Avast detected delay.exe

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Twilight450, Mar 17, 2015.

  1. Twilight450

    Twilight450 Private E-2

    I ran a virus scan earlier and Avast detected a file named delay.exe. Avast seemed to have trouble repairing, quarantining, and deleting the file. I just rechecked Avast and the file appears to be in the quarantine chest. My browser (Firefox) also started acting a bit funny as well. I have gotten this error a few times in the last few hours "Content Encoding Error

    The page you are trying to view cannot be shown because it uses an invalid or unsupported form of compression.

    Please contact the website owners to inform them of this problem."

    I downloaded and ran Ccleaner, however the other the programs from the Read Me First thread such as RogueKiller and MGtools and the others I couldn't install. Firefox won't let me choose where to download them to, even after changing Firefox's settings. I tried downloading and installing them anyways but windows prevented me from running it it says it wasn't made for my PC and says to check with the program publisher for a version that can run on my PC. I also tried downloading from different download locations

    My browser is Firefox version 36.0.1
    Windows 8.1 64-bit operating system

    I hope I provided all of the needed information, Thank you for any help :)
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!


    You have to download and run the 64 bit versions of the tools like RogueKiller and HitmanPro.

    Also I suggest that you use Internet Explorer to download them since you are having a problem with Firefox. Firefox may even be blocking you from downloading various files.


    Also note that in the READ & RUN ME FIRST where the instructions for Using MGtools link was given, the below info was posted



    FYI to Firefox users: New versions of Firefox will falsely tell you that MGtools.exe is a virus and it will not let you download it. It also does not let you override this false accusation. Do the below to fix this issue:

    • In Firefox's Menu ( if you don't see the Menu bar then right click on the top area of the Firefox window and select the Menu Bar selection to enable it. Also something that should be enabled by default in my opinion )
    • Now on the Menu Bar select Tools. Then select Options
    • On the Options form select the Security tab.
    • Now uncheck the below check boxe
      • Block reported attack sites
    • Now click OK to save the change
    • Now see if you can download MGtools.exe
     
    Last edited: Mar 17, 2015
  3. Twilight450

    Twilight450 Private E-2

    I have downloaded RogueKiller using Firefox the problem was that Firefox wasn't asking me where I wanted to save it even after changing the settings, thought I was able to change where it saved it by changing settings again. The program won't install though as Windows appears to be preventing it from running as it says "This app can't run on your PC to find a version for your PC, check with the software publisher"

    I checked and it is the 64 bit version I downloaded also the name is RogueKillerX64

    I tried using IE to download MGTools and IE was also preventing the download, I went to the downloads and clicked run, then I received an error that Windows cannot find GetLogs.bat.

    IE version is 11

    I tried using safe mode to run RogueKiller and it just says the same thing and the same if I try to run as administrator.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    POkay but unlike the poor designs in Firefox and Chrome, with IE you can use the Save As option and you can tell it to download anyway. This is done all the time. The only other reason you could be blocked would be due to any protection software you may have running.


    See if you can do the below.

    Please do the below so that we can boot to System Recovery Options to run a scan.

    For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.


    Enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
    Last edited: Mar 17, 2015
  5. Twilight450

    Twilight450 Private E-2

    None of the programs seem to be working :confused
    I was able to download MGtools with IE but even after I downloaded it and tried to run it I received an error that said Windows cannot find GetLogs.bat

    I downloaded the 64 bit version and saved the program to a flash drive and restarted using advanced tools since it wouldn't work using f8 (I think cause of Windows 8 fast boot?)

    I then followed all of your other instructions and when I typed the file name into command prompt I received the same error I received when trying to run RogueKiller, that I need a version for my PC and to contact the Author.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Where exactly did you save and run MGtools.exe from? What drive is it on and in what folder name ( the full path name )? Also what drive letter does Windows run from?

    Please open up a command prompt Window using Run As Administrator and take notice of the prompt being show as this folder is where the out put from the below tests will be saving files. Now run the below commands:

    dir > file1.txt
    dir %systemdrive%\ > file2.txt
    dir %userprofile%\Desktop > file3.txt
    set > file4.txt

    Now please attach the file1.txt through file4.txt files to your next message.


    Will FRST run if you try to run it after booting up into Windows ( either normal boot mode or safe boot mode ) ?
     
    Last edited: Mar 18, 2015
  7. Twilight450

    Twilight450 Private E-2

    Windows is installed on the C drive, MGtools is also on the C drive C:\Users\lilbear450\Downloads\MGtools.exe
    I downloaded it again to the desktop since the MGtools link says to download it to the desktop if you still have problems ‪C:\Users\lilbear450\Desktop\MGtools.exe

    I did what you said in command prompt, I can find the files in windows explorer but for some reason when I try to upload them to the forum they don't show up even if I try to search for them. Can I copy the contents to another notepad file and then try to upload it?

    I haven't tried running FRST yet after booting to windows (I will try normal and safe mode next) Thank you for your help :)
     
  8. Twilight450

    Twilight450 Private E-2

    Ok I tried to run FRST after windows booted in normal and safe mode, with and without command prompt they all gave me the same error that the version isn't made for my PC and to contact the software author. I double checked that the file is FRST64 too so it should be the correct version.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to check for error messages on the Manage Attachments forum to make sure they are uploading. In fact, make sure you click the Upload button too and that the attachments shows in the list on the Manage Attachments form. Sometime people browse to locate the files and they select them, but they forget to click Upload to actually send them.
     
