.

wmic path softwarelicensingservice get OA3xOriginalProductKey

Here is a link to obtain an image of Windows 7 that you can burn on a CD or USB drive using Rufus or a CD burner.

https://archive.org/details/windows-7-ultimate-32-64bit-iso_20201128

I wish I can do more for you.
 

[Yahya_Saleh]

1 minute ago, JSntgRvr said:

There is something very wrong with that drive. I believe that the only option will be to backup your personal files, replace the disk and reinstall Windows.

Run this command at an administrator command prompt to obtain the product key. You will need this to reinstall Windows.

wmic path softwarelicensingservice get OA3xOriginalProductKey

Here is a link to obtain an image of Windows 7 that you can burn on a CD or USB drive using Rufus or a CD burner.

https://archive.org/details/windows-7-ultimate-32-64bit-iso_20201128

I wish I can do more for you.
 

The virus is there for a several months now maybe it missed up the drive, and thank you for trying 

[JSntgRvr]

By the way, it was my fault. The command should be:

CHKDSK X: /R

There is a backslash that it is no suppose to be there.

Sorry. Please try again.

[Yahya_Saleh]

It's running now

[Yahya_Saleh]

1 hour ago, JSntgRvr said:

By the way, it was my fault. The command should be:

CHKDSK X: /R

There is a backslash that it is no suppose to be there.

Sorry. Please try again.

Here, is that what you need or something else 

[JSntgRvr]

You have 56 kb in Bad Sectors. That is like a progressive sickness. Soon will increase the number of bad sectors and your computer will crash. I believe you should do this promptly:

Run this command at an administrator command prompt to obtain the product key. You will need this to reinstall Windows.

wmic path softwarelicensingservice get OA3xOriginalProductKey

Here is a link to obtain an image of Windows 7 that you can burn on a CD or USB drive using Rufus or a CD burner.

https://archive.org/details/windows-7-ultimate-32-64bit-iso_20201128

Lets continue:

This Fix will empty the following folders:

• Windows Temp
• Files detected by Dr. Web
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

FRST64 was saved as  C:\Users\ram soft\Desktop\FRSTEnglish.exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

 

[Yahya_Saleh]

I opened CMD and that happened, is that normal 

[Yahya_Saleh]

9 hours ago, JSntgRvr said:

You have 56 kb in Bad Sectors. That is like a progressive sickness. Soon will increase the number of bad sectors and your computer will crash. I believe you should do this promptly:

Run this command at an administrator command prompt to obtain the product key. You will need this to reinstall Windows.

wmic path softwarelicensingservice get OA3xOriginalProductKey

Here is a link to obtain an image of Windows 7 that you can burn on a CD or USB drive using Rufus or a CD burner.

https://archive.org/details/windows-7-ultimate-32-64bit-iso_20201128

Lets continue:

This Fix will empty the following folders:

• Windows Temp
• Files detected by Dr. Web
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

FRST64 was saved as  C:\Users\ram soft\Desktop\FRSTEnglish.exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

 

Here's the log

Fixlog (3).txt

[JSntgRvr]

Open FRST64 (FRSTEnglish.exe) on the window next to Search, type CMD.exe and click on Search Files.

A log, Search.txt will be produced. Attach it to a reply.

 

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

[Yahya_Saleh]

1 hour ago, JSntgRvr said:

Open FRST64 (FRSTEnglish.exe) on the window next to Search, type CMD.exe and click on Search Files.

A log, Search.txt will be produced. Attach it to a reply.

 

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Finally we are making progress, folders now open normally, but still most applications give me error 0xc0000005, aNd here is the logs

Fixlog (4).txt Search.txt

[JSntgRvr]

With that file infector I wouldn't expect more. Get the product key and replace the drive. Only a clean install will resolve all your issues.

[Yahya_Saleh]

Ok, thanks 

12 minutes ago, JSntgRvr said:

With that file infector I wouldn't expect more. Get the product key and replace the drive. Only a clean install will resolve all your issues.

 

12 minutes ago, JSntgRvr said:

With that file infector I wouldn't expect more. Get the product key and replace the drive. Only a clean install will resolve all your issues.

 

[Yahya_Saleh]

I got some hope when the folders opened 

[Yahya_Saleh]

but why applications open when first I install them and after once or two the error 0xc0000005 comes 

2 hours ago, JSntgRvr said:

With that file infector I wouldn't expect more. Get the product key and replace the drive. Only a clean install will resolve all your issues.

 

[JSntgRvr]

It is how the infector works. It injects code to the executables making these unusable. Reinstalling the application may solve that issue.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs. I would like to take another look.

[Yahya_Saleh]

19 minutes ago, JSntgRvr said:

It is how the infector works. It injects code to the executables making these unusable. Reinstalling the application may solve that issue.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs. I would like to take another look.

Here

FRST (1).txt Addition (1).txt

[JSntgRvr]

It respawned:

AppInit_DLLs: C:\PROGRA~1\COMMON~1\System\symsrv.dll => C:\Program Files\Common Files\System\symsrv.dll [69337 2024-06-23] (Microsoft Corporation) <==== ATTENTION 
Remove the following program:

Web Companion (HKLM\...\{220dfbfe-3c16-4cc4-84e4-66cd7a76e750}) (Version: 8.9.0.748 - Lavasoft) <==== ATTENTION 
 

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

[Yahya_Saleh]

45 minutes ago, JSntgRvr said:

It respawned:

AppInit_DLLs: C:\PROGRA~1\COMMON~1\System\symsrv.dll => C:\Program Files\Common Files\System\symsrv.dll [69337 2024-06-23] (Microsoft Corporation) <==== ATTENTION 
Remove the following program:

Web Companion (HKLM\...\{220dfbfe-3c16-4cc4-84e4-66cd7a76e750}) (Version: 8.9.0.748 - Lavasoft) <==== ATTENTION 
 

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Here

Fixlog (5).txt

[Yahya_Saleh]

Should I delete this web companion or what do you mean 

I deleted it now but after I did the fix, I didn't notice

[JSntgRvr]

Yes, remove the program web companion.

We will need to know if the entry respawned.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs.

[Yahya_Saleh]

11 minutes ago, JSntgRvr said:

Yes, remove the program web companion.

We will need to know if the entry respawned.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs.

Here 

FRST (2).txt Addition (2).txt

[JSntgRvr]

Lets try again.

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs.

[Yahya_Saleh]

18 minutes ago, JSntgRvr said:

Lets try again.

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Re-scan with FRSTEnglish.exe and attach the FRST.txt and Addition.txt logs.

Here

Fixlog (6).txt FRST (3).txt Addition (3).txt

[JSntgRvr]

It is gone. Lets wait until tomorrow and post a new set of logs.