5 Replies Latest reply on Aug 24, 2013 2:21 AM by st1300abs

    ISwizard virus

      Dear all,

      I have a real nastey virus under the hood.

      It is recognized by the McAfee software and is placed in quarantine.

      However that is only the last part of the virus and every time I boot the computer the virus is back.

      The warning is a Trojan.BitCoinMinner in c:\user\mylaptop\AppData\local\temp\iswizrad\dwm.exe

      Nog the McAfee software stops and removes the virus. Few minutes later its back again, now running in a different directory starting a differend file mbamservice.exe (malwarebyte) and that its removed and comes back starting another file aso aso.

      So the virusscanner intercepts the instalation but does not remove the source.

      Anybody any thoughts?

        • 1. Re: ISwizard virus
          Peter M

          Try booting into Safe Mode and running McAfee there, if it detects it it should be removable.   To run in Safe Mode simply right-click the folder and select Scan or right-click your McAfee icon by the clock and select Scan.

           

          In this mode all you will see if some activity in that notification area icon.   Hover over it for a progress report.

           

          If that doesn't help I suggest running either Hijackthis or DDS as suggested lower down the last link in my signature below,  Then post the log as instructed on an approriate forum,  We don't analyse them here due to work load.

           

          Alternatively McAfee has a professional virus removal service but that costs money, so you may wish to try the above first.

           

           

          .

           

          Message was edited by: Ex_Brit on 21/08/13 6:56:39 EDT PM
          • 2. Re: ISwizard virus
            Hayton

            If it keeps coming back then it's a cloaked infection, probably a rootkit. Either that or you're being re-infected by something like P2P or Skype (both of which have been used to deliver BitCoin mining malware). There are posts a-plenty about dealing with this on other forums, especially the Malwarebytes forum. You may need to ask there or on BleepingComputer for specialist advice if Ex_Brit's suggestion about Safe Mode doesn't deal with the problem.

             

            Try running RootkitRemover first to deal (if possible) with anything that's modified the MBR.

            • 3. Re: ISwizard virus

              This would be a good case to run GetSusp to find any unknown software that may be reinstalling malware or unwanted programs.

               

              http://www.mcafee.com/us/downloads/free-tools/getsusp.aspx

               

              If GetSusp or the other above suggestions do not work for you, post back and I will point you to other solutions to detect software starting up with your computer that may be downloading and installing malware/PUPs over and over again on your computer.

              • 4. Re: ISwizard virus
                Peacekeeper

                Oh if you have win8 getsusp might give you an erroneous list of suspicious fiies till they fix the issue in a week or so.

                • 5. Re: ISwizard virus

                  Hi,

                  I realy want to thank everybody for their great effort to get rit of this nastey malware/virus thing.

                  I tried all the solutions, but not of them really did it for me.

                   

                  Than I turnt over to ComboFix who spotted the program that caused all the troubles and removed it.

                   

                  After a safe mode scan with McAfee, who picked up the last trojan, that for some strange reason was not picked up by ComboFix, I am glad to say my machine is clean again.

                   

                  Again thanks for all the good ideas, which at the end pointed me to the solution as described above.