Strange Processes Slowing Me Down

Please run this and then rerun TDSSKiller:

RKill

Do not reboot. Try to run RogueKiller and Hitman. Let me know what happens.

 

Download and run Autoruns

You will have to extract the contents from the ZIP file into its a new folder you create for it ( like AutoRuns on your Desktop )
Keep the Everything tab selected in AutoRuns.
Then click on the File menu selection and select Save. Save this log file in default format to your Desktop. The default format and filename should be AutoRuns.arn
Now put the AutoRuns.arn file into a ZIP file and attach this ZIP to your next message. ( NOTE: You cannot attach the AutoRuns.arn file. It must be ZIP'ed ).

 

For some reason I cannot open your autoruns log... it appears to be encrypted and needs a key to decrypt. I downloaded 7zip just in case and the log is gibberish.

Have RogueKiller remove that process.

Then reboot and rerun RogueKiller and tell me what issues you still have.

 

Please right click on the AutoRuns.arn file and scroll to "send to" and choose Compressed (zipped) folder. (not 7zip)

 

Please download GMER and save it to your desktop:

• Unzip (extract) it to your desktop.
• Disconnect from Internet and close all running programs.
• There is a small chance this application may crash your computer so save any work you have open.
• Double-click gmer.exe to run it.
• Let the gmer.sys driver to load if asked.
• If it gives you a warning at program start about rootkit activity and asks if you want to run a scan... click NO.
• Click the Rootkit tab.
• Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
• Then click the Scan button. Wait for the scan to finish.
• Once done, click the Copy button.
• This will copy the results to the clipboard. Open Notepad and press CTRL + V to paste the log, and save it to your desktop. Attach this log to your next reply.

NOTE: If you're having problems with running gmer.exe, try it in Safe Mode. This tool works in Safe Mode whereas many other rootkit revealers do not.

 

I did manage to open your Autoruns log and neither of those exe files are in there. Continue on with Gmer.

 

It's related to steam.

Now please download OTL by OldTimer.

• Save it to your desktop.
• Double-click on the OTL icon on your desktopto run it. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the text-field.
  
  Code:

  activex
  netsvcs
  drives
  

• Now click the button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

 

Tim's boilerplate instructions needs updating.. now click the Run Scan button. *Side note: Please try to run any scans in Normal Startup Mode if possible.

 

Crap....images are no longer available. Carry on.

 

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:

:processes
:killallprocesses
:otl
[2017/11/09 11:02:57 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\zadtgpv
[2017/11/09 10:58:20 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\exibrgo
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

 

A copy of an OTL fix log is saved in a text file at :\_OTL\Moved Files

 

C:\_OTL\Moved Files

Run won't find it. Look through File explorer after right clicking Start.

If you can't find it, please just rerun OTL as in post #62.

 

• Copy and Paste the following code into the Custom Scans/Fixes textbox.
• Do not include the word Code

Code:

:otl
[2017/11/09 11:02:57 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\zadtgpv
[2017/11/09 10:58:20 | 000,000,000 | ---D | C] -- C:\Users\OWNER\AppData\Local\exibrgo
:commands
REBOOT

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log from OTL to your next message.

A copy of an OTL fix log is saved in a text file at C:\_OTL\Moved Files

 

OK....that's weird since the original scan did find them. Let's try this:

Please download BlitzBlank to your desktop.
Double-click BlitzBlank.exe to open (If running Vista, Win 7, or Win 8, 10 use right-click and select Run as Administrator)
Press OK at the warning prompt.
Click the Script tab
Copy the text inside the code box below and paste it into the text-field.

Code:

[color=red]DeleteFile:[/color]
C:\Users\OWNER\AppData\Local\zadtgpv
C:\Users\OWNER\AppData\Local\exibrgo

Now click the Execute Now button.
The fix will require a reboot in order to complete successfully.
Upon reboot, locate C:\blitzblank.log and upload this log to your next message.

 

No. That is the old OTL log. You need to find the log located at C:\blitzblank.log

 

Let's try it again, please:

Double-click BlitzBlank.exe to open (If running Vista, Win 7, or Win 8, 10 use right-click and select Run as Administrator)
Press OK at the warning prompt.
Click the Script tab
Copy the text inside the code box below and paste it into the text-field.

Code:

DeleteFile:
C:\Users\OWNER\AppData\Local\zadtgpv
C:\Users\OWNER\AppData\Local\exibrgo

Now click the Execute Now button.
The fix will require a reboot in order to complete successfully.
Upon reboot, locate C:\blitzblank.log and upload this log to your next message.

 

Please follow these steps:

1. Copy all text in the quote box (below)...to Notepad.
   
2. Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"
   delfile.bat <<------------- you should see this on your desktop.
3. Double click on delfile.bat to execute it.
   A black CMD window will flash, then disappear...this is normal.
4. The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted.

Reboot and rerun OTL.

 

Is this what you have when you run BlitzBlank:

 

One more time:

Double-click BlitzBlank.exe to open (If running Vista, Win 7, or Win 8, 10 use right-click and select Run as Administrator)
Press OK at the warning prompt.
Click the Script tab
Copy the text inside the code box below and paste it into the text-field.

Code:

DeleteFile: ReplaceWithDummy
                  C:\Users\OWNER\AppData\Local\zadtgpv
                  C:\Users\OWNER\AppData\Local\exibrgo

Now click the Execute Now button.
The fix will require a reboot in order to complete successfully.
Upon reboot, locate C:\blitzblank.log and upload this log to your next message.

 

Please post a screenshot. If the items are showing up in Designer.....can you not hit execute now?

 

Nothing wrong with what you are doing. Yes, run RKill and then try again with Blitz.

 

Ok...... please right click on start/run/ and type in regedit. Once the window opens, click on edit and scroll to find. In the find box, put in zadtgpv. If it finds it, and is listed in the right column or left, right click and delete. Do the same for exibrgo.

Then rerun RKill and Blitz. Let me know how you get along.

 

Did you find the items in the registry?

 

Did you not do this?

 

Good.....now let's see if you can run this:

Please download and run Emsisoft Emergency Kit.

Double click EmergencyKitScanner.exe to install EEK
When the installation of EEK is complete the Emergency Kit scanner will run.
NOTE: Make sure to enable PUPs detection.
Click "Yes" to Update Emsisoft Emergency Kit
Under "Scan" click-on "Malware Scan".
IMPORTANT: Do not quarantine or delete anything. We just want the scan log without anything being quarantined or deleted.
Save the scan log somewhere that you can find it (desktop).
Exit Emsisoft Emergency Kit.
Don't close out the program until I get back to you after looking at the log.
Attach the log.

 

Good....it came up clean. What issues are you still having?

 

Stop it. Then go to the startup tab and if it is there, and disable it. You can right click it and "go to location" and delete this file: C:\Users\OWNER\AppData\Local\exibrgo

Let me know how you get along.