Programs to hunt down viruses/malware?

**Dave Strider** · April 25, 2012, 04:03 PM

Allow me to start from the beginning. Several days ago, my computer contracted quite a bad virus, or rather, a string of them. The creator really knowed what he was doing, too, I saw everything from Obfuscator.XZs, to CoinMiners, to Trojans, to Worms, to Backdoors, all popping up as having been suspended from action. I swear Microsoft Security Essentials is saving my computer's life.

Anyways, I did a hard disc scan(the pre-startup kind - it took about an hour and a half), then a full scan with MSE, then rebooted, and am in the process of doing a second full scan as well as a scan with MalwareBytes. But these damn things keep popping up! I know that any hacker with any form of humanity can't have the time to manually be sending all these things in, so my theory is that there's some kind of script that's creating them. Is this possible? And if so, what can I do to get rid of it?

**Blau&Gruen** · April 25, 2012, 04:12 PM

Nasty. You can try with the TuneUp, Advanced System Care, Super Antispyare Free Edition, Kapersky, Norton or the like. But if you do not get rid off then you should consider the solution that (nearly) always works.

**Dave Strider** · April 25, 2012, 04:50 PM

Well, I mean, my computer has been able to contain it, and nothing bad has happened, but I'd just like to get rid of the spawnpoint, so to speak

And thanks, I'll keep them in mind!

**Jaketh** · April 25, 2012, 08:16 PM

Malwarebytes, which you already use. It will cleanse your computer in purifying flame and leave only clean files in its wake.

**Dave Strider** · April 25, 2012, 08:59 PM

I just used it, and at first, you were right! 58(!) infected files were found and deleted, and all was calm for a while.

...Then 5 minutes later I checked again and 5 new files were there.

**Jaketh** · April 25, 2012, 09:14 PM

Originally Posted by Comrade Chernov

I just used it, and at first, you were right! 58(!) infected files were found and deleted, and all was calm for a while.

...Then 5 minutes later I checked again and 5 new files were there.

Something is infecting it with new files, you need a beefier active antivirus to block those new files. Try downloading Super Anti spymare and run a scan to see if it cleans it out, if not trying using a trial version of a paid antivirus to keep it clean.

**PoleCat** · April 25, 2012, 09:51 PM

Originally Posted by Comrade Chernov

...[snip]...I know that any hacker with any form of humanity can't have the time to manually be sending all these things in, so my theory is that there's some kind of script that's creating them. Is this possible? And if so, what can I do to get rid of it?

Yes it is possible. It is also a pain in the ass. Your best bet may be to copy your vital files to a thumbdrive, scan them for possible contamination and then nuke the OS and completely reinstall. It's the easy option - believe me.

Originally Posted by Comrade Chernov

I just used it, and at first, you were right! 58(!) infected files were found and deleted, and all was calm for a while.

...Then 5 minutes later I checked again and 5 new files were there.

Now we get to the more difficult solution - a rogue file operating outside the main boot sequence while still having a foot in the door so to speak.

I'll gladly accept some help on this one from any members willing to contribute.

From my rusty memory you should be looking at your Startup processes via the [msconfig] command from the Command Prompt. Look for something that is running outside either the Win32 or the SysWOW64 folder straight off the boot drive path. If there is a process in your boot sequence that is outside these folders and on the root path then that may be your culprit.

Long story short - if something has attached itself to your system it may be burrowing in under your boot sequence and thereby bypassing your anti-virus programs. Have you booted into Safe-Mode and made a Malwarebytes scan? If so could you provide a copy? Good luck!

**Blau&Gruen** · April 26, 2012, 12:41 AM

-> http://www.superantispyware.com/

**Dave Strider** · April 27, 2012, 02:27 PM

Originally Posted by PoleCat

Long story short - if something has attached itself to your system it may be burrowing in under your boot sequence and thereby bypassing your anti-virus programs. Have you booted into Safe-Mode and made a Malwarebytes scan? If so could you provide a copy? Good luck!

I haven't...simply because I don't know how.

**Jaketh** · April 27, 2012, 08:12 PM

Originally Posted by Comrade Chernov

I haven't...simply because I don't know how.

Restart the computer and when you see the splash screen for Dell, HP or whoever you bought your computer from start tapping the F8 key until you see a screen that says "advanced boot options" when you see that using the up and down arrow keys highlight "safemode with networking" then press enter, that will boot your computer into safemode and allow you to run malewarebytes in safemode without interference from other programs.

**PoleCat** · April 27, 2012, 10:18 PM

Originally Posted by Jaketh

Restart the computer and when you see the splash screen for Dell, HP or whoever you bought your computer from start tapping the F8 key until you see a screen that says "advanced boot options" when you see that using the up and down arrow keys highlight "safemode with networking" then press enter, that will boot your computer into safemode and allow you to run malewarebytes in safemode without interference from other programs.

I can't disagree with Jaketh here as he's mostly right. But just so you know there are other keys that activate the BIOS depending on the maker of the Motherboard you're using. I've seen F11 and Del keys as well as F8 just so you know.

The main thing is to get into the BIOS - do you know how or do you need a point-by-point...? Good luck!

EDIT:

Originally Posted by Comrade Chernov

I haven't...simply because I don't know how.

Let's get you into Safe Mode before we start worrying about getting a Malwarebytes log from you. One step at a time....

**Taiji** · April 26, 2012, 11:22 AM

Scan it in safemode or before it boots into windows. And with something that sorts out rootkit stuffs, something that scans the boot sector, etc.

I avoid AV SW so I haven't got any recommendations for that yucky stuff, except to remove it asap.

**Kamos** · April 28, 2012, 01:48 AM

Aye running standard the programs more like to dodge scanning. Safe mode generally solves that though isn't infallible.

**Dave Strider** · April 28, 2012, 04:22 PM

Alright, the F8 key didn't bring the advanced boot options up. What other keys are there?

**PoleCat** · April 28, 2012, 09:05 PM

Originally Posted by Jaketh

Safemode is always F8, the BIOS uses various different keys depending on the motherboard he has.

You're probably right - was thinking of BIOS access. I'd rep you but apparently I've already repped you sometime this last century....

Originally Posted by Comrade Chernov

Alright, the F8 key didn't bring the advanced boot options up. What other keys are there?

What do you see when the computer boots? Do you only see a splash screen (the logo screen for the maker of your computer)? If so you may not see the instructions for loading into BIOS and changing that screen to a true POST screen.

What Brand, Make and Model system do you have? Can you post your DxDiag log - it could help us here. Do you know how?

Good luck!

**Dave Strider** · April 29, 2012, 09:13 AM

Originally Posted by PoleCat

What do you see when the computer boots? Do you only see a splash screen (the logo screen for the maker of your computer)? If so you may not see the instructions for loading into BIOS and changing that screen to a true POST screen.

What Brand, Make and Model system do you have? Can you post your DxDiag log - it could help us here. Do you know how?

Good luck!

I only see the Splash Screen. I have an HP Pavilion Slimline s5000 series.

And here's my DxDiag.

Spoiler Alert, click show to read:

**PoleCat** · April 29, 2012, 02:48 PM

Originally Posted by Comrade Chernov

I only see the Splash Screen. I have an HP Pavilion Slimline s5000 series....

Ok, I looked up your manual and found that the key to access your BIOS is F11. When you boot up press and hold it during the splash screen to get into the BIOS since F8 didn't work. In the BIOS find the option to show the POST screen during boot - it should also give you the option for advanced boot somewhere in there. Good luck!