Malware hunt gone wrong... Help!

[ThatOneCollegeGuy96]

When it happened?

I had just finished restoring immunizations from recently added "Spybot" (I'll explain why later), and because I know next to nothing about what was quarantined (from yesterday's scan), I opted to restore that as well (note: they were all usage tracks, nothing more), when asking about each file for confirmation (was still reviewing the first file, at the time of the "incident"), I was also searching google for a better understanding of what the heck it was I was about to restore, suddenly google stopped loading, aaand.... BOOM...BSOD...

"SYSTEM_SERVICE_EXCEPTION"

Why was I doing this?

Well some background may help, I Received a virus a few weeks back, from an infected DDU download file ("Win32.Vigram.A"), fortunately defender caught and removed it, but I have since then started a war, cleaning my computer and attempting to root out any possible lingering threats. Some of the programs i used include: Adwcleaner (found 7, I believe??), ESET (found and quarantined a couple other things), Hitmanpro, Malwarebytes, switched to kaspersky, ublock origin, couple other things? (I did save some of the scan logs, if interested in results)... Now, about a week later after sifting through a bunch of recommendations, reviews, and combos. I have decided on:

NOTICE (#1= Why restore?):

1) "SpyBot's Windows 10 privacy software" -- (NOT SPYBOT SAD2! - but like the idiot I am, that is exactly what i got instead-- which is just bloat in culmination with the rest listed below.)--- Thus, that is the reason for restoring all of the changes it's made, to prevent issue with uninstall.


2) Windows Defender Antivirus as main AV/AM/AS etc. (W10 Creators)


3) Windows Firewall as always


4) Kaspersky anti-ransomware tool for business free


5) Malwarebytes anti-exploit free


6) uBlock Origin (proactive safe web)


7) Malwarebytes free for on-demand scan

8) Glasswire
 

Thus far I have taken care of 3-8: i wanted to remove spybot before continuing on to removing Kaspersky AV and switching back to defender.

My best guess is that when i removed the immunizations a massive change was recorded and adjusted in SYSTEM32 (as was noted at bottom of screen by either kaspersky or glasswire, idk which), but because I was not prompted to restart I just continued on.... but then again, i may be way off base here, and it may be something more deeply rooted, once again i have no idea what the heck i am talking about, but these are my observations....

Sorry about the long post, i hope this was an appropriate post for here. If additional information is required please let me know! Any help/recommendations/Input as to how I should proceed is welcome!

Thank you!

EDIT: I have since restarted my computer... first thing I noticed was that it took a few minutes for desktop background (slideshow) to show up.

IMPORTANT UPDATE: After 20-30 minutes of browsing, my computer is now showing a BSOD... again  

 

[camieabz]

I would boot to safe mode and examine the startup programs list using MSconfig or CCleaner. Disable any of the programs that you want disabled, and try a reboot. If that 'seems' to help, go back into safe mode and uninstall each program, and reboot back to safe mode. Uninstall, reboot, uninstall, reboot. Don't do many at once.

If you can't get to safe mode you'll need to look into Windows repair.

 

[aldan]

try a system restore to before you did this and get rid of spybot.this program hasnt been relevant for quite some time.all you should need is the windows firewall,defender (i use avast free),and malwarebytes.more antimalware programs do not equal more protection.did you in fact register some infections with these programs and if so,what were they?

 

[smashjohn]

At some point you just have to throw in the towel and perform a fresh install. Sometimes when viruses infect certain files, the cleaners quarantine or remove those files, but they are critical to windows operating correctly.

 

[ThatOneCollegeGuy96]

@camieabz ok, thanks, I'm doing it now. No problem in startup, but I did disable Spybot and Shadowplay...
On to the uninstall of spybot, I am currently going through the quarantine list (painstakingly slow), since once again I have to search everyone...

Should I just restore all of them, and scan again later with my desired programs?

Or would it be better or safe to purge all of them, and possibly use sfc/scannow down the road if there's an issue?

Any experience with this and what I should do?

Thanks again for helping.

 

[ThatOneCollegeGuy96]

Upvotes all around! Lol, that was kind of an accident, but thanks for the responses!

@aldan

I just went ahead and followed the first suggestion and undid, all of the changes I have made, because to your point; it's not worth it anymore. Then I uninstalled it in safemode with revouninstaller.

Though, if problems stil persist, i will definitely follow your suggestion and go to a previous restore!

And how do you mean by did i register infections with these programs??
Like, did they report any infections, or were they reported as infections?? Ooor am I way off?
Sorry for the confusion.

 

[aldan]

no,did these programs find any infections?if not i wouldnt worry.if in doubt run windows defender scan and a mbam scan and quarantine away so to speak.if nothing found,no worries.

