I have a VERY powerful virus on my computer and need help

[NateTheKingIV]

So here's my problem, I've obtained a virus due to my stupidity last Sunday (12/3/17), and i'm gonna need help getting rid of this. This is a virus that isn't like any other. It prevents me from downloading certain antiviruses, prevents me from reinstalling windows the normal way (can only do that by tapping shift + F8 upon start up), it prevents me from ending it's task, and plainly deleting it in it's file location. This virus will spawn the Windows Process Manager (32-bit) thing that slows down my computer immensely after about a day. I've spent the past 6 days trying to get rid of this virus. I've tried various anti-viruses that I was able to install like, AVG, EMSIsoft, and Malwarebyes, but they all didn't do a thing. I'm looking for assistance in my problem so that this can be solved. I should mention that I don't have the money to buy anything.

If there's anyone who's willing to help me with this, it would mean the world to me, because I'm very upset that this has happened


The "(TOSHIBA CORPORATION) C:\Windows\System32\ticnkwlsvc.exe" found in the FRST.txt, That's the virus that I'm dealing with. It's name has been changed each time I've reinstalled windows. If I need to provide evidence on how I know, I can indeed do that at anytime.

 

[NateTheKingIV]

I should mention that during the time of the Farbar scan, the windows process manager wasn't on my computer at that moment, but it is now. so I've decided to do another scan just in case. (the 2 .txt files are different from the first two if it actually matters)

 

[NateTheKingIV]

Idk if this'll help but here's the locations of the windows process manager virus, and the location of the virus that spawns the windows process manager virus, ticknwlsvc.

 

[TwinHeadedEagle]

Hello,

You will need to download FRST tool on clean computer and to transfer it to the USB drive.


Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Click Start and while holding Shift key on your keyboard click Power --> Restart.

Note: It is important that you keep Shift key pressed while doing this or it won't work.​

• Now you should get a window like this where you need to click Troubleshoot.

• In the next window, click Advanced options and select Command Prompt.
• Now you should log in into your account and after that Command Promptwindow.

Access the notepad and identify your USB drive

In the Command Prompt please type in:

notepad

and press Enter.

• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.
• Note down the letter and close the notepad.

Scan with Farbar Recovery Scan Tool

Once back in the command prompt window, please do the following:

• Type in e:\frst64.exe and press Enter.
  You need to replace e with the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.
• When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.

Transfer it to your clean machine and include it in your next reply.

 

[NateTheKingIV]

Hello,

You will need to download FRST tool on clean computer and to transfer it to the USB drive.


Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Click Start and while holding Shift key on your keyboard click Power --> Restart.

Note: It is important that you keep Shift key pressed while doing this or it won't work.​

• Now you should get a window like this where you need to click Troubleshoot.

• In the next window, click Advanced options and select Command Prompt.
• Now you should log in into your account and after that Command Promptwindow.

Access the notepad and identify your USB drive

In the Command Prompt please type in:

notepad

and press Enter.

• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.
• Note down the letter and close the notepad.

Scan with Farbar Recovery Scan Tool

Once back in the command prompt window, please do the following:

• Type in e:\frst64.exe and press Enter.
  You need to replace e with the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.
• When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.

Transfer it to your clean machine and include it in your next reply.

Okay, so i've done it. I feel like i should mention that holding shift and pressing power then restart didn't get me that menu probably because of the virus, i had to turn off my computer and on start up press shift and F8 at the same time repeatedly to get to that menu. I should also mention that i've done a few reinstallations of windows and factory restoring to try to fix the problem myself, but i won't do that again now that i have your attention. The virus is still here, nothing has changed except for the name of the virus that starts it. ticnkwlsvc's name has been changed to remiswbsvc. The name of the task, and folder of igfxmtc has remained the same. The folder where the Windows Process Manager thing is located has had a name changed which changed from wdrlzei, to vdkxges (remember, these changes were only because of resetting). properties of these things have remained the same.

