Solved What kind of Malware do I have?

kelper · Apr 11, 2023

For anyone testing Defender offline, if you click the mouse in the defender window the program paused and you will see a white square where the cursor was. Tap any key to restart the scan.

Try3 · Apr 11, 2023

kelper said:
You have to uninstall any third party antivirus or antimalware first. I use Webroot and pausing it was not enough, I got the same error in Powershell as you. But Defender offline ran fine once I had uninstalled Webroot.

@Brink
Is this true?
I thought Run Microsoft Defender Offline Scan - ElevenForumTutorials could be used even if unnecessary third-party real-time protection was in use.

Denis

Brink · Apr 11, 2023

Try3 said:
@Brink
Is this true?
I thought Run Microsoft Defender Offline Scan - ElevenForumTutorials could be used even if unnecessary third-party real-time protection was in use.

Denis

Hey Denis,

I suppose it depends on if the AV or security program protects the boot environment causing an issue with the offline scanner.

kelper · Apr 11, 2023

I tried from within Windows Security where it wasn't offered and then I tried in PowerShell.

Try3 · Apr 11, 2023

kelper said:
I tried from within Windows Security where it wasn't offered ...

It was not in the scan options within Windows security, Virus & threat protection, Scan options

kelper said:
... then I tried in PowerShell.

And what happened?

What anti-malware do you have installed?

All the best,
Denis

kelper · Apr 11, 2023

I have no issues personally, I was just suggesting a reason why some cannot run a Defender offline scan. I do not need any assistance!

I use Webroot SecureAnywhere Complete. Even sleeping Webroot doesnot help, I had to uninstall it. This is what I see.

And inWindows Security I see

Bunaby Jones · Apr 11, 2023

I’m going to get a new router and ditch all my former drives and get new ones. Depending on what GeekSquad tells me I may have to get a new mobo.

Ghot · Apr 11, 2023

Bunaby Jones said:
I’m going to get a new router and ditch all my former drives and get new ones. Depending on what GeekSquad tells me I may have to get a new mobo.

If your BIOS chip is NOT soldered in, you may be able to just replace that, instead of the whole motherboard.
They usually run about $15-20, if available.

This is why we ask members to fill in their computer specs. Then we can check things like that.

As for the router... if you have other computers hooked to the router that aren't having the same problems, then the router is possibly un-infected.

Hazel123 · Apr 11, 2023

There are still programs that can remove root and boot viruses so don't rush out to replace everything. I know some trojans can get into the network via the router and infect other devices. So it's more a case of isolating everything until you get to the bottom of it. There are various antivirus programs that can be run from a disk or usb without logging in - ie you boot from them and run them - and they can find rootkits etc. If you run two or three and find nothing and do a full format of the disks (which wipes them including the boot partition) then you can't get much cleaner than that.

I'd suggest another antivirus in future for safety. I did get a trojan once, via a usb stick, but luckily the av on the computer I plugged the usb stick into, blocked it. But only after a few seconds and meanwhile it had gone via the router to another device. Scanning, wiping drives and resetting the router did it for me.

Hazel123 · Apr 11, 2023

Not sure if I'm correct in this, but if you wipe a drive and delete the mbr I don't think anything can survive on the drive. Parted magic has various options for wiping the drive including one to specifically wipe the mbr. And it's then like a new drive and you have to reformat to msdos before formatting to ntfs again.

Could you try using your phone as a router for a while and leave the router off while you get the gadgets checked out and cleaned up one by one? If you have an iphone, that shouldn't be infected.

Bunaby Jones · Apr 11, 2023

Ghot said:
If your BIOS chip is NOT soldered in, you may be able to just replace that, instead of the whole motherboard.
They usually run about $15-20, if available.

This is why we ask members to fill in their computer specs. Then we can check things like that.

As for the router... if you have other computers hooked to the router that aren't having the same problems, then the router is possibly un-infected.

Z490e Strix mobo. Sorry, was in a rush to get this stuff posted.

Ghot · Apr 11, 2023

Bunaby Jones said:
Z490e Strix mobo. Sorry, was in a rush to get this stuff posted.

No worries.

When you have the time....

