My Wifi unit has possibly been compromised by a virus

chrstrbrts

Senior member
Aug 12, 2014
522
3
81
Hello everyone,

I'm not quite sure where to post this; I've posted in both the Networking forum and here.

I'm sure the mods will clean things up if need be.

Anyway, I'm using an HP 15-r264dx running Windows 7.

My Wi-Fi is not working and shows up as enabled but disconnected in my notification area, and according to ipconfig/all.

However, under control panel device manager, it appears to be enabled and shows no issues with its driver.

My Ethernet connection, though, is fine.

My Wi-Fi is, in fact, enabled, just not connected to anything.

In fact, my Wi-Fi is not picking up any signals from any routers anywhere.

What happens is that after restart or cold start, the wifi remains disconnected as I described.

I then have to reinstall the driver and replace the one already installed.

Everything remains fine until the next restart, cold start, or hibernation, and then the problem begins all over again.

But, something else is happening.

My anti-virus software, Panda Protection free version, continually catches a trojan right after restart or cold start.

The virus is always in the Windows/temp folder and takes on different names for each iteration.

Panda considers each iteration to be of type Trj/Agent.OMX and the names that the virus has taken on the past five iterations are:

g750.tmp.exe
g8F72.tmp.exe
gD328.tmp.exe
gD6BE.tmp.exe
gDFA8.tmp.exe

I don't know that much about malware, but I don't think that it's too difficult to engineer a virus that takes on different names each iteration.

As this keeps happening when I boot, I can only assume that the boot process is compromised.

That is, either my MBR, boot sector, or, God forbid, my firmware have been infected.

It would be too much of a coincidence for the two issues to be unrelated; they both started at the same time after all.

So, any advice, guys?

I have become too paranoid to use that HD, so I swapped it out for Win 8.1.

P.S.
I scanned the entire drive both when placed internally and externally as a USB peripheral and Panda finds no problems.
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
So you changed hard drives and you still have this issue? You might want to run Herdprotect portable and Freefixer. Research each module and don't delete anything you shouldn't.
 

chrstrbrts

Senior member
Aug 12, 2014
522
3
81
So you changed hard drives and you still have this issue? You might want to run Herdprotect portable and Freefixer. Research each module and don't delete anything you shouldn't.

No, the problem doesn't exist when using my second HD.

I suppose, then, that my firmware is OK.

Do Herdprotect and Freefixer scan firmware for viruses?

Is that what you were implying?
 

Elixer

Lifer
May 7, 2002
10,371
762
126
Have you checked what is running at startup, and what is set to run at startup?
If those are popping up every boot/reboot, then you are infected with something.

If you don't want to mess with fixing it (if you actually find out what is causing it), then I would do a clean install of the OS.
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
Do Herdprotect and Freefixer scan firmware for viruses?

Is that what you were implying?


Yes. And to check your start up items use Autoruns, but don't disable what you don't know. Right click the module and you can scan at Virus Total.