amyb2007
Members-
Posts
11 -
Joined
-
Last visited
Reputation
0 Neutral-
Awesome! Thank you for checking it for me once again. Too bad I use the BBC site for my homepage, maybe it is time to change it lol Thanks again for all your help! I will let you know if I need you to rescue me again, hopefully I won't tho. Amy
-
So I have had no beeping that I noticed tonight & still no mpstats appearing! Maybe it really is fixed. Fingers crossed. Here's the results. Addition.txtFRST.txt
-
That does make me feel better hearing that it could be BBC. I have not had as much beeping as before, and no mpstats have appeared in my tabs. Next time I go to BBC news I will pay close attention to my tabs history. It does seem that it is not as slow starting up or opening IE now and not working as hard when I am on IE browsing the web. However, my husband uses BBC news as well and he doesn't have the mpstat sites appearing in his tabs or history at all so I am not really sure what is going on there. The conhost.exe thing does still concern me because I have read it is actually a legitimate process but it should not appear in the task manager list, and that if it does it is likely a bitcoin miner. The file size is also suspicious, as my file size is 338,432 and that is not the typical size and it is listed as created June 9, 2015.
-
BBC news, Yahoo, and Facebook primarily. I pay bills as well and my son plays games on my computer on a site called A10 i believe. Once in a while I go to MSNBC as well for news.
-
I use internet explorer 11. And if you mean that the mpstat pages happen themselves, yes. I do not visit those pages, but they have been appearing in my tabs (and in my historyof pages too), like when I go to open a new page when I am on IE, I will click on the blank tab at the top, and when the new tab opens up, frequent pages that are listed will include pages I have actually visited, but then there will be a page with the weird 36fxxxxx.mpstat.us address on it. It has not happened since I posted here last night tho. I am going to donate $20 to you later today (from my work computer) for your continued help with this.
-
Here is the fixlog. I hope I did it all correctly but I think I messed it up. I downloaded the fixlist to my desktop. I moved FRST64.exe & FRST.txt and addition.txt onto the desktop in order to make sure it was all in the same place with the fixlist. ( I found doubles of these files in the original folder & was getting them confused, so for some reason, I decided to rename the old and newer FRST and addition files to keep them straight. I am very sorry about that, as I realized after the test & restart that it probably messed up the whole fix.) Then I ran frst64exe as administrator, clicked fix one time. Fixlog was created & then it had me do a restart. But when I opened ie, the mpstat.us still appeared in my history list of pages visited today. I deleted it in the history list, then reset ie settings. I then closed ie, opened it again & found an mpstat.us page in the history list again. Did I mess it all up? Can I rename the file back to FRST.txt & rerun the fix? Or do I just need to have my computer privileges taken away now? I am so sorry I am an idiot. I am going to go lay down in the corner now. Fixlog.txt
-
It is still making intermittent beeps, not as often, but still doing it. My frequent tabs were empty when I opened IE but then after visiting one page, I closed the browser session, opened IE again, & one of those 36f11e49.mpstat.us pages was in my tabs again. In my history tab for today, I found that mpstat page & also a site listed as s.tagsrvcs.com and I have no idea where that came from. Clearly some malware, but I never looked in my history tabs before but I am guessing this is still part of the mpstat menace. Conhost.exe seems to be out of the listing of processes from all users, so that's good
-
I forgot to mention, that as the scan was nearing end, my AVG turned itself back on again. That was my fault because when i disabled it I thought 15min would be enough but the scan took atleast 30 min, I should have chosen "until restart". When it turned on, it found an object in my appdata/local/temp folder and it said was dangerous, zoek.bat, IDP.ALEXA.43, and asked if I wanted to block/quarantine it. I waited to answer until the zoek scan was complete and then I said no. And it set it as an exception.
-
Thank you so much for helping me out with this. I did as you said, downloaded zoek.exe, turned off antivirus & firewall & ran zoek from my desktop as admin. I was concerned it wasn't working as it took 10 min to bring up its window (I left conhost.exe running for the scan, as I wasn't sure if it needed to be running for the scan to do its magic or not, hope I didn't screw anything up doing that.) I have attached the scan results. Hope that is okay too, as your initial instructions said you prefer attachments but your written instructions said to paste. zoek-results.log
-
Hi there, I am not really sure how to explain what exactly is infecting my computer but I think at some point, as many others here report, I accidentally clicked on an ad a couple months ago. trc.taboola.com sites that I never visited started showing up in my frequent tabs. An example of one of the taboola tabs: "trc.taboola.com/ziffdavis-network15-pcmag/log13/available". This tab appeared the next time I started my computer after I had visited a pcmag website. And there were other page names that would appear in the taboola addresses, like PCMag, that I had visited on later occasions. I also started getting mpstat.us tabs as well, for example, 36f142cc.mpstat.us & another, 36f1f08e.mpstat.us. I have had many of these over the last several weeks, sometimes two at a time, but usually just one, when I view the frequent sites on a new tab. Always with a 36 at the start and then other letters & numbers. I did several scans with AVG and Malwarebytes & found nothing. I ran scans with Adwcleaner, that found several things, which I deleted. I also ran a junkware JRT scan. I would be happy to post all the logs of scans I have run if you think that would help to troubleshoot. Conhost.exe is a process that also seems to be causing my computer to slow down. I now end the process when I start my computer, but every time I restart, there it is running again & seems to really slow things down. And when the process is running, my computer makes weird intermittent beeps. I have read this conhost might be a bitcoin miner. Currently the taboola addresses no longer appear on my frequent tabs, but the mpstat addresses do. Please help. I have no idea how to rid my machine of this taboola, mpstat & conhost menace. Thank you in advance for any help or guidance you can provide. I am including the FRST & addition logfiles from a scan I did last night. Amy Addition_04-08-2015_22-39-10.txtFRST_04-08-2015_22-39-10.txt