BLEEPINGCOMPUTER NEEDS YOUR HELP!
BleepingComputer is being sued by Enigma Software because of a negative review of SpyHunter.
A case like this could easily cost hundreds of thousands of dollars. If we have ever helped you in the past, please consider helping us. To learn more and to read the lawsuit, click here.
CONTRIBUTE TO OUR LEGAL DEFENSE
All unused funds will be donated to the Electronic Frontier Foundation (EFF).
LET OTHERS KNOW
NVIDIA Optimus Problems After Virus Removal
Posted 28 April 2012 - 12:25 AM
To make matters as simple as possible, let me explain the situation:
I own a laptop which I use at home for HD family video editing. It's a Dell XPS 15 L502X with a 2nd Generation Core i7-2860QM and an Nvidia Geforce GT 540M with Optimus Technology running on Windows 7 Home Premium 64-bit. The NVIDIA Optimus technology is supposed to switch between Intel HD Graphics and NVIDIA Accelerated Graphics when the application demands it. Therefore, it is of great importance to me to have this technology working, since editing 1080p footage using the Intel HD Graphics is not a pleasant experience.
However, this laptop got infected with a nasty virus, which stole some of my information, including credit card information and other sensitive data. I sent the computer to repair, but this bore no results. The person trying to eliminate the virus said he was unable to do so and thus he recommended to reinstall Windows completely. The problem is, I have gigabytes of valuable data in this computer accompanied by a lot of software I would not even want to start reinstalling. Thus, I turned to the IT person at my work, which took the laptop for the day and ran some tools to clean it. To my surprise, he was able to remove the virus and my computer was completely normal and stable. However, it was only a week after (yesterday) when I went to edit some footage that I noticed that my NVIDIA card was not running when needed. I tried forcing the card (by making it the default graphics card for every application) to run, but with no results. This is when I called the guy that removed the virus to ask him if he knew anything about this and he said he would check online. An hour later he calls me saying that one of the tools he used (Combofix) may have corrrupted my registry and so it may have rendered my graphics card useless. He told me the only solution would be to reinstall windows (Again, not an option)
So now, here I am, turning to this great forum in looks for an answer. I am willing to provide any information regarding what the IT person did (I told him I would contact a forum, so he provided me with everything he did).
I hope this issue can be resolved...I trust you guys!
BC AdBot (Login to Remove)
Posted 28 April 2012 - 10:13 AM
Please post the ComboFix log(s), they should be located at C:\ComboFix.txt
if there are any other tools/logs that were used, please post them
then run the following diagnostic tools:
Please download DDS from either of these links
and save it to your desktop.
- Disable any script blocking protection
- Double click dds to run the tool.
- When done, two DDS.txt's will open.
- Save both reports to your desktop.
Please include the contents of the following in your next reply:
Please download aswMBR to your desktop.
- Double click the aswMBR.exe icon to run it
- When asked if you want to download Avast's virus definitions please select Yes.
- Click the Scan button to start the scan
- On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
- You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well
Posted 28 April 2012 - 01:02 PM
Yes, I tried updating the NVIDIA as well as the Intel HD Graphics drivers, but to no avail...
The logs you asked for are attached to this post.
Also, one more thing to mention. The folder "Qoobox" was created in C:\, and that contains the Combofix logs, some quarantine folders, and also a Snapshot.(numbers).dat file which is the biggest file in the folder.
Thank you for your help!
Posted 28 April 2012 - 04:47 PM
see if you can download and install the drivers you need, there doesn't appear to have been anything deleted by ComboFix related to nvidia
qoobox is the ComboFix quarantine.
have you tried doing a system restore back to before you encountered this issue?
even if you have to restore back to an infected state, then we can see what the issue might be with nvidia, it may have been corrupted.
Posted 28 April 2012 - 06:58 PM
Is there any ways I could go back using the Combofix log to restore whatever was deleted or changed?
I tried uninstalling my current drivers, and installing the same ones again. I also tried installing the new "beta drivers" but also to no avail...
Also, maybe it could be a registry issue?