During these reinstallations and factory restoring, i was able to learn a few things about this virus; idk if this info will be helpful. When everything is reset, the virus whose name changes every time doesn't show up right away; it shows up in task manager and in the system32 folder after an hour or two, but after resetting multiple times, idk if this is a coincidence, it seemed to get faster and faster at showing up in task manager and in the folder. When remiswbsvc showed up today, I wanted to take note of a few things (again, idk if this'll help). When remiswbsvc showed up after about a few seconds today after resetting, I was only protected by McAfee, the anti-virus that comes with the computer after resetting. I took note that remiswbsvc stood at a stable 2.5MB memory usage, 0% CPU usage, 0MB/s disk usage, and 0Mbps networking usage while having McAfee's Lockdown setting on, which blocks EVERYTHING from obtaining internet access. After disabling the firewall and real-time scanning in McAfee, remiswbsvc's memory usage went up to 2.9MB memory usage and started using a tiny amount of CPU usage, like, between 1.3%-3.5% and after about a minute after that, igfxmtc showed up in the task manager with it's folder also appearing in the Appdata/Local folder. In task manager, igfxmtc stood at a stable 0.7MB memory usage while everything else at 0. The igfxmtc didn't react to the turning on and off of the firewall and real-time scanning, but remiswbsvc seems like the only one that does. After seeing that, I waited to see when the Windows Process Manager (32-bit) would show up in task manager, but it didn't. I was a little confused by this because the folder that it is suppose to located in was there (vdkxges); still unable to access it (I should mention that the vdkxges folder wasn't there until I disabled the McAfee firewall and real-scan earlier as i said with remiswbsvc). I decided restart my computer (Still with McAfee's Lockdown setting enabled) to see if that would somehow start Windows Process Manger. It didn't... But what did happen was that McAfee's firewall got automatically turned off, even though I turned it on before the restart, I'm pretty sure the viruses did that. After disabling McAfee's lockdown setting and restarting again, I checked the task manager, and remiswbsvc was using CPU, Memory, Network, and a lot of disk usage; and then i witnessed the appearance of multiple Windows Process Manager (32-bit) clients.

Anyways, hopefully that doesn't annoy you, and again, now that i have your attention, i won't reset my computer again unless I get a say so from you. So here's the new FRST.txt from EXACTLY what you told me to do with downloading FRST on a clean computer and transferring it onto a flashdrive and using cmd in the advanced menu, and again, the virus prevented me from accessing it while doing the 'holding shift and restart way'. I had to tap shift + F8 during startup. (The picture i sent was taken before Windows Process Manager showed up in task manager(also with a new description of imnsvri instead of vdbhpsm), but the FRST.txt file uploaded was after Windows Process Manager showed up)

 

[TwinHeadedEagle]

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>> Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your USB flashdrive.

>> Exit out of Recovery Environment and post me the log please.



Try to boot Windows normally...

 

[NateTheKingIV]

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>> Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your USB flashdrive.

>> Exit out of Recovery Environment and post me the log please.



Try to boot Windows normally...

Done. I got the fixlog. After booting windows normally, i checked the task manager, and igfxmtc isn't running, which i'm sure is a good sign. Also remiswbsvc (The thing whose name changes after every reset) isn't running in the task manager either! I then check the system32 folder, and i saw that remiswbsvc IS still in there, but again, not running in task manager, which also might be progress. Also when i hovered my cursor over remiswbsvc, it didn't show "company: TOSHIBA CORPORATION" like it used to, nor the file version which also might be progress. I checked the Appdata/Local folder, and the igfxmtc folder isn't there and the vdkxges folder, the folder where the Windows Process Manager (32-bit) is located, also isn't there. I try to see if i could create restore points the normal way without going into a recovery environment, and i could! and i couldn't do it before. so i try to see if i can install Comodo anti-virus, which i have the installation file saved, and it was extracting, then it stopped. i looked into the task manager and there was something new, wdeszuisvc, and right when it appeared, it was using CPU, Memory, and Disk. i check the system32 folder, and there it was, i hover my cursor over it and there it was, "company: TOSHIBA CORPORATION." It seems to be some sort of replacement for remiswbsvc. I should mention that wdesziusvc is in the system32 folder WITH remiswbsvc. remiswbsvc is still dead, it wasn't running in the task manager. I went to the Appdata/Local folder, and the igfxmtc folder came back along with a replacement for vdkxges which is now called wibxtrg. After hovering my cursor over those folders, both folders claim to be empty, when trying to open them, access is denied. In task manager igfxmtc isn't currently running. I should mention that McAfee's Lockdown feature is still on, and i'm guessing that if i turn lockdown off wdesziusvc will spawn the igfxmtc application that'll run in task manager. Idk if wdesziusvc was created because i tried installing Comodo, or if it was a coincidence that it appeared at the same time as when i tried installing Comodo.