Quickie Eleven Forum Setup Guide for new Members

Quickie Interface tour... Quickie set up... At the top right, click on your name, then choose "Preferences". Then go through everything on the left side. Quickie navigation... Click Forums and choose a subforum, OR... Click Forums, then New Posts or What's New Ranks, Trophies...

www.elevenforum.com

Bunaby Jones · Apr 16, 2023

So I got it back from GeekSquad they found nothing. I brought it home, started to run TDSSkiller and rubbish started happening again. It found nothing, ran MBAR and got
Nothing. ran rogueKiller and got nothing. I found that Tron malware wiper and that also found nothing.

This motherboard is completely compromised. Gonna get a new one. I also ran Malware bytes and also got nothing.

Hollywood · Apr 16, 2023

This is all interesting and scary. Anyone using a computer online "could" get some bad things on your computer. I would think memory, hard/SSD drives, and plug-memory are most vulnerable (my guess).

As far as bios and routers go, do/can they get infected if they are password protected? Replacing hardware piece by piece is expensive, but some or all of your photos, music, documents, and any other data may be infected too.

I'm not an expert, but I would reset the bios (I think there are jumpers to do that). You might even look for a firmware update to over wite the current one. Just install one cheap SSD (around $20 or so here), and have someone with a clean computer install the Windows installation on a new USB stick. That will tell you if it is your computer or your drives and the data on them.

The price for a 240gb SSD and thumb drive is a lot less then a service call. If things are still acting infected, yea, replace your motherboard, but if the system now seems stable, load several free trusted anti virus/malware programs and start connecting drives and other stuff one at a time and have them scanned before you re-hookup the next one. If you have success you can continue to load and configure your new Windows installation or start again from scratch if you found the problem in a file(s) that was cleaned.

We all heard these horror stories. I hope you get it sorted out, but these days computers are no longer toys and our data is often as important as the hardware.

Hollywood · Apr 16, 2023

Follow up: What passwords are being exposed? Are they ones you have saved in Firefox or some other browser? If so you can view them in the Firefox setting, and even export them as a file. If those are the passwords you are talking about (those saved in your browser), I would delete the Firefox and Mozilla folders in the ProgramData, and AppData/Roaming. maybe the issue is a Firefox addon?

*If* that sounds like it may be on the right track, if you have online browser "Sync", you need to address it there too so it doesn't re-sync the problem.

also, If that sounds like it may be on the right track but you use another browser, maybe someone else can help as I only use Firefox.

TairikuOkami · Apr 16, 2023

Bunaby Jones said:
I also ran Malware bytes and also got nothing.

Please try this, run CMD as admin and copy/paste:

Code:

reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\WOW6432Node\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\WOW6432Node\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" /t REG_SZ /d "Restricted" /f
reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v "EnableScripts" /t REG_DWORD /d "0" /f
reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "__PSLockDownPolicy" /t REG_SZ /d "4" /f

Install a firewall, this one has a great informative GUI:

Safing Portmaster - Easy Privacy

Portmaster is a free and open-source application that puts you back in charge over all your computer's network connections. Increase your privacy and security. Get peace of mind.

safing.io

Hazel123 · Apr 16, 2023

I agree - flashing, resetting or overwriting the bios and wiping the drive should do it. Or using a new drive to be sure. If that doesn't do it then it sounds like you have a rare beast. That's also a very good point about firefox syncing as well. If you have flashed bios, wiped drive and clean install and you still have it, then think about the motherboard maybe.

kelper · Apr 17, 2023

It may have left the Geek Squad clean but you immediately re-infected it when you ran TDSSkiller or other AV. Did you have these on a USB stick for example?

Bunaby Jones · Apr 19, 2023

Hazel123 said:
I agree - flashing, resetting or overwriting the bios and wiping the drive should do it. Or using a new drive to be sure. If that doesn't do it then it sounds like you have a rare beast. That's also a very good point about firefox syncing as well. If you have flashed bios, wiped drive and clean install and you still have it, then think about the motherboard maybe.

Geek Squad flashes the bios and reseated the CMOS battery, wiped the drive and reinstalled windows. It did it again. I got a new motherboard and now all is working again. It was in the motherboard.

Ghot · Apr 19, 2023

Bunaby Jones said:
Geek Squad flashes the bios and reseated the CMOS battery, wiped the drive and reinstalled windows. It did it again. I got a new motherboard and now all is working again. It was in the motherboard.

That sounds like an infected BIOS. The part of the BIOS chip that we don't have access to.... the part we can't... flash.