Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Malware Removal

Started by itc1991 , Apr 16 2017 11:16 PM

  • Please log in to reply

#31
itc1991
Posted 22 April 2017 - 04:07 PM

itc1991

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Farbar Recovery Scan Tool (x64) Version: 22-04-2017 01
Ran by Ines (22-04-2017 23:05:50)
Running from C:\Users\Ines\Desktop
Boot Mode: Normal
 
================== Search Registry: "errorreport.exe;dashost.exe;conhost.exe;bsdrive" ===========
 
 
===================== Search result for "errorreport.exe" ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\Program Files (x86)\Samsung\Smart Switch PC\ErrorReport.exe"="1"
 
 
===================== Search result for "dashost.exe" ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adsi\Options\dashost.exe]
 
 
===================== Search result for "bsdrive" ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\PUB-Removed]
"1d2b6824159b433"="
c:\windows\system32\drivers\bsdriver.sys"
 
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\PUB-Removed]
"1d2b9f332506022"="
C:\Users\Ines\AppData\Local\Temp\bsdriver.sys.dmp"
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bsdriver]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bsdriver]
"DisplayName"="bsdriver"
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bsdriver]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\bsdriver.sys"
 
[HKEY_USERS\S-1-5-21-676550262-2765486237-767571021-1001\SOFTWARE\WinRAR\Profiles\0]
"PathsAbsDrive"="0"
 
[HKEY_USERS\S-1-5-21-676550262-2765486237-767571021-1001\SOFTWARE\WinRAR\Profiles\1]
"PathsAbsDrive"="0"
 
[HKEY_USERS\S-1-5-21-676550262-2765486237-767571021-1001\SOFTWARE\WinRAR\Profiles\2]
"PathsAbsDrive"="0"
 
[HKEY_USERS\S-1-5-21-676550262-2765486237-767571021-1001\SOFTWARE\WinRAR\Profiles\3]
"PathsAbsDrive"="0"
 
[HKEY_USERS\S-1-5-21-676550262-2765486237-767571021-1001\SOFTWARE\WinRAR\Profiles\4]
"PathsAbsDrive"="0"
 
====== End of Search ======

  • 0

Advertisements

#32
itc1991
Posted 22 April 2017 - 04:09 PM

itc1991

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts

I didn´t understand the part about the safe mode what to you mean ?

I have tried the commands and it says access denied and error. 


  • 0

#33
RKinner
Posted 22 April 2017 - 09:56 PM

RKinner

    Malware Expert

  • Expert
  • 24,623 posts
  • MVP

If you aren't able to get into Safe mode then that's probably because bsdriver or his hidden friend is blocking it.  That rules out getting rid of it the easy way.

 

See if BleepingComputer's guide will help:

 

https://www.bleeping...e-shopper-z-ads

 

Even tho you do not have shopper-z they both use the bsdriver.sys to protect the malware.


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP