nasdaq

Hi, Remove this program in bold via the Control Panel > Programs > Programs and Features. CPUID CPU-Z 1.78 (HKLM\...\CPUID CPU-Z_is1) (Version: - ) <==== ATTENTION This version is not signed and could be compromised. If you still need it get it from this site. https://www.cpuid.com/ === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please run the Malwarebytes and clean everything that will be found. Run the Farbar program is normal mode and post a fresh FRST.txt log for my review. Let me know of any issues with this computer. fixlist.txt

Hi, Try this. Follow the instructions on each step. Locate the CMD.EXE and run it as an Administrator. At the DOS prompt execute this command in bold. net stop wuauserv Renames the C:\Windows\SoftwareDistribution folder to C:\Windows\SoftwareDistribution.old , essentially clearing the Windows Update download cache so that it can start over. Restart the Windows Update service net start wuauserv Restart the computer normally. Try the update now. How is it? <<<>>>

Hi, If not already done please run the RogueKiller and delete the items reported. Let me of any issues with this computer.

Hi, The instructions were to boot to the Recovery Console, not safe mode. Please repeat the instructions. p.s. The Farbar program downloaded to your flash drive may have been compromised. Please delete the current version and get a fresh version before you mount it to the compromised computer.

Hi, Go for a clean install of Malwarebytes, see if that helps... Totally Remove Malwarebytes from your system: Download the latest version of MB-Clean by clicking this link: https://downloads.malwarebytes.com/file/mb_clean save to your Desktop, or a folder of your choice. Close all open applications Double-click and run mb-clean.exe A prompt with an option to clean up the system will appear: Yes - will proceed with backing up the license key (Malwarebytes 3.x only) and initiating the cleanup process. (Recommended) No - will exit the utility Once the cleanup process is completed, a prompt will appear: Yes – will proceed and post reboot you will be prompted to continue with the downloading, installation and activation of latest version of Malwarebytes 3.x (Recommended) No – will exit the utility and you will not be prompted (post reboot) to download, reinstall and re-activate (Not Recommended) We recommend rebooting immediately. Additionally, stopping at this step is not recommended and will most likely not resolve your issue(s). Upon reboot, a prompt will appear: Yes - will download, install and activate the latest version of Malwarebytes 3.x (Recommended) No - will exit the utility and the cleanup process is complete... Does clear the issue..? <<<>>>

Hi, If all is well. To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe. http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/ https://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/ Simple and easy ways to keep your computer safe and secure on the Internet. ===

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Your logs are clean. Reset Chrome... Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome. Click "Settings" then "Show advanced settings" at the bottom of the screen. Click "Reset and clean up" > "Restore settings to their original defaults" Restart Chrome. <<<>>> --RogueKiller-- Download & SAVE to your Desktop Download RogueKiller Quit all programs that you may have started. Please disconnect any USB or external drives from the computer before you run this scan! For Vista or above, right-click the program file and select "Run as Administrator" Accept the user agreements. Execute the scan and wait until it has finished. If a Windows opens to explain what [PUM's] are, read about it. Click the RoguKiller icon on your taksbar to return to the report. Click open the Report Click Export TXT button Save the file as ReportRogue.txt Click the Remove button to delete the items in RED Click Finish and close the program. Locate the ReportRogue.txt file on your Desktop and copy/paste the contents in your next. =======

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Reset Chrome... Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome. Click "Settings" then "Show advanced settings" at the bottom of the screen. Click "Reset and clean up" > "Restore settings to their original defaults" Restart Chrome. <<<>>> Please post the Fixlog.txt and let me know what problem persists. fixlist.txt

Hi, Let just install one update and see how it goes. If successful try one or 2 more, if all is well continue. p.s. It's important to wait until the updates are all installed to used the computer. Do not stop any yourself. Let me know how it goes.

Hi, Lets proceed: Read all the instructions before proceeding. Take your time and all should be well. Preparing the USB Flash Drive Boot up your spare PC: Plug in the flash drive, navigate to that drive, right click on it direct and select format. Quick option is adequate. Next, On that same PC download the right version of Farbar program for your system to Desktop or the Flash drive. 64-bit or 32 bit version. Select the one you need. https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ If the files were saved on the Desktopl Move the executable (FRST.exe or FRST64.exe) to your USB Flash Drive Do not plug the Flash Drive into the sick PC until booted to Recovery Environment. Boot the compromised PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 Select in this order "Troubleshoot" > "Advance Options" > "Command Prompt" Once in the command prompt Plug your USB Flash Drive in the infected computer In the command prompt, type notepad and press on Enter Notepad will open. Click on the File menu and select Open Click on Computer/This PC, find the letter for your USB Flash Drive, then close the window and Notepad In the command prompt, type e:\frst.exe (for the x64 version, type e:\frst64.exe and press on Enter Note: Replace the letter e with the drive letter of your USB Flash Drive FRST will open Click on Yes to accept the disclaimer Click on the Scan button and wait for the scan to complete A log called FRST.txt will be saved on your USB Flash Drive. Attach it in your next reply. p.s. If at any time you need additional information please ask before proceeding. Wait for further instructions.