(I was typing the section above as i doing those things)

So here's the Fixlog along with a few pictures. Should i try the Fix thing with FRST again?

 

[TwinHeadedEagle]

Let's make a MalwareBytes scan:

Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Quarantine Selected button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the Reports tab.
• Double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

 

[NateTheKingIV]

Let's make a MalwareBytes scan:

Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Quarantine Selected button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the Reports tab.
• Double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Done. The scan detected 0 threats even though there is totally something. idk if it's because igfxmtc isn't running in task manager, and/or if it's because Windows Process Manager (32-bit) isn't running in task manager. I still have McAfee's lockdown feature on on the infected PC which, again, prevents everything from accessing the internet.

Here's the txt file you asked for from exactly what you told me to do. I titled it ScanLog.

 

[TwinHeadedEagle]

Okay. One more check:

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[NateTheKingIV]

Okay. One more check:

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

Done. I just wanna remind you that the Windows Process Manager (32-bit) an igfxmtc isn't running in task manager due to wdesziusvc not getting internet access and it not spawning them. I do still have McAfee's lockdown feature on which prevents internet access for everything on the computer (I explained this in a previous reply). Idk if having Windows Process Manager and igfxmtc running in the task manager would change any needed info in the FRST and Addition txt. Also just to let you know, i've been communicating with you by using my sister's computer and remaining to cut off internet access for the infected PC, My computer. So i've been tranfering files back and forth between computers so send to you and to bring back to the infected PC. I'm pretty sure that wouldn't change anything, but i thought i'd let you know.

So here are the txts. I transferred FRST64 onto my flash drive, plugged it into the infected PC, put FRST64 on the desktop, then ran it, and brought back the files to my sis' PC.

 

[TwinHeadedEagle]

Let's see if this is going to clean up the remnants:

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[NateTheKingIV]

Let's see if this is going to clean up the remnants:

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

So i did what you told me word by word, but it didn't do anything. I put the fixlist in the same location as FRST, on the desktop. When i pressed the fix button, it was finished in a split second with nothing changed.

Here's a picture and the Fixlog. In the picture, you'll see remiswbsvc, but don't worry about it, it's dead from an earlier fix. It's wdesziusvs that's part of the virus.

 

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[NateTheKingIV]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

I decided to turn McAfee's Lockdown feature off ,which gives anything on my PC internet access, so that wdesziusvc could spawn igfxmtc and the multiple Windows Process Manager (32-bit) clients, which it did. I felt that it would help you catch some things in the FRST and Addition txts and help improve the fixlist you would make for me.

So here's FRST and Addition txts you asked for along with a picture of task manager to show windows process manager. A thing you might wanna take note of, is that sometimes one of the Windows Process Manager things are treated as an app (shown in picture). (igfxmtc isn't in the picture, but trust me, it's running in task manager.)

 

[TwinHeadedEagle]

Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Quarantine Selected button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the Reports tab.
• Double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

 

[NateTheKingIV]

Scan with Malwarebytes' Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Quarantine Selected button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the Reports tab.
• Double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Done, when scanning, it detected two threats which were both named rootkit.agents. I clicked the quarantine button and had to restart, so i did. this was probably because I had McAfee's lockdown feature on the first time we did this.upon restarting, Windows did an update. Thought i should mention this because idk if it'll affect the quarantine by malwarebytes or not. After the restart was complete, I checked the task manager to see if the Windows Process Manger clients were still there, and they were, along with igfcmtc, and wdesziusvc. I did another scan to see if somehow the rootkit.agents revived themselves, turns out they didn't. The second scan detected 0 threats, idk if this is temporary; hopefully not.

Here's the Log from the initial malwarebytes scan (NOT the second one to test to see if the rootkit.agents came back), I titled it ScanLog2 this time.

 

[TwinHeadedEagle]

How is the situation now?

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[NateTheKingIV]

How is the situation now?

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

The situation is currently still the same as we began; computer is still slow, and I can't end any of the viral tasks. I sent some pictures with describing titles for clarification on the current situation. again, things are still the same, and has been the same.

Here is also the new FRST and Addition txts you asked for.

 

[NateTheKingIV]

Hello?