Jump to content

2 Malware keep coming back?!

Tim Drake
By Tim Drake
in Troubleshooting
 Share
Posted

Okay so I have removed this BitCoin Mining malware twice and it came back when I booted today.

 

It only comes back when I boot but it seems to be every other reboot..

 

14c4de4fb0190ab194460cf00b60d0d0.png

 

EDIT: It came back straight after removing it so is something injecting it there?

PCPP Version | Text Version 

 

 
LTT Beginners Guide | My Build Log | 80+ Efficiency Explained | Mechanical Key Switch Guide
Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I find that Norton Power Eraser works really well for getting rid of sticky rootkits like that. Worth a run to see if it gets it.

i5 4690K | Asus Ranger VII | 8GB HyperX Fury | Asus GTX 780 | NZXT H440 | Samsung 850 Evo | Seagate Barracuda | Corsair RM 750W | Corsair H105 


 


E3-1246 v3 | Asus Gryphon Z97 | 8GB HyperX Fury | MSI GTX 970 | Enthoo Evolv mATX | Samsung 840 Evo | WD Red | EVGA SuperNova GS 650W | NZXT Kracken x41 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I find that Norton Power Eraser works really well for getting rid of sticky rootkits like that. Worth a run to see if it gets it.

HOW DARE YOU MENTION NORTON.

                            500 Posts achieved 29/4/16 9:13PM

i7 980x Power! Beamng Drive is one of the best games ComicSans

“I was the rebellious one.” - Maxene Andrews

Damn that's a nice hair flick 1981 Simon LeBon!

"Nothing gets you going like a juicy pussy!" - ashens

"what sorry blender isn't that what you make smoothe?" - pathole

"Yeah, well i'm a member of the waffen ss who lives with hitler in the bunker And i like modern music!" - Hans krebs loves fish

"We won world war 2 for a reason" - ironic shitposting is still shitposting

"Fight shooting game with pretty girls" - megami strike 1943

"You've got wood in an evo" - moog

"oxygofishafacematerialsotosis" - linus

"Vehicle stimulator" - crappy russian mod site

"The power table" - Nerdcubed

"Nuclear spaghetti" - ashens

FRANKIE SAYS RELAX!!!!



 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

I find that Norton Power Eraser works really well for getting rid of sticky rootkits like that. Worth a run to see if it gets it.

 

 

Tried both, both removed it but it came back.

PCPP Version | Text Version 

 

 
LTT Beginners Guide | My Build Log | 80+ Efficiency Explained | Mechanical Key Switch Guide
Link to comment
Share on other sites
Link to post
Share on other sites
Posted

HOW DARE YOU MENTION NORTON.

If it works, I can't complain ;)

i5 4690K | Asus Ranger VII | 8GB HyperX Fury | Asus GTX 780 | NZXT H440 | Samsung 850 Evo | Seagate Barracuda | Corsair RM 750W | Corsair H105 


 


E3-1246 v3 | Asus Gryphon Z97 | 8GB HyperX Fury | MSI GTX 970 | Enthoo Evolv mATX | Samsung 840 Evo | WD Red | EVGA SuperNova GS 650W | NZXT Kracken x41 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Tried both, both removed it but it came back.

i think there is an operating system you should reinstall....as a last resort did you try booting in with safe mode and seeing if its there?

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

HOW DARE YOU NOT HELP

Oh fuck off, i'm trying to actually have some fun instead of focusing on fat hairy men touchy feelying computer hardware okay?

                            500 Posts achieved 29/4/16 9:13PM

i7 980x Power! Beamng Drive is one of the best games ComicSans

“I was the rebellious one.” - Maxene Andrews

Damn that's a nice hair flick 1981 Simon LeBon!

"Nothing gets you going like a juicy pussy!" - ashens

"what sorry blender isn't that what you make smoothe?" - pathole

"Yeah, well i'm a member of the waffen ss who lives with hitler in the bunker And i like modern music!" - Hans krebs loves fish

"We won world war 2 for a reason" - ironic shitposting is still shitposting

"Fight shooting game with pretty girls" - megami strike 1943

"You've got wood in an evo" - moog

"oxygofishafacematerialsotosis" - linus

"Vehicle stimulator" - crappy russian mod site

"The power table" - Nerdcubed

"Nuclear spaghetti" - ashens

FRANKIE SAYS RELAX!!!!



