HIVE

Hey... I have a terrible virus on my computer which duplicates its self.

I was wondering if you could help.

It seems to reappear no matter how many times I delete it. It isn't running in services I've checked, so where could it be duplicating its self from?

It might be a fileless infection.

Maybe I could help, but I think you should open a new thread in the disinfection forums of Bleepingcomputer instead:
https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-assistance/

They will certainly ask you run FRST as a first step:
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

That's the way to do it:
https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

frst doesn't help, it just shows you what could be wrong...maybe

FRST lists some internal information about your PC. From there, you could either fix some eventual issues yourself (if you are tech-savvy enough), or create a new thread on the Bleepingcomputer forums.

There, someone will tell you what to do next (you might have to run additional diagnostic tools such as FSS or MiniToolBox).

Please read a few of their support threads, to understand how their assistance works.

They are imho *very* competent.

Nah it is cool, I'm a programmer after all. I just wonder how this program works. It is quite fascinating. It somehow managed to write over my 'safe mode' boot files, creating an environment for it to cease complete control over my computer even before it boots.

But I think I've killed it now... Thanks for the help

You're welcome.

Some reading about fileless infections:
https://blog.malwarebytes.com/cybercrime/2016/03/fileless-infections-an-overview/

Damn the virus is still around.... The virus name is 'Kunde'

In case you want to do some additional scanning, you might want to run:
- ESET Online Scanner
https://www.eset.com/us/home/online-scanner/

- TrendMicro HouseCall
https://www.trendmicro.com/en_gb/forHome/products/housecall.html

- F-Secure Online Scanner
https://www.f-secure.com/en/web/home_global/online-scanner
(careful, *no* user interaction at all, and *no way* afaik to undelete any FP - you have to completely trust the tool)

Plus:

- HitmanPro
https://www.hitmanpro.com/en-us/hmp.aspx
(the scanning part only is always free, and is not time-limited)

- McAfee Stinger
https://www.mcafee.com/enterprise/en-us/downloads/free-tools/stinger.html
(go in the options menu to activate Rootkit detection, and then afterwards use MCPR and reboot your PC to remove the somewhat annoying service Stinger permanently installed to detect Rootkits)

- TDSSKiller
https://support.kaspersky.com/viruses/utility#TDSSKiller

- RogueKiller
https://www.adlice.com/download/roguekiller/

- KVRT by Kaspersky
http://www.majorgeeks.com/files/details/kaspersky_virus_removal_tool.html

- Microsoft Safety Scanner
https://www.microsoft.com/en-us/wdsi/products/scanner
(same as Microsoft Security Essentials / Windows Defender)
(runs on XP, but MS will not admit it)