  10. Twilight450

    Twilight450 Private E-2

    What I mean is I can't find the files 1-4 in windows explorers when trying to upload the files to the forum. I included screenshot images to try to explain what I mean.
     

    Attached Files:

  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The files show right there in your second screen capture. You just need to navigate to that folder on the Manage Attachments form by click the Browse button and select the files and then upload them by clicking Upload. (See: HOW TO: Attach Items To Your Post )
     
  12. Twilight450

    Twilight450 Private E-2

    The images are screenshots of the same folder and using the same search term. They show up in windows explorer but not when trying to upload it to the forum.
     
  13. Twilight450

    Twilight450 Private E-2

    Really weird, they showed up without a problem when using a different browser.
     

    Attached Files:

  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay, now that you know how to find and attach these text logs, please continue as follows.


    Please open up a command prompt Window using Run As Administrator (It is critical that you run it this way. )
    • If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
    • Enter the below commands at the command prompt each followed by the enter key. Try each command!!!! The bold black are commands. The purple/brown is merely informational.
      • cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
      • ShowNew <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
        [*]nwktst <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
        [*]analyse <-- this will try to run TrendMicro Hijackthis. Click Twice on the Accept button to accept the license agreement if it shows. Then run a scan and save a log. Tell me what error messages, if any, you see.
        [*]GetRunKey<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
      • getnetinf<-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.
    Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above. Make sure that when you come back that you explain what happened at each step, especially if there are any error messages.
     
  15. Twilight450

    Twilight450 Private E-2

    I received errors for all of the commands also I couldn't find the zip file anywhere I looked in different folders and tried searching for it, but I couldn't find it. I ran command prompt as the administrator as well.

    Here are the error messages

    C:\WINDOWS\system32>cd \MGtools

    C:\MGtools>ShowNew
    Error message:'ShowNew' is not recognized as
    an internal or external command, operable program
    or batch file

    C:\MGtools>nwktst
    Error message:'nwktst' is not recognized as
    an internal or external command, operable program
    or batch file

    C:\MGtools>analyse
    Error message:'analyse' is not recognized as
    an internal or external command, operable program
    or batch file

    C:\MGtools>GetRunKey
    Error message:'GetRunKey' is not recognized as
    an internal or external command, operable program
    or batch file

    C:\MGtools>getnetinf
    Error message:'getnetinf' is not recognized as
    an internal or external command, operable program
    or batch file
     
  16. Twilight450

    Twilight450 Private E-2

    Oh I forgot to add that I don't remember downloading Hijackthis should I have downloaded it? I entered the command anyways though like you said to do.
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No!

    It seems that the programs files are not in the MGtools folder. Let's check.

    Please open up a command prompt Window using Run As Administrator (It is critical that you run it this way. )
    • If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
    • Enter the below commands at the command prompt each followed by the enter key. Try each command!!!! The bold black are commands. The purple/brown is merely informational.
      • cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
      • dir > filelist.txt
    Now attach the filelist.txt file to your next message. It should be in the C:\MGtools folder.
     
  18. Twilight450

    Twilight450 Private E-2

    Here is the file
     

    Attached Files:

  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I was right! Most of the files required for MGtools to work properly are missing.

    Now download the current version of MGtools and save it to the existing C:\MGtools folder.

    Now open up a command prompt window again As Administrator and run cd \MGtools again to get into the MGtools folder. The prompt should change to C:\MGtools when you are correctly in the folder.

    Once in the folder, type the below to run MGtools.exe

    MGtools.exe

    Le me know if you receive any error messages! Let this run until it finishes. It can take as little as 5 minutes or up to an hour depending on your PCs speed and how much is running and how many files/folders on your PC.


    Now attach the below logs:
    • C:\MGlogs.zip
    If you don't see the C:\MGlogs.zip file see if there is one on your Desktop. If neither of these exist then look in the C:\Mgtools folder for a file named MGlogsR.zip and attach it.

    If none of the above ZIP files exist then please rerun what I had you run in my previous message to create a new filelist.txt
    log and attach it.
     
  20. Twilight450

    Twilight450 Private E-2

    It worked this time!
     

    Attached Files:

  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Based on this log and the description of the problems you have posted, I don't believe that you are having malware problems. Seems more like issues with Windows and/or your browser corrupting downloads.

    You may be better off discussing your problems in the Software Forum.
     
  22. Twilight450

    Twilight450 Private E-2

    Ok, thank you. What about the file that Avast detected?
     
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Without seeing a log that shows exactly where the file was located and more information on it, I cannot comment. It could have been a false detection or it could have been real. If the latter and already removed then there is nothing to worry about. If it was a false detection then it could have broken some program that is installed on your PC.
     
  24. Twilight450

    Twilight450 Private E-2

    Ok thank you
     
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Let's just cleanup from what we had you run now.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     
  26. Twilight450

    Twilight450 Private E-2

    I'm wondering since the PC is still having problems should I reverse all of that now or wait until everything is fixed? Thank you for your help
     
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should complete my final instructions because you are not having malware issues.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds