Struck down by nasty and clever virus

Welcome to Major Geeks!

The first thing you have to do is stop randomly running things. This will not help and will eventually just make every program on your PC be unusable. These infections require very control methodical steps to fix and even then they can leave residual damage behind which could mean a format/reinstall will be require. The infection replaces system files with their own copies and the first step is to identify which system file and repair it. Then steps can begin to try and recover from remaining damage. Please do the below to get started:

If something does not run, write down the info to explain to us later but keep on going.

• Do not assume that because one step does not work that they all will not.

Now download this Win32kDiag and save to your Desktop.

• Double-click the Utility to run it and and let it finish.
• When it states Finished! Press any key to exit, press any key to close the program.
• It will save a Win32kDiag.txt file to your desktop automatically. Attach this log file to your next message.

See: HOW TO: Attach Items To Your Post


Now download SysProt AntiRootkit

This is a ZIP file so unzip onto your Desktop which should create a SysProt folder on your Desktop.

• Open the SysProt folder by double clicking it
• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box, make sure to select and unselect the following items.
  • Process << Selected
  • Kernel Modules << Selected
  • SSDT << Selected
  • Kernel Hooks << Selected
  • IRP Hooks << NOT Selected
  • Ports << NOT Selected
  • Hidden Files << Selected
• At the bottom of the page
  • Hidden Objects Only << Selected
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Attach the SysProtLog.txt log file to your next message.

Note:

To avoid additional delay in getting a response, it is strongly advised that after completing the above instructions that you also read this sticky:

• Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.​

​