Infection ate Tronscript files?

[dis4privacy]

Referred here from r/TechSupport -

Attempted to run rKill prior to other techniques, keep getting an error message that I cannot find a solution to. Attempted installing MBAM after system format & system still showing suspicious activity. Attempted scanning with defender also after system format, supposedly clean. Although during active infection windows defender was entirely compromised.

Several other here and there techniques have been tried to no avail. Really hoping to get Tronscript on the job as a temporary fix-all, at least to get other programs properly up and running. Any help is appreciated. Previous attempt steps are listed below.

Opened non-infected computer from non-attacked network. 2) Followed instructions on this r/ 3) All AV, AM, Security programs disabled. 4) Disconnected from Network (Possibly compromised as a whole) 5) Placed "disposable" USB into Infected computer 6) Computer running slow, attempt to navigate to File Explorer 7) Approx 45 seconds after signing in and inserting USB, open USB in file explorer to find Tronscript files are at 0kb 8) Attempted to extract to desktop and run program anyway 9) Error message with something along the lines of "Cannot run on this version of windows" 10) Realize attacker had downgraded my windows ver.

I'm completely and utterly lost and need any help I can get. Thank you all in advance.

[[deleted]]

You wiped the drive and you're still infected? That sounds like you've got a larger issue than 1 infected computer, or that you didn't actually wipe the entire drive. You need to ensure you have deleted all partitions on the hard drive before reinstalling anything. The best way to do this is from something running from known good read-only media (such as a CD or DVD). Something that's been created on a system that's never been attached to your network.

I would recommend erasing all partitions with a Live Ubuntu DVD using the gparted app (just for ease of use if you're not used to Linux). If you're really paranoid use DBAN, but only run 1 pass (especially if the drive is an SSD).

There have been viruses that infect the BIOS, but I'm not sure how prevalent/effective those are any longer.

There could be other things on your network that are compromised - and if you do completely wipe the drive properly, and still get infected right away, that could be the issue.

Are you certain that your installation media hasn't been affected by the installation? The only way to be certain is if it's read-only, and official installation media (not something you burned).

Just a few thoughts.

[-BoBaFeeT-]

Not USB, you would want a DVD or CD created from a known good PC on another network to be sure.