 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Oh fuck off, i'm trying to actually have some fun instead of focusing on fat hairy men touchy feelying computer hardware okay?

Nah you're wasting oxygen on this forum, plz leave.

PCPP Version | Text Version 

 

 
LTT Beginners Guide | My Build Log | 80+ Efficiency Explained | Mechanical Key Switch Guide
Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Try using Hitman Pro.

"We're all in this together, might as well be friends" Tom, Toonami.

 

mini eLiXiVy: my open source 65% mechanical PCB, a build log, PCB anatomy and discussing open source licenses: https://linustechtips.com/topic/1366493-elixivy-a-65-mechanical-keyboard-build-log-pcb-anatomy-and-how-i-open-sourced-this-project/

 

mini_cardboard: a 4% keyboard build log and how keyboards work: https://linustechtips.com/topic/1328547-mini_cardboard-a-4-keyboard-build-log-and-how-keyboards-work/

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Nah you're wasting oxygen on this forum, plz leave. 

No. no. no. There is no physical oxygen on this webpage.

                            500 Posts achieved 29/4/16 9:13PM

i7 980x Power! Beamng Drive is one of the best games ComicSans

“I was the rebellious one.” - Maxene Andrews

Damn that's a nice hair flick 1981 Simon LeBon!

"Nothing gets you going like a juicy pussy!" - ashens

"what sorry blender isn't that what you make smoothe?" - pathole

"Yeah, well i'm a member of the waffen ss who lives with hitler in the bunker And i like modern music!" - Hans krebs loves fish

"We won world war 2 for a reason" - ironic shitposting is still shitposting

"Fight shooting game with pretty girls" - megami strike 1943

"You've got wood in an evo" - moog

"oxygofishafacematerialsotosis" - linus

"Vehicle stimulator" - crappy russian mod site

"The power table" - Nerdcubed

"Nuclear spaghetti" - ashens

FRANKIE SAYS RELAX!!!!



 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

If all else failes, DBAN and start fresh...

Mutsuki:

CPU: AMD A8 5600K @ 4.2GHz | Motherboard: Gigabyte GA-F2A55M-DS2 (rev. 1.0) | RAM: 2 x Kingston Low Profile 4GB 1333MHz | GPU: Sapphire R7 260X OC 2GB DDR5 2xDVI | HDD0: Seagate Barracuda 500GB 7200RPM 3.5" (SATA II) | HDD1: WD Elements (WD Blue 1TB 3.5" SATA II) connected via USB 2.0 | HDD2: Seagate Barracuda 1TB 7200rpm (SATA II) | DVD: Samsung DVD+RW combo drive | PSU: FSP Hexa 600W | Case: Aerocool PGS V | Cooling: DeepCool Gammaxx S40 (stock fan), 2x 120mm Aerocool fan 1xDeepCool 120mm fan from a scrapped heatsink

eMachines D732Z | CPU: Intel Pentium D P6100 | GPU: Intel HD 3000 | RAM: 2x Kingston ValueRAM 2GB 1066MHz SODIMM | HDD: Hitachi 320GB 5600RPM

Acer ES13 | CPU: Intel Pentium N4200 | GPU:  Intel HD 505 | RAM: 1x 4GB (unidentified) DDR3L | HDD: (unidentified) 500GB 5600RPM

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Nah you're wasting oxygen on this forum, plz leave.

Try using regclean pro ( ͡° ͜ʖ ͡°)( ͡° ͜ʖ ͡°)( ͡° ͜ʖ ͡°)

                            500 Posts achieved 29/4/16 9:13PM

i7 980x Power! Beamng Drive is one of the best games ComicSans

“I was the rebellious one.” - Maxene Andrews

Damn that's a nice hair flick 1981 Simon LeBon!