Edited by DonJota, 28 April 2012 - 06:58 PM.
Posted 28 April 2012 - 08:27 PM
Posted 28 April 2012 - 09:19 PM
Press the WinKey + R to open a run box > and copy/paste the following bolded text into the Run box and click OK:
A report should pop open for you. Please post the contents in your next reply.
Posted 29 April 2012 - 01:00 AM
2012-04-24 03:46:49 . 2012-04-24 03:46:49 604 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-ATR_72500.reg.dat
2012-04-24 03:46:43 . 2012-04-24 03:46:43 80 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-SynTPEnh.reg.dat
2012-04-24 03:46:43 . 2012-04-24 03:46:43 92 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Toolbar-Locked.reg.dat
2012-04-24 03:46:34 . 2012-04-24 03:46:34 104 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-Toolbar-Locked.reg.dat
2012-04-24 03:44:21 . 2012-04-24 03:44:21 22,277 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2012-04-24 03:40:33 . 2012-04-24 03:40:33 51 ----a-w- C:\Qoobox\Quarantine\catchme.log
2012-01-16 17:33:10 . 2012-01-16 17:33:11 1,173,991 ----a-w- C:\Qoobox\Quarantine\C\Users\Jesus\Downloads\f1_Fsx_vcrainfix.exe.vir
2011-12-31 03:38:36 . 2012-01-06 19:35:39 1,220 ----a-w- C:\Qoobox\Quarantine\C\prefs.js.vir
2011-12-21 20:09:27 . 2012-04-18 15:23:43 737,280 ----a-w- C:\Qoobox\Quarantine\C\Windows\iun6002.exe.vir
2011-12-10 07:30:51 . 2012-04-22 02:45:13 294,912 ----a-w- C:\Qoobox\Quarantine\C\Users\Jesus\AppData\Roaming\chrtmp.vir
2007-11-07 12:03:18 . 2007-11-07 12:03:18 562,688 ----a-w- C:\Qoobox\Quarantine\C\Install.exe.vir
Posted 29 April 2012 - 06:43 AM
(I'll restore the files that are likely infected too,then I'll have you download a new version, see if the same files are targeted or not)
Please do the following:
to restore the registry Items, it is a little more complicated, but please do this
Open Windows explorer and navigate to this folder
In the right hand panel, locate these files
you will need to delete the extra extension so the file ends in .reg just like the first file on the list.
for C:\Qoobox\Quarantine\Registry_backups\AddRemove-tsimtnccxx.reg.dat remove the .dat so you have this remaining
To do that right click on the files, select rename
- remove only the .dat from the end of the filename
- left click near the file name to ensure the rename is correct
- Do the same for each file listed
- Next double click the renamed files to ALLOW them to merge into the registry
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
DEQUARANTINE:: C:\Qoobox\Quarantine\C\Users\Jesus\Downloads\f1_Fsx_vcrainfix.exe.vir C:\Qoobox\Quarantine\C\prefs.js.vir C:\Qoobox\Quarantine\C\Windows\iun6002.exe.vir C:\Qoobox\Quarantine\C\Users\Jesus\AppData\Roaming\chrtmp.vir C:\Qoobox\Quarantine\C\Install.exe.vir QUIT::
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix may request an update; please allow it.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
- Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
Posted 30 April 2012 - 07:56 AM
However, I managed to fix my problem without having to reinstall everything. I followed a tutorial on how to perform a "repair" installation, which basically restored all my windows files without touching my programs and settings. After performing this "repair" install, which was a lengthy process, my drivers would still not work. However, I uninstalled both the NVIDIA and the Intel graphics drivers, and reinstalled them (First Intel, then NVIDIA). I have to say I downloaded the Intel drivers from the Dell website, and NVIDIA drivers were just straight from nvidia. After doing this, Optimus was running fine, and everything was working the way it's supposed to.
Thank you for your help anyways!
Posted 30 April 2012 - 10:35 AM
are there any outstanding issues or are you good now?
Posted 04 May 2012 - 09:55 PM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users