All Activity

Thank you. You skipped a step add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.

Please start Farbar again with Admin rights. In the top portion of the program copy and paste the following SearchAll: eocnnoackodjagdbaoddhjbkpjabimed;pbneiecbhikjapoihjpemfmpaalkafkh Then click the Search Files button When done, please attach that new Search.txt log

Wow, still a lot of unwanted data removed. I would recommend you consider backing up personal data and doing a clean install of Windows. we have done multiple clean up scripts and multiple antivirus scans and you still continue to have unwanted software show up in new scans. Clean Install Windows 10 & 11 (2023) https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587 Also, please review the following topic Bypass Microsoft Online Account Creation during installation of Windows 11 https://forums.malwarebytes.com/topic/296613-bypass-microsoft-online-account-creation-during-installation-of-windows-11/

Open Notepad and verify which drive your Windows folder is on. It could be D: E: or F: etc. Modify the path to use the correct drive letter

Thanks for the feedback.

Hi, Thanks for responding. I ended up wiping and starting again. Windows 10 will be out of support soon so an upgrade was always going to need to happen. I have installed Malwarebytes to prevent this in the future. It seems to be ok, nothing has installed as of yet. I will open another topic if need be or open this one up again.

Hello Malwarebytes Beta community, We have released beta build version 4.6.13.324 component package 1.0.2337. Features and improvements Minor updates to improve migration to Malwarebytes 5

Hello Malwarebytes Beta community, We have released beta build version 5.1.4.112 component package 1.0.1240. Features and improvements Improved keyboard navigation Issues fixed Minor bug fixes

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply

I think it's because of the help you and Porthos gave earlier 😄 I'm very happy to have found this Forum. Thank you Malware Bytes team 🙌

Welcome I'll be helping you with your computer. Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding. Please take note of the guidelines for this fix: Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated. First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer. Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me. Please read ALL instructions carefully and perform the steps fully and in the order they are written. If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean. Continue to read and follow my instructions until I tell you that your machine is clean. If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed. Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. Let's begin... This Fix will empty the following folders: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Discord cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. Download the enclosed file Fixlist.txt Save it in the same location FRST64.exe is saved. ( C:\Users\SP00Ky\Downloads ) Start FRST (FRST64) with Administrator privileges (FRSTEnglish.exe) This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Dr.Web CureIt! Please download the Dr.Web CureIt! anti-virus utility https://free.drweb.com/ You will need to send them an email to obtain a link to download the scanner, please do so The downloaded file will normally have a unique name such as: q7a9tr4p.exe Close all open applications and locate the downloaded file and double-click to run it The program will take a moment to launch and bring up the License and Update screen Place a check mark to agree to the terms and then click on the Continue button Click the underlined link Select objects for scanning On the top left click the Scanning objects that should automatically check all objects Click the small wrench and make sure there is a check on Automatically apply actions to threats Then click the large button on bottom right Start scanning Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad The log is saved in the folder named Doctor Web in the top of your user profile folders Please attach that log on your next reply

When i open the report with notepad, it appears as weird characters, is this normal?report_2024.05.09_23.39.47.klr.txt

Logs are clear. I am glad you were able to remove the notifications.

Hi @BjelakovicL @TeMerc, The action we had taken before is we suspended their account so they couldn't send out any more emails with malicious links. We went a step further and redirected all of the malicious links to an error page. All the links that were flagged are now going to an error page and not the phishing pages they were going to before. Please let me know if this is what was needed. Thanks in advance for the help.

AdwCleaner AdwCleaner[C00].txt AdwCleaner[S00].txt

FARBAR Addition.txt FRST.txt

Why is my website payments.tawfeer.nl is blokked through your system? This is my website tawfeer.nl and the payment is going through a different system that we built.

@Bronson1979 Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following. Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Then be patient for the next expert to take your case. Thank you

Avast has a history of issues running with Malwarebytes. Especially web protection.

Symtomps Weird flashing Windows box Asked to restart after "service change" I couldn't find the culprit since my system is very minimal and organised. Malwarebytes removed these files but it keeps coming back I know when it's back when there's a flashing windows. Thank you for your help. Malwarebytes Scan Report 2024-05-10 150240.txt Malwarebytes Scan Report 2024-05-10 160029.txt

@Porthos I uninstalled Avast and now I can download Malwarebytes. Thanks so much for your help. It's a little weird just because on my desktop I was able to download Malwarebytes even though I still had Avast (Windows 10). [Cosmos]

Thank you Porthos for reopen this topic, And It's great that you replied JSntgRvr, I just synced Pass through DuckDuckGo like 2 hours ago and when I received the notification, I deleted all the data on it, even deleted the pass manually and restored DDG to default. I then Uninstalled it and went back to Fire Fox with uBlock. I then used Hitman Pro to scan, it showed a tracking cookie and it was deleted And one thing is that cookie is on Edge Since then, I have not received any more notifications. However, I still did everything as you instructed yesterday for the first time collecting data. If you have time, please have a look. Addition.txt FRST.txt

Sincerely thank you for trying to run a test. I apologize but I may not have been very clear about the attachments and our background, that is my fault. In the archive are two files: 1. cbfs22.sys (driver) 2. CCNHA_8868_trial.exe (CBFS Connect setup assembly) Problem statement: MWB interferes with the normal operations of various software titles that use our product, CBFS Connect Our product CBFS Connect is not software itself. It is a development library which allows developers to build their own software titles. So, the setup assembly above is what we provide to our customers, they would use the enveloped assemblies/drivers (cbfs22.sys) in their own software and deploy it to their end-users. The problems come into play on the endmost deployment system, once some software has been developed or when using our demo applications in the "demos" folder of the installation directory (C:\Users\Reese\Documents\CBFS Connect 2022 .NET Edition\demos\) such as "Folder Drive" demo , and using that demo on a machine with MWB installed (e.g. installing the driver and playing with the main features of the demo). Would it be possible to give the demos inside the *.exe a quick try? On the detection logs, we will continue trying to get them for you guys.

@steveheinz I suggest changing all of your website passwords and enabling 2FA wherever possible. Also suggest checking your email address here. https://haveibeenpwned.com/