 

[ThatOneCollegeGuy96]

@ aldan

I gotcha. Yeah, as noted above, over the last few weeks (all of which were quarantined) with like 16 from adwcleaner, and a few more from eset...
Problem was not fixed, however
I posted a new thread for the NEW issue, but you would just need to look at the 1st paragraph/TL;DR, the rest you know...

But ultimately, I followed your advice, and wound up restoring my PC, BSOD'S stopped, but TOTAL freezes began + and more serious glitching (i.e. internet no longer auto connecting + and disconnecting while updating MWB (got it through eventually)...
Possibly some light though, time after switching back to defender, and running initial quick scan, and a restart, I was notified that...
"Trojan:Win32/Bitrep.B" was detected - Threat level: Severe
Quarantined... Full scan/Offline scan - nothing... I haven't done anything since.
Also "performance and health" displayed that 1 or more apps have stopped working - with an option to troubleshoot.
Am I safe? What now?

 

[boju]

MERGED QUESTION
Question from ThatOneCollegeGuy96 : "Trojan detected! - Windows 10 Defender- "Trojan:Win32/Bitrep.B"!! What next??"

Some related background...

I had just went to a previous restore point today, and switched back from kaspersky to windows 10 defender earlier today. After doing so i ran a quick scan (nothing), got busy, powered down, came back, ccleaner, malwarebytes scan.... finished, no issues found.... BOOM (right there after mwb scan) Windows Defender notified me that my system was infected with "Trojan:Win32/Bitrep.B"- Threat level: Severe. I promptly quarantined it, and then without restarting, running ccleaner, OR checking a secondary notice from windows "performance and health" - that 1 or more apps have stopped working (something long those lines) with an option to troubleshoot, (1 or more apps have stopped working) (after a quick google search on phone of the trojan) I near IMMEDIATELY went to run a full scan - which is ongoing as I type...
As is inferred by immediately running the full scan... I have not yet restarted; ran ccleaner; OR attempted to deal with a secondary notice from windows "performance and health" - stating that 1 or more apps have stopped working (or something along those lines), which then provided an option to troubleshoot...

Some relative background...

The windows restore and switch back to defender, was as a last ditch effort of sorts (less, full system reinstall), as a few weeks back windows defender caught and removed/quarantined a "virus" from a corrupted ddu download file ("Win32.Vigram.A").
I have since then started a manhunt cleaning my computer and attempting to root out any possible lingering threats (as after all basic windows scans, I started to notice weird glitches, more on that in the next paragraph)... Starting with a switch to "Kaspersky" and then using such programs as.... Adwcleaner (found 16 over the whole period I believe??), ESET (found and quarantined a couple of things), Hitmanpro (0 serious results), Malwarebytes pro trial, but now free (0), malwarebytes anti-exploit, ublock origin (preventative), glasswire, superantispyware, and OF NOTE: spybot (THIS BITCH=reason windows restore, more on that at the end). Also, I did save some of the scan logs, if interested in results...


I was STILL noticing some minor odd hickups (though tbf I have been hyper vigilant) such as: the icons/background flickering/flashimg/refreshing, seldomly, but randomly, or when opening programs like malwarebytes (which, also seems to start up slower now), and a couple others, and ESPECIALLY when opening "file viewer" which has now often taken a couple seconds to open, and then when double clicked it would open 2 windows (like, spastically lol). ONCE AGAIN, although these and a few other weird random glitches have been occuring, i have been hypervigilant and they may have been overlooked by others...

As mentioned previously, the last straw came after installing "Spybot- Search and destroy", which was a stupid mistake on my part as I meant to download JUST  "SpyBot's Windows 10 privacy software", no the whole out of date sha-bang...
So after recognizing this I went to restore the changes it's made in immunizations and quarantine, before uninstalling it...
After restoring immunizations, and while helplessly reviewing the quarantined files (all usage tracks -_-) before restoring...
BOOM... BSOD...("SYSTEM_SERVICE_EXCEPTION")
My guess why? -- The massive change in System32 from restoring the immunizations (as noted by glasswire)??? but what the fuck do I know, I did just find a trojan afterall.
Despite my best efforts...
It KEPT happening!!
Thus, I gave in and just restored the quarantine list; uninstalled; and went to my last windows restore point. (unfortunately, the last executable point was only from a couple days ago, which was at least before BSOD, and the May update)...

Conclusion (almost there!)....

The windows restore, proved worthless... Though it worked well at first (at least comparatively, no BSOD'S!) and to my delight it also successfully updated windows this time around!
But the fun didn't last...
The next morning when casually using PC, it COMPLETELY froze! While trying to figure ou the the problem, IT happened like 4 MORE TIMES!! + MORE weird shit---
Namely when trying to update MWB, internet disconnected!; and I had to keep manually reconnecting to work + chrome windows "ghosting" close...