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === I have identified a bad SmartService infection. You will need access to a spare PC and a USB flash drive that has not been in contact with the sick PC... Let me know if you have these access to these devices. I need to know first if you can enable the Recovery Environment. It will be needed to remove this infection. Open FRST on the compromised computer: copy/paste the following inside the text area of FRST. Once done, click on the Fix button. A file called fixlog.txt should appear on your desktop. Attach it in your next reply. Start:: CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes CMD: bcdedit.exe /set {default} recoveryenabled yes End:: http://i121.photobucket.com/albums/o239/kevinf80/Farbar%20Tools/frst%20b.jpg&key=98f8e4fa906452a8ed54423fd0407a3d120fe6064437244ca29c06ed5f968755] On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad Copy and paste its content in your next reply. Wait for further instructions. <<<>>>

Hi, Sorry I taught you were trying to download a file and MBAM notified you.

Hi I repeated the Fixlist.txt because it was malformed. First line in my previous post. === This may not give you any problems but I'm fixing these restrictions and removing the NoLowDiskSpaceChecks. If you hard drive gets filled you may not be able to run the computer unless you reformat and reinstall Windows. Then all your programs and data will be lost. ===

Hi, Repair these services. Boot with Safe Mode with Networking. Execute the following. Please Download Tweaking.com - Windows Repair from Here Install and then run the program Execute the instructions on Step 1 Important Click Next on Step 2 Optional, do the Pre Scan skip Step 3 and 4 Optional for now. On Step 5 Backup System Restore Do a Registry backup. When you have completed this click Next Click Repairs - Open Repairs in the bottom right corner Uncheck the All repair button then select just the item(s) listed below 01 - Repair Registry Permissions 03 - Reset Service permissions 04 - Register System Files 05 - Repair WMI 10 - Remove Policies Set By Infections 16 - Repair Windows Updates 20 - Repair MSI (Windows Installer) 25 - Restore Important Windows Services 26 - Set Windows Service to Default Startup Click the Start button and let the process run to completion. Copy any error messages into Notepad, Save it on your Desktop. ( Reboot if asked to do so) Please copy and paste the Contents of this file on your next reply. === Restart the computer normally. How is the computer running now?

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Your logs are clean of malware. This fix will clean empty items only. ---- This fix will clean the empty items found in your registry. I do not think that nothing will be changed as far as the Windows Updates are concerned. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === If you feel strongly that the file you are trying to download is good then I suggest you start a new topic in the False Positives forum https://forums.malwarebytes.com/forum/122-false-positives/ The expert will be happy to review it. === p.s. You can download the file but DO NOT run it. Submit the file to Virus Total for review. https://www.virustotal.com/#/home/upload If the file is found to be good then post the results in the False positive forum. fixlist.txt

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === It looks like the Bitdefender download failed and the program is not installed correctly. Download their uninstaller program and run it. https://www.bitdefender.com/uninstall/ === This fix will clean the empty items found in your registry. I do not think that nothing will be changed as far as the Windows Updates are concerned with this fix. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Download Farbar's Service Scanner utility http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and Save to your Desktop. If using Windows 7 or above, Right-Click on fss.exe and select Run As Administrator. If using XP, double-click to start. Answer Yes to ok when prompted. If your firewall then puts out a prompt, again, allow it to run. Once FSS is on-screen, be sure the following items are checkmarked: Internet Services Windows Firewall System Restore Security Center/Action Center Windows Update Windows Defender Other Services Click on "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Copy & Paste contents of FSS.txt into your reply. === Please post the logs for my review. fixlist.txt

Hi, Sorry my previous Fixlist.txt was malformed. If still present delete it. Run this one and post the Fixlog.txt for my review. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Let me know if the problem persists. fixlist.txt

Hi, You are attacked by some malware. MBAM is protecting you from know bad sites. Stay safe.

Hi, Remove this program in bold via the Control Panel > Programs > Programs and Features. Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.) === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === If all is well, it's still your call if you want to keep the IObit programs. Please post the log and let me know if the problem persists. fixlist.txt

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === potential PUP Potentially Unwanted Program. IObit programs are not recommended. Advance System Care and others are known to cause system problems and that had stolen material from other computer security companies to use in their own program. IOBit Steals Malwarebytes’ Intellectual Property IOBit’s Denial of Theft Unconvincing The program has also been seen to cause numerous system problems that tend to go away after uninstalling their software. It's your call if you want to keep it. ==== If you have any problems with this computer execute this scan. Download the version of this tool for your operating system. Farbar Recovery Scan Tool (64 bit) Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File. Click the file you wish to Attach. Click Attach this file. Click the Add reply button. === Please post the logs for my review. Wait for further instructions

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Your logs are clean. These attacks are stopped by Malwarebytes and you are possibly notified in your System Tray. If that is the case follow these instructions. Check the Notifications settings. Change the setting Show Malwarebytes Notifications to Off https://content.invisioncic.com/Mmalware/monthly_2018_05/2018-05-22_10-28-24.png.a3502457b1398cbb8a3d56e78531dcbd.png === Let me know if the problem persists.

Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Download the version of this tool for your operating system. Farbar Recovery Scan Tool (64 bit) Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File. Click the file you wish to Attach. Click Attach this file. Click the Add reply button. === Please post the logs for my review. Wait for further instructions

Hi This could be a Syncing issue if you are Syncing Chrome with other devices? To remove it you will have to reset the Sync in Chrome. Read this article and proceed. Chrome Secure Preferences detection always comes back https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ <<<>>>

Hi, Your logs are clean. If this has failed to solve the issues your Chrome may have been compromised. Quoted from my previous post.

Nothing to worry about. Run the .reg file as suggested. p.s. Make sure that the file you have created has the .reg extension.