To boot from the infected drive and run any antivirus isn't the correct way to do it. If the virus is under control it wont let you run the antivirus.
I suggest you detach the current OS drive (if a SATA, detach the SATA cable. If a M.2 drive, remove it).
On a spare drive, install Win 10 and Superantispyware and Malawarebyte.
Attach the OS drive, boot from the spare drive and run Superantispyware and Malawarebyte.
Thanks for this - well I think it may have worked! Well sort of until my final paragraph.
I initially had the usual issues but after an hour or so of trying - for whatever reason Malawarebyte installed
I ran it and no issues reported.
I then installed Mbar - after multiple times are trying - I finally got it to work. Looked to have worked - no issues found.
Ran Adwcleaner.
Then just tried my usual check of MB2 on disk clean up and this time it worked - wow! Deleted many files that were not needed.
I have quite a few anti-virus now installed - probably not perfect but better than none, which I believe we stupidly had.
I'll pick one and run it regularly.
I did download AVG antivirus and it found:
Malaware or other threats could be running in your PC memory (Turn on Data Execution Prevention to detect malicious codes - it will turn on after restart). All cleaned now
We do use a webcam and avg does mention this. All this has rightly put me on edge and will review all these with family member. I will continue to test system and run scanners.
Any other comments would again be greatly received.
Thank you for all your help!
- - - Updated - - -
Minecraft doesn't run properly, but will restart and see what happens....
- - - Updated - - -
Might have spoken too soon. After a few restarts - Malwarebyte is not responding.....
- - - Updated - - -
Actually nothing is responding. Going to leave it now until next day
As I said on post 11, to boot from the infected drive and run any antivirus isn't the correct way to do it. If the virus is under control it wont let you run the antivirus.
Sorry - yes forgot that.
You sort of lost me on what you said -
Detach the current OS drive - that sounds serious and not sure what all this actually is.
No idea what SATA or M2 drive is?
Also not sure how to install Win 10 on what?
All sounds a bit tricky to a novice.
"I suggest you detach the current OS drive (if a SATA, detach the SATA cable. If a M.2 drive, remove it).
On a spare drive, install Win 10 and Superantispyware and Malawarebyte.
Attach the OS drive, boot from the spare drive and run Superantispyware and Malawarebyte."
- - - Updated - - -
Also - might remove some of my anti virus programs = Install only one antivirus solution
I have 3 or 4 now
You needed to heed this statement not run several apps and run application that are not needed, Basically if the malware is a worm with a rootkit which tbh it sounds like the case then it will just compound its probably so deep seated that you won't remove it at this point because the more you use the computer it just continues to bury itself.
I think this is SOL because there is to much noise in the thread, its probably better to look at reinstalling windows. Rootkits are also notoriously hard to detect at times this is why you are getting detection's some of the time and not others and or removing detection's only for the symptoms to re appear down the line.
You really need to band aid the computer along and know your way around a computer to even tackle them, realistically if those apps are not cleaning up then its a bit beyond trying to navigate you through that. Running Minecraft is also not a good idea for example at this time.
Like don't do anything in the computer except the bare minimum so don't run or open anything or uninstall anything or open a web browser or navigate through the computer, everything you do is cause to compound further.
Maybe start by posting logs of the detection's which you will find in the relevant areas of the apps you used. So far you have relayed some redirects and some adware. I think its a dead horse though tbh.
There is some apps that you should run but it feels like to much energy to relay all that currently. This is all assumption because there is no logs but the signs are all there.
You are not going to be able to fix it yourself, so get it to a good PC repairer and explain what is wrong.
They may just remove the HDD and replace it, installing Windows 10.
Essentially just starting again.
They may not want to take the long route of analysis and sorting stuff out, that requires a lot more expertise and time.
How important are the user files, we have no idea. Were they saved to OneDrive or other backup, whatever, we don't know.
Emails maybe on the respective mail servers, we don't know.
If it really is malware and it persists over a hard disk format then it would start coming into bootkit territory which is even more secluded as these are relativity new forms of malware without much remediation to the user.
At that point it would be replacing the whole PC with a new one and burning that old one in a fire so it cannot continue on infecting devices.
I don't think this is the case bootkits are hard to spot because they seem to stem from surveillance so they purposely don't want to be detected by way of visible symptoms just like a rootkit but more severe because its the entry point at boot not just a admin access malware.
After much restarting and virus checking (safe mode an normal) - I've only managed to create the windows on USB to use as fresh installation.
It all now works beautifully.
Now to load on Malawarebyte, AVG perhaps. Also the other PC programs you mentioned to keep PC nice and clean
Thank you all for your help!
There is nothing as a Clean Install to have everything fresh and fast.
You're happy, we are happy.
Now it is time to think about on creating a Drive image backup.
Quote