Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

11 6.2gb files in c:\windows on Windows 7 Home Premium


  • This topic is locked This topic is locked
7 replies to this topic

#1 jockovonred

jockovonred

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 13 March 2018 - 12:39 PM

I was tasked by my father-in-law to backup his pictures.

In the process, I checked to see what was consuming hard drive space using WinDirStat.

 

I found 10-11 files in the C:\Windows directory all having 6.2 gb file size.

None of these file display in windows explorer.

They all have weird characters in their name, like logograms.

 

I was able boot a Linux live drive and delete the files.

Upon booting back into windows, shutting down windows and booting back into Linux, the files were there again but with different characters.

 

I performed the above 2 times before running AdwCleaner and MBAM which cleaned up PUP files.

After a third Linux live drive boot, deletion of files, boot into windows, shutdown and Linux live drive boot, it shows the 11 6.2 gb weirdly named files again with different 'characters'.

 

I've not seen this before on Windows 7 and can find no information while doing an internet search.

I am looking for assistance in next steps to determine the extent of an infection and steps to resolve.

 

Thanks.



BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:59 AM

Posted 04 April 2018 - 12:51 PM

Hello, please try one more...

MiniToolBox
  • Please download MiniToolBox, save it to your desktop and run it.
  • Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP conf[iguration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size.

  • Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run. Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
  • [/list]
  • Please download and run ESET Online Scanner
  • Check qy7AMI8.jpg (if available) and click on the ePL5oyv.jpg button.
  • [/list]
  • It is recommended to turn off your antivirus program. Click on the E5rfZI9.png button to see which antivirus is currently enabled:
  • c4VVzVO.png
  • Turn off your antivirus program. See here how to do this.
  • Check the option beside: Enable detection of potentially unwanted applications.
  • Now click on Advanced Settings and make sure that the option Clean threats automatically is NOT checked, and select the following:
  • Enable detection of potentially unsafe applications
    Enable detection of suspicious applications
    Scan archives
    Enable Anti-Stealth Technology
  • Click on the Change button and select only Operating memory, Autostart locations and drive C:\ to be scanned.
  • yKulboi.jpg
  • Push the dtoGjAL.png button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • 8L8IBHJ.png
  • When the scan completes a list of found threats will open automatically (if any malicious files are found).
  • imxEgHt.png
  • Push thecRhRYZ8.png button and save the file to your desktop using a unique name, such as ESETScan.txt. Include the contents of this report in your next reply.
  • Push the 9IjfdXq.png button.
  • Check the box beside RHzfZB1.png to uninstall the application when closed.
  • Push Vc3btaC.png and the close the application clicking the X in upper right corner.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 jockovonred

jockovonred
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 12 April 2018 - 10:01 AM

Hello, please try one more...
 

I have posted the log files to pastebin for quick/easy sharing.  Let me know if you'd rather have the full text here instead and I can repost with the full contents.

 

MiniToolBox log:  https://pastebin.com/C2GwbzBS

ESETScan log:  https://pastebin.com/Ry14GArB

 

(It took some time to get these as I had some travels and had to get the computer connected to the interent for the ESET scan.)

 

FYI, after downloading and running ESET, the computer also downloaded a bunch of Microsoft updates.



#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:59 AM

Posted 12 April 2018 - 10:37 AM

OK  the updates are good.. you need to rerun ESET and Remove what was found .. Reboot. and see how it is.


Edited by boopme, 12 April 2018 - 10:37 AM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 jockovonred

jockovonred
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 14 April 2018 - 11:49 AM

OK  the updates are good.. you need to rerun ESET and Remove what was found .. Reboot. and see how it is.

I ran ESET again and had it remove everything found. 

 

The problem with the weird files remains however.

I need to attach an image to show you the files and the location.

 

https://pasteboard.co/HgBlQfJ.png

 

The files in question are highlighted in the image.

 

These files don't appear like they should be there or exist.

 

Any ideas?



#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:59 AM

Posted 15 April 2018 - 03:02 PM

Hello, I want to make a new topic so we can get a deeper look. You can refer back to this topic. Include the image. Do steps 6 & 7.

Please follow this Preparation Guide and post in a new topic.
Let me know if all went well..
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 jockovonred

jockovonred
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 18 April 2018 - 11:28 AM

Hello, I want to make a new topic so we can get a deeper look. You can refer back to this topic. Include the image. Do steps 6 & 7.

Please follow this Preparation Guide and post in a new topic.
Let me know if all went well..

I have gathered the requested information and posted in the new topic:  https://www.bleepingcomputer.com/forums/t/675961/eleven-62gb-files-in-cwindows-on-windows-7-home-premium/#entry4484774

 

Let me know the next steps.  Thanks for your assistance!



#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,323 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:59 AM

Posted 18 April 2018 - 12:00 PM

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.
From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.
Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.
The current wait time is 1 - 3 days and ALL logs are answered.
If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.
To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users