Trusted installer.

Question

I have been dealing with a nasty Trojan for some time. After a clean install I don't connect to the internet. The owner is trusted installer. 

So I attempt to take over along the way there are files like page.sys or swap file dump stack log etc certain folders that I still don't have full control over! I tried to load Ubuntu I don't like windows they make it easy even for the most inexperienced user can navigate. I'm trying to rid my system of windows and go to Linux but there is some thing in the bootlog I'm guessing that on startup it loads these default settings and soon as I get connected to the internet. Bam he's got control and running scripts on port 80 Nmap is my scanner I use. I ultimately wanted to learn the other half. 

I am learning the ways, I don't claim to know a lot and probably get my self in trouble as I learn about software vulnerabilities and what not. I caught this Trojan doing just that. 

Since I'm not that far advanced I need to understand how this Trojan operates how I can cut the head off this snake before I connect to the internet. Can I get a list of registry keys that are loaded at time of install so I can compare and see where the one script is that starts the whole thing going?

Same with the bootlog how do I look at what is actually being loaded. I even went as far as total format wipe clean re partition everything clean slate. I haven't looked at the logs but I am guessing it is in my cloud. As soon as I sign in to Microsoft. Bam edge sucks. That's the field I'm going into cloud security server less scripts. That's the goal I know enough to get my self into trouble That's it so far.

Any suggestions on where to start I would even connect so someone that knows can see what I'm talking about. It's the worst root kit I have encountered and believe me when I tell you I thought I had seen them all. This guy is tricky and pushing me to throw this whole laptop in the lake. 

I promise I'll be good if someone can just give me some guidance on how to rid my system or delete my Microsoft account I'm torn. Thanks

Juston black

Answer 1

Though I once worked for a whitebox PC manufacturer, I wasn't directly involved in the production side and instead was responsible for network management on the business side of the organization.  This was also in the late 1990's to early 2000's period, so the BIOS and versions of Windows have changed drastically since that time.

That's why I still recommend you go to the HP forums and post your questions there, since they should know their devices and have people there better than anyone here who might be able to answer your questions.

However, I will provide the following entry point into the Windows 10 documentation related to booting and installing Windows, since these should cover the processes that are occurring when you restart the PC with a wiped drive as you've apparently been doing.

Boot and install Windows | Microsoft Docs

Note that the URL I provided takes you directly to the Boot and install Windows section, which is likely what's been happening to you and why you can't seem to stop this.  However, if you look at the left hand pane, you'll notice it's a table of contents that also includes other boot options like Boot to UEFI Mode or legacy BIOS mode, which I believe is what must be used to install alternative operating systems.

My knowledge of any of this including installing Linux or other operating systems is limited, since I've never done it myself and only read about it or seen it mentioned in forum posts, which is why I keep telling you to look elsewhere for this aid.  I'm sure there are others here who might know, but the title of your thread "Trusted installer" and the way the thread progressed with discussions of a Trojan in a forum relating to viruses and malware aren't likely to result in the people who might be able to help ever finding your true question to offer their aid.

That's why I recommend you start over, preferably in the HP forums or at least in a more appropriate forum here that has nothing to do with viruses or Trojans and begin a new thread, titling it with what you're actually trying to do rather than some random issue you're having.

These are the reasons no one before me could answer any of your questions, since they were incoherent and confused, so the answers were as well.

Rob

Answer 2

Trusted Installer is a completely normal and necessary part of Windows 10 and it won't operate properly unless this service is running.

What is TrustedInstaller.exe in Windows 10?

If you're trying to avoid running Windows at all on that laptop, you're in the wrong place to ask and should instead be talking to the manufacturer of your device, since they're the only ones who know how their own boot manager and other startup features of that laptop truly operate.

It's very possible that the manufacturer won't support the operation of any operating system other than the Windows 10 that came with it on their devices, but typically there are methods available to bypass these.  However, if the manufacturer won't support you then it will be necessary to go to other forums relating to the operating system you prefer to install to get help in the specific steps required to make it work on your brand of laptop.

You keep mentioning a Trojan in your posts, but those answering don't seem to understand that you're talking about Windows itself, so since you're in a forum for help with malware issues with Windows, you'll keep getting help as if that's what you're attempting to fix.

You don't want to fix Windows, you want to get rid of it, so this is the wrong place to ask for that help.

Rob

Answer 3

As long as you're not modifying anything and using the latest media from Media Creation Tool, there is no worry about what's in System32 unless you put it there.

Malwarebytes is 3rd party so install it from the link I gave and follow the steps to check for infection, including of your files before you reimport them.

Answer 4

In answer yes I formatted all drives all partitions and then started fresh with new partition and one partition for the system. I even formated the recovery partition there is file in my system 32 file named adanvceInstaller he has control in the boot file there is one called winresume from a hibernate boot application. I haven't connected to the internet yet I can't get it to load from USB something is telling the system at boot to do one thing only. Is malwarebytes already loaded at first install? I will try that.

Answer 5

Hi Juston. I'm Greg, awarded MVP for eleven years, Volunteer Moderator, and Independent Advisor here to help you until this is resolved.

You said you did a Clean Install but did you unplug all other drives and wipe all partitions off the Windows hard drive, which is the definition of a Clean Install because that's how it gets it clean? Then for a heavily infected PC you need to scan any data drives or data backup before reimporting the data into Windows or it will just reinfect it again.

Compare the install you did with this gold standard Clean Install of Windows which will stay that way as long as you stick with the tools and methods given, has zero reported problems, and is better than any amount of money could buy: http://answers.microsoft.com/en-us/windows/wiki... Note the driver steps are so important they are printed in red.

The reason I ask you to do this is because no one of millions who have followed the install in that link has ever come back to report problems that I have seen. It is also a great learning experience that will make you permanently the master of your PC because you will learn what works best and have applied it with your own hands.

If you want to try to disinfect and repair what you have then Download, install and run a full scan with the most powerful on-demand free scanner Malwarebytes:

https://www.malwarebytes.com/mwb-download/.

In the Malwarebytes Settings > Security tab set it to include scanning for Rootkits.

If necessary run it in Safe Mode with Networking, or Safe Mode accessed by one of these methods: https://www.digitalcitizen.life/4-ways-boot-saf...

Clean up anything found, restart PC and then run again until it comes up clean.

Then download, install and run a full scan with AdwCleaner:

http://www.bleepingcomputer.com/download/adwcle... Remove whatever it finds.

Check for any remainders in Settings > Apps > Apps & Features, and also in each of your browser's Extensions, Home Page settings, Search service or Add-On's as shown here: https://www.computerhope.com/issues/ch001411.htm

Then check for damaged System files by running System File Checker from Step 10 in this checklist:

http://answers.microsoft.com/en-us/windows/wiki....

If completing all of Step 10 in above Checklist doesn't fix it then run a Repair Install which reinstalls WIndows while keeping your files, programs and most settings in place, by installing the Media Creation Tool from this link http://windows.microsoft.com/en-us/windows-10/m..., open the tool and choose Upgrade This PC Now. This will solve most problems and also bring it up to the latest version which you need anyway and by the most stable method.

If you want to keep Malwarebytes as an on-demand scanner then you can turn off its Real Time trial version in it's Settings > Account Details tab.

I hope this helps. Feel free to ask back any questions and let us know how it goes. I will keep working with you until it's resolved.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.