"Nothing gets you going like a juicy pussy!" - ashens

"what sorry blender isn't that what you make smoothe?" - pathole

"Yeah, well i'm a member of the waffen ss who lives with hitler in the bunker And i like modern music!" - Hans krebs loves fish

"We won world war 2 for a reason" - ironic shitposting is still shitposting

"Fight shooting game with pretty girls" - megami strike 1943

"You've got wood in an evo" - moog

"oxygofishafacematerialsotosis" - linus

"Vehicle stimulator" - crappy russian mod site

"The power table" - Nerdcubed

"Nuclear spaghetti" - ashens

FRANKIE SAYS RELAX!!!!



 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

You can use unetbootin utility to download and install latest dr. web antivirus livecd to your flash drive, boot with it and wipe out malwares.

Almost every malware, that generates such stuff, hide themselves via ring 0 vulnerabilities and u cannot spot it when running windows.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

I find that Norton Power Eraser works really well for getting rid of sticky rootkits like that. Worth a run to see if it gets it.

0.0 Dont say that name.... its voodoo..,

Legends say everytime someone mentions it-whom-cant-be-said, 10 computers run %50 slower...poor computers.

Try searching around www.bleepingcomputer.com for a rootkit remover.

@xTrixieHD

@Tim Drake

Have you simply tried going to those temp files and deleting them yourself?

CPU: Pentium G3258 @ 3.2GHz || GPU:(first release,used) MSI R9 270 OC || Motherboard:MSI Z97-G45 Gaming Motherboard || RAM: 8 GB G.Skill Sniper 1600 || Monitors: Vizio 22 in Ultra slim 1080p TV || Storage: Seagate barracuda 160 GB 7200RPM,(REFURB) 1TB toshiba 7200RPM || PSU: (stripped from 2013 CAD PC)Corsair CX600 build was under $420

BE SURE TO FOLLOW YOUR THREADS! READ THIS BEFORE POSTING IN TROUBLESHOOTING!! http://linustechtips.com/main/topic/40334-read-before-asking-for-help/
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
  • Author

0.0 Dont say that name.... its voodoo..,

Legends say everytime someone mentions it-whom-cant-be-said, 10 computers run %50 slower...poor computers.

Try searching around www.bleepingcomputer.com for a rootkit remover.

@xTrixieHD

@Tim Drake

Have you simply tried going to those temp files and deleting them yourself?

Yup I tried deleting everything in that folder.

PCPP Version | Text Version 

 

 
LTT Beginners Guide | My Build Log | 80+ Efficiency Explained | Mechanical Key Switch Guide
Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Yup I tried deleting everything in that folder.

And have you tried Hitman Pro? Worked for me last time with a similar virus problem (it wasn't a bitcoin one, but it was a persistent one)

"We're all in this together, might as well be friends" Tom, Toonami.

 

mini eLiXiVy: my open source 65% mechanical PCB, a build log, PCB anatomy and discussing open source licenses: https://linustechtips.com/topic/1366493-elixivy-a-65-mechanical-keyboard-build-log-pcb-anatomy-and-how-i-open-sourced-this-project/

 

mini_cardboard: a 4% keyboard build log and how keyboards work: https://linustechtips.com/topic/1328547-mini_cardboard-a-4-keyboard-build-log-and-how-keyboards-work/

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Oh fuck off, i'm trying to actually have some fun instead of focusing on fat hairy men touchy feelying computer hardware okay?

please leave this forum, noone bites your bait. just go to /b/ or something.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

Don't download so much pr0n ;)

I had the same issue as you not long ago where it just would not go away, run malwarebytes in safe mode and remove it that way, or possibly find a copy of Hiren's Boot Disk and run that.
 

 

 

Anybody? It doesn't stop coming back.

Motherboard: MSI G45 | CPU: Intel i7 4790K | RAM: 16GB G.Skill DDR3 | SSD: 2x Samsung 840 Evo 256GB | Graphics: EVGA GTX 1080 FTW | PSU: Corsair HX650W | Cooler: Cooler Master Hyper 212 Evo | Fans: 6x Corsair SP120's | Case: NZXT H440 Razer Edition | OS: Windows 10

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Troubleshooting

×