COMING FULL CIRCLE NOW!

I nearly gave up, when I FINALLY got around to uninstalling kaspersky, and going back to Defender! Which (seemed?) reluctant at first, after a break, and a scan, and a... you know the rest...

While posting I have now had the time to complete the full scan and run an offline scan, both of which found no threats...

I am now terrified to even breathe on my computer, and haven't done ANYTHING else since scanning...

My question to all of you who braved the journey of the neverending post, is...
Am I safe????
And... What should I do next????

Thank you all so much for taking your time to make it tothis point!!

Any input is welcome!




TL;DR:

My windows 10 laptop has increasingly become more "glitchy" going from minor odd/slight/random glitches and behavior... to... BSOD "SYSTEM_SERVICE_EXCEPTION"... Despite my inexperienced, yet best efforts with cleaners ...
All of these problems, originated from a DDU virus caught and removed by defender a few weeks back...
Now... shortly after going back to defender from kaspersky, defender has caught and quarantined... "Trojan:Win32/Bitrep.B"
No action has yet to be taken on my end...
Am I safe???
What do I do next???
Thank you.

https/linustechtips.com/main/topic/918609-ddu-display-driver-uninstaller-tool-is-infected-with-a-virus-or-im-wrong/

Where did you download ddu from?

https/linustechtips.com/main/topic/918609-ddu-display-driver-uninstaller-tool-is-infected-with-a-virus-or-im-wrong/

Where did you download ddu from?

Thank you for responding!
Sorry, about the late response! phone died!

Wagnardsoft, the DDU official website. I did look into it some and there were multiple users with the same malicious fie caught by Windows, the problem has since then been resolved, and i was lucky, as after downloading it i wanted to move it to the desktop, but when i tried it spased the heck out, which made me reaaaly wanna delete it, after trying to remove this demon file for a while, i was finally able t get it into the recycle bin and delete it, with CCleaner; and b/c I'm an idiot, i didn't run a defender's scan right then after, and thought it was dealt with, but fortunately before logging off windows ran an automatic scan, and the rest is history...

BUT I think I found the real problem (not to negate the fact that vigram.a didn't play a role, as it may have!). It makes a lot more sense too, but I was so hell bent on the idea tat it had to be the DDU file, that i didn't even consider other possibilities....
While reviewing the "Trojan" description i noticed it's source was a paint.net ZIP plugin I installed! What's more, is that I dowloaded "paint.net" and this zip plugin about 2 weeks ago, which is more or less when the degradation started occurring, but i just assumed it was DDU, b/c that was stil very recent + i did take care to scan the plugin file folders, but kaspersky/MWB showed nada....
Anyways, i personally think that has been the issue, the worrisome thing is that even though the crashes did STOP, it was definitely not free of problems (weird screen flickering/chrome ghosting close+stutter start/ etc, etc, VERY glitchy). After a barrage of different scanners I finally decided to try out "roguekiller" (deleted 5 PUM (one was for an altered registry: DNS - DhcpNameServer (the altered IP ending with ([]) , idk what that is???? but it sounded sketch), but nothing else was reported... after i did all that I could do (atleast, with my llimited knowledge)
I went ahead and ran... "SFC /scannow"...
A literal crap TON, possibly infinite, # of entries were detected and repaired!!
It then ran noticeably smoother, but definitely still janky, so i did a few final scans, and "Installed Malwarebytes anti-exploit protection free" (for 0 day protection), and gave my computer a much needed break...

I am now back, and i'm happy to report that the the difference is night and day! BUT though it is good now, I am still not 100% (hasn't been long enough to tell) Escepically, since, the trojan had a fair amount of time to sink its roots into my system + though it was nice to see that most of the problem lied within corrupted system files, it's also disconcerting that there are possibly other files from my logs (SFC/roguekiller/etc) that dictate an underlying problem, which would require the expertise of a more experienced user, to sort through...

Am i probably safe, or do you think there is a lingering issue, and if so, what should i do?

Sorry about the length, i wanted to be as descriptive as possible...



NOTE:
1 more thing i forgot to mention!! When i pulled up the troubleshooter for "performance and health" as directed, it
Showed...
Temporary internet file has changed...FIXED... Reset to default... Completed
Hanging or crashing apps... NOT FIXED.... reset hanging or crashing apps... Completed
--- Noting... Problem with BITSservice- the requested service has already been started

Though, idk if this is really anything of note, given the progress made thereafter...

The link i posted was to demonstrate ddu being detected as a false positive, youre not the first to discover. With all the scans and multiple rounds of registry clean ups have done more harm than good.

Should do a fresh install of Windows