Persistent files. Stay even after I reinstall Windows. Is it malware?

Edited by Madmatt85, 27 October 2023 - 06:24 AM.

Hello and welcome to BC:

We need more information in order to better assist you.

FIRST: Please download, install and run the Free version of Speccy from here: https://www.ccleaner.com/speccy.

Then, go to File > Publish Snapshot

Click YES > Copy to Clipboard

Then please post the LINK by pasting it into your next reply.

ALSO:

Please download and install MiniToolBox from here:  https://www.bleepingcomputer.com/download/minitoolbox/

Place a checkmark in the following boxes:
 
List Last 10 Event Viewer Errors
List Installed Programs
List Problematic Devices 
List Users, Partitions and Memory size

While you're working on those....

Did you wipe the drive and delete all the existing partitions before reinstalling Windows?

So you deleted UEFI and System Partition as well as C:  ?

If so there is no such thing as persistent files.

It would be something you are installing.

I definitely did. Thats why im confused and the same date from 2019 is on all of them. I will have the requested info in just a sec.

So ya no such thing if have wiped the drive including any partitions that Lenovo has for recovery.

Your Support Page : https://pcsupport.lenovo.com/ca/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430/downloads

So ya you were asked for :

Please Post a "link" of Speccy Report.
Please install Speccy Free : https://m.majorgeeks.com/files/details/speccy.html
Use Custom Install
  At the Top Left Corner of Speccy --> Click File and then Click Publish Snapshot Report, a window will popup and Click YES. --> Another popup will appear and then Click "Copy To Clipboard" then Paste that "link" to your next reply in your thread.

Download Minitoolbox from the below link :
http://www.bleepingcomputer.com/download/minitoolbox/
  Run the tool and only select the following tick boxes.
    -List last 10 Event viewer errors
    -List installed programs
    -List devices
    -List users, partition and memory size
Now click "Go" and Copy/Paste and post the output text in your next reply

http://speccy.piriform.com/results/w8KVdRCz5elfWrnMUUBtGF2

so ya i know  thats why i said i will have you the requested info shorty. so ya

Hi:

For starters, it appears that you’ve been using torrents, which is a great way to get infected.
As such, Defender has detected evidence of malware in an installed program. (NOTE: this is consistent with what we suspected, as a true, clean Windows install after removing partitions would NOT include malware. The malware did not “survive” Windows reinstall – you installed a program with the malware.)

You might want to head over to the malware removal section for expert help with diagnosis and cleanup.
First: please read & follow THESE INSTRUCTIONS: https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Then, please post the requested logs in a new topic HERE: https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-help/

Once you have done so, please post back in this thread with the link to the new malware removal forum topic.
The Mod Team will then (temporarily) lock this thread until your malware helper gives you the “all clear”. Other issues can be addressed after the malware cleanup.
-------------------

Date: 2023-10-22 01:57:39
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Bullboka.A&threatid=2147842004&enterprise=0
Name: Trojan:Win32/Bullboka.A
Severity: Severe
Category: Trojan
Path: file:_C:\Users\FUKdafedgov\Downloads\FL Studio Producer Edition - v21 Full (2021)\Setup (password is THEPIRATEBAY007)\Setup.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.399.1099.0, AS: 1.399.1099.0, NIS: 1.399.1099.0
Engine Version: AM: 1.1.23090.2007, NIS: 1.1.23090.2007

Date: 2023-10-22 01:52:23
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Bullboka.A&threatid=2147842004&enterprise=0
Name: Trojan:Win32/Bullboka.A
Severity: Severe
Category: Trojan
Path: file:_C:\Users\FUKdafedgov\Downloads\FL Studio Producer Edition - v21 Full (2021)\Setup (password is THEPIRATEBAY007)\Setup.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.399.1099.0, AS: 1.399.1099.0, NIS: 1.399.1099.0
Engine Version: AM: 1.1.23090.2007, NIS: 1.1.23090.2007
Event[0]:

 

yeah but the issue was before that even before i was torrenting things the files with the 7/19 date are all over the place.  You certainly have the right to scold me over the torrents but the issue was already there before i even got the torrent program.

i just kind figured well something weird is going on anyway so why not. im gonna post a screenshot of my program files

Please find from the bottom of your ThinkPad the proper name and the Serial Number.

What is showing does not match information.

Lenovo Model: 23474R7 gives me this Page : https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430/2347/downloads/driver-list/component?name=BIOS%2FUEFI&id=5AC6A815-321D-440E-8833-B07A93E0428C

Which shows the BIOS Version that is released : 2.82    Released  21 Aug 2019 

yet the Speccy Report shows that you are running BIOS Version  : G1ET98WW (2.58 ) Date: 10/23/2013 there fore the serial # is needed to properly identify.    Provide the info please.

=======================================================================================================================

What Install media are you using to do your Clean Install. ??  Where is it from ???

Or the URL for your correct Support Page.

Please provide the above and also Open a new Topic as has been recommended in the Malware Removal Forum please.