-1

I recently got infected with a ton of viruses, and I was able to clean out most of them, but there's still one that I can't get rid of. Here are the details (the computer is running Windows 10 x64):

-The effect of the virus is rather miniscule; whenever I search using the top bar on Google Chrome, it redirects my searches to Yahoo although I have my settings set to Google.

-The name of the program is msmnlbvsrv.exe. It appears in my Windows/temp folder, which is the temporary files folder specified by my environment variables.

-The exe itself can't be deleted from Windows because of some permissions shenanigans that I haven't been able to get around; basically even if I change the owner, it denies me access to delete it. In fact, you can't actually stop the process from the regular task manager either because it once again denies you access. But I was able to kill it by using Process Explorer as an admin.

But the real problem is this: I booted Gparted Live to delete it from there in an attempt to remove it, but when I restart my computer, it's back in my temp folder. This means that some other application is the actual culprit and is running at boot and creating this program that redirects my searches. How can I figure out what exactly is creating the process and remove it from the source? Neither Windows Defender nor Malwarebytes could get rid of the source itself, and I really, REALLY don't want to have to reinstall my OS. Also, I've seen Process Monitor mentioned here and there, but it doesn't run on my computer no matter what I do. No window opens, and if I look at process explorer, the process appears and disappears within the same second.

Kurausukun
  • 141

1 Answers1

0

A few choices, in order of simplicity:

  • Completely wipe the drive and restore from your last known good image, after first saving any recent data offline and scanning the offline files for malware.
  • Run a malware removing tool from USB or CD, e.g Avira Rescue System, Panda Cloud Cleaner Rescue ISO or Kaspersky Rescue Disk.
  • Search the whole drive for the string "msmnlbvsrv.exe" to find where it is being re-created and manually change the filename wherever it occurs to change the extension, e.g. "msmnlbvsrv.xxe". This must also be done from an external bootable device, and is useless if the filename is encrypted.
DrMoishe Pippik
  • 37,887