I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (2024)

Table of Contents
#1Andre_Castillo14 BC AdBot (Login to Remove) #2nasdaq #3Andre_Castillo14 #4nasdaq #5Andre_Castillo14 References

#1Andre_Castillo14

Andre_Castillo14


  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (2)
  • Members
  • 134 posts
  • OFFLINE
  • Gender:Male
  • Local time:05:40 PM

Posted 28 August 2020 - 04:56 AM

A few days ago, I was looking around the internet for a program for Nvidia called Nvidia Profile Inspector, to allow me to edit game profiles to give me a boost in GPU performance. It didn't work though, so I reset the edited profile to its original settings.

If anyone want to check out the files themselves if they're safe, here is the link: https://github.com/Orbmu2k/nvidiaProfileInspector/releases

I then went around to VirusTotal and uploaded the .zip and .exe files, nothing was detected, but the .exe file was somehow related to 4 other known malicious files that is known to VirusTotal, one of which is a Trojan. I then initiated a System Restore, to somehow reverse any system changes I have done, and ran a scan with ESET, Malwarebytes and Window's in-built Anti-Virus. Both Malwarebytes and the in-built Anti-Virus didn't pick up anything, ESET did pick up a PUP in my system, a file ending in .msi in C:\Windows\Installer, which it also never picked up before.

I just want a peace of mind that my laptop is clear of anything malware/virus/spyware, especially since this laptop was "stuck" for the past 4 years with very outdated software.

Here are the FRST and Addition logs.

Attached Files

  • FRST.txt 86.15KB6 downloads
  • Addition.txt 44.6KB6 downloads

  • Back to top

BC AdBot (Login to Remove)

  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (6)
  • BleepingComputer.com
  • Register to remove ads

#2nasdaq

nasdaq


  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (8)
  • Malware Response Team
  • 48,328 posts
  • OFFLINE
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:40 AM

Posted 28 August 2020 - 08:23 AM

Hello, Welcome to BleepingComputer.

I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

===

This is just some maintenance no malware was found.

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.

Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to the a new file.

startCreateRestorePoint:CloseProcesses:HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTIONFF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTIONTask: {55526CF7-B06E-4D07-B29C-865AF2F1B86D} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTIONCHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No FileShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No FileContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No FileContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No FileContextMenuHandlers1: [Briefcasem*nu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No FileContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No FileContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No FileContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No FileContextMenuHandlers6: [Briefcasem*nu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No FileContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => -> No FileAlternateDataStreams: C:\Users\andre\Downloads\chrome.exe:SmartScreen [7]FirewallRules: [TCP Query User{A5CF9EFC-D0B0-4024-9497-21211194B0A8}D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe => No FileFirewallRules: [UDP Query User{6FBC6D3F-D772-4D44-9841-92CC3CD10825}D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe => No FileFirewallRules: [{A0C8A438-DE56-4A25-BD02-B00889086A5D}] => (Block) D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe => No FileFirewallRules: [{DECAC2BB-3BA2-46A0-84CC-0F9E951A3939}] => (Block) D:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe => No FileFirewallRules: [{3FACDB22-A99E-43C1-A6D7-97C46BB45AB2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe => No FileCMD: netsh int ip resetCMD: ipconfig /flushDNSCMD: "%WINDIR%\SYSTEM32\lodctr.exe" /RCMD: "%WINDIR%\SysWOW64\lodctr.exe" /RCMD: "C:\Windows\SYSTEM32\lodctr.exe" /RCMD: "C:\Windows\SysWOW64\lodctr.exe" /REmptyTemp:End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.

The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.

===

Let me know of any remaining issues with this computer.


  • Back to top
See Also
How to Fix Always Available Offline Not Showing/Grayed Out? - MiniToolVirus / Trojan or Windows Defender False Positive? (Trojan:Win32/Tiggre!rf)

#3Andre_Castillo14

Andre_Castillo14

  • Topic Starter

  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (11)
  • Members
  • 134 posts
  • OFFLINE
  • Gender:Male
  • Local time:05:40 PM

Posted 28 August 2020 - 08:35 AM

Let me know of any remaining issues with this computer.

Thank you for for checking out my post.

I have a question though: ESET detected a a file, classed it as potentially unwanted application called 1e5b1.msi and deleted it. It was located in my C:\Windows\Installer, which never appears in Windows Explorer for me. But why did ESET only managed to detect it after I performed a System Restore? Only ESET Online Scanner managed to detect it, MBAM, AdwCleaner, or Windows' own Anti-Virus couldn't detect it. And why was it only detected just now?


Edited by Andre_Castillo14, 28 August 2020 - 08:38 AM.

  • Back to top

#4nasdaq

nasdaq


  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (14)
  • Malware Response Team
  • 48,328 posts
  • OFFLINE
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:40 AM

Posted 28 August 2020 - 01:01 PM

Hi.

Read about the MSI File Format

===

Nothing to worry about.

To be safe you can scan the file at VirusTotal.

Stay safe.


  • Back to top

#5Andre_Castillo14

Andre_Castillo14

  • Topic Starter

  • I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (17)
  • Members
  • 134 posts
  • OFFLINE
  • Gender:Male
  • Local time:05:40 PM

Posted 29 August 2020 - 10:20 AM

Hello again,


EDIT: I forgot to include the Fixlog.txt on my last reply, here it is.

Attached Files

  • Fixlog.txt 8.19KB2 downloads

Edited by Andre_Castillo14, 29 August 2020 - 10:29 AM.

  • Back to top
I think I WAS infected - Virus, Trojan, Spyware, and Malware Removal Help (2024)

References

Top Articles
Best Runelite Plugins for OSRS in 2023 - OSRS Guide
How-To Geek on LinkedIn: How to Change Your Default Google Account on Android
Craigslist Deming
Ridgeview News Calhoun Wv
maryland jobs - craigslist
Gsfi Ihub
Jennette Mccurdy Tmz Hawaii Photos Joe
Mvd Express 98Th
Tri State Dog Results
Tony Capone Pizza Eau Claire
Office of the Registrar
Funding your Education
Latest Posts
Kwas DHA – czym jest i za co odpowiada jeden z kwasów omega–3? Suplementacja DHA dla kobiet w ciąży i dzieci
National Spelling Bee reflects the economic success and cultural impact of immigrants from India
Article information

Author: Jeremiah Abshire

Last Updated:

Views: 6558

Rating: 4.3 / 5 (74 voted)

Reviews: 81% of readers found this page helpful

Author information

Name: Jeremiah Abshire

Birthday: 1993-09-14

Address: Apt. 425 92748 Jannie Centers, Port Nikitaville, VT 82110

Phone: +8096210939894

Job: Lead Healthcare Manager

Hobby: Watching movies, Watching movies, Knapping, LARPing, Coffee roasting, Lacemaking, Gaming

Introduction: My name is Jeremiah Abshire, I am a outstanding, kind, clever, hilarious, curious, hilarious, outstanding person who loves writing and wants to share my knowledge and understanding with you.