help with /.php virus

[Pat Chiles]

I have either a virus or malware on my windows 10 desktop. I have tried everything I can come up with to remove it. It manifests itself by placing an inch high 4 inch long box in the middle of the screen that shimmies and will not let you close it. Inside the box in the upper left it says "update available" and in the middle of the box is "/,php" and nothing else.

Here are the things I have tried. 3 scans with Malware Premium. Windows defender and a threat scan from Microsoft. All of these say there is no threats on my machine. I have uninstalled all software with the date that the box appeared. I have scanned processes and removed a few that looked suspicious. I have reset Foxfire which is the browser I was using when I got the box. Finally, I have Googled /.php virus all to no avail. Does anyone have some suggestions that might help me? At this point I am thinking that I need to reset Windows 10. This will mean reinstalling a lot of apps. Any help will be appreciated.

 

[Bif]

Hi and welcome to the forum Pat!
Try running an Superantispyware scan as well as JRT ..links below.

1. http://www.superantispyware.com/download.html
2.https://www.malwarebytes.com/junkwareremovaltool/


See if they pick up anything out of the ordinary..and post back your results..

 

[Norton]

As Bif mentioned, download and run Malwarebytes (JRT) Junk Removal Tool.

 

[Pat Chiles]

Bif and Norton, thank you for the replies. I literally just finished isolating the infected file and removing it. My son works at Microsoft and put me onto the tool that the link will take you to. With it I was able to identify all "auto start files" and then filter down (i.e. hide all Microsoft etc.). What was left was 3rd party file which I turned off in batches of about 20. When I was able to reboot with out seeing the window then I knew it was within those 20. I kept cutting the batch in half and rebooting until I isolated the file and removed it
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

 

[Norton]

Pat Thanks! for the reply. So glad you managed to isolate the offending file(s)
Now your PC is rid of the infection just make sure you create a Manual Restore Point and a System Image/Backup.

 

[Bif]

Glad you got to the bottom of it Pat!
As Norton said, make sure you manually create a restore point and a system image/backup just in case things go sideways again.