Sandor

Thanks for the logs. You'll have more work to do, but please wait for @AdvancedSetup to came back.

Sounds good. Now please run Malwarebytes, do a full scan and get us its report. After that collect and attach reports from Farbar Recovery Scan Tool as described before by @AdvancedSetup

If I'm allowed to intervene, @ItsAllo, please download AV block remover, unzip it and run. If you possibly couldn't run it, simply rename AVbr.exe -> AV-b-r.exe for expamle and run. At least run in in Safe mode with network if renaimed failed too. Follow the instructions. After reboot you should have AV_block_remove_date-time.log. Please attach it to your next post.

Thanks a lot, AVZ is clean now even on VT and it is great! Is it possible to do the same thing to another two quite known tools - RSIT and HiJackThis or should I start new topic? Link to the first one is here - https://www.virustotal.com/gui/file/643f9279743c1737607e4a69d5dfcc3f692e495ac84c50205f6c613c2055919a/detection And to the second one is here - https://www.virustotal.com/gui/file/9da5a899b9d55e1d43718ec0ad6368f9e9ef0242a4e88cd5ddb2cc6d7bfa5fb3/detection

Hello, Please exclude VT detection of AVZ (which is simply renamed for certain reason). It is well known tool and I'm only interested in removing the detection on Virustotal if it is possible. https://www.virustotal.com/gui/file/56b231e3183a8ce962fea49ed53a1caa9fccb8e6cd3ae4574dbc24d5bbbb8fc9?nocache=1 Thanks in advance.

Please uninstall, update, or otherwise address the following as appropriate for your computer. ------------------------------ [ ArchAndFM ] ------------------------------ WinRAR 6.01 (64-bit) v.6.01.0 Warning! Download Update -------------------------- [ IMAndCollaborate ] --------------------------- Discord v.1.0.9002 Warning! Download Update --------------------------------- [ P2P ] --------------------------------- BitTorrent Web v.1.2.2 Warning! Ad-supported P2P-client. BitTorrent v.7.10.5 Warning! Ad-supported P2P-client. -------------------------------- [ Java ] --------------------------------- Java 8 Update 311 (64-bit) v.8.0.3110.11 Warning! Download Update Uninstall old version and install new one (jre-8u333-windows-x64.exe). ------------------------------- [ Browser ] ------------------------------- Opera GX Stable 81.0.4196.61 v.81.0.4196.61 Warning! Download Update ---------------------------- [ UnwantedApps ] ----------------------------- Driver Easy 5.7.2 v.5.7.2 Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall it. Possible you became a victim of fraud or social engineering. Computer experts no longer recommend this program.

Great, good run! Final steps: 1. Rename file FRST64.exe => to uninstall.exe and run. It will uninstall itself and reboot PC. Other tools and folders we use in this cure you can simply delete. 2. Download SecurityCheck by glax24 from here https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe and save the tool on the desktop. If Windows's SmartScreen block that with a message-window, then Click on the MORE INFO spot and over-ride that and allow it to proceed. This tool is safe. Smartscreen is overly sensitive. Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file. Attach it with your next reply. You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

Good run, thank you. Lets have another one run to double-check. I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer. The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. The download links & the how-to-run-the tool are at this link at Microsoft https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Look on the Scan Options & select the FULL scan. Then start the scan. Have lots of patience. It may take several hours. Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run. The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands .....just do not use the computer during this scan. This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.) The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log Please attach that log with your next reply.

Yes, you should. Please run full scan in Malwarebytes and let me see its log.

OK, now in Normal mode try to install and start Malwarebytes.

I see. Please download new fixlist.txt, then go to Safe Mode, run FRST64.exe and press Fix. After reboot new Fixlog.txt will be created, attach it please. fixlist.txt

Before next fix lets try this method: Please download MALWAREBYRES MBST Support Tool run it. Go to Advanced Options tab, press Clean button and let it reboot when needed. Tell us result.

OK, please get new FRST.txt and Addition.txt logs again and attach them in next post.

Good run, thanks. Yes, restart your computer. After restart try to run Malwarebytes and tell us will it start or not.

Good run, thanks. Lets do some more work: Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Double-click to run the program Accept the End User License Agreement. Wait until the database is updated. Click Scan Now. When finished, if items are found please click Quarantine. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Attach or Copy its content into your next reply.

Please download attached file fixlist.txt and place it at your Desktop. Run FRST64.exe and press Fix button. Wait for complete and allow program to reboot the system. You will get file named Fixlog.txt also at your Desktop. Please attach it to your next post @aki fixlist.txt

Thanks for the logs, they look much better. I'll give you next recomendation in a couple of minutes.

You have to just rename file AVbr.exe to something else like AV-br.exe as I said before.

Hello and Please download AV block remover. Run it and follow instructions. If you'll get an error, simply rename file AVbr.exe to AV-br.exe for example and run it again. After restart you'll have folder AV_block_remover behind downoaded tool and file AV_block_remove_date-time.log inside this folder. Please attach log to your next post. Delete old and create new files FRST.txt and Addition.txt using Farbar Recovery Scan Tool. So I'm waiting three logs from you, @aki

Yes, logs show no obvious signs of any infection. Did Avast clean tool run successful and did you run it from Safe mode?

Do you find any Avast leftover signs now? And do you have some other issues?

Hello and You can use Avast clear tool running it from Safe Mode. After completion and restarting in Normal mode @bthause Please do the following so that we may take a closer look at your system for possible troubleshooting: NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply Thanks

I'm sorry for intervention. Just FYI @Czepa, You were using an outdated and no longer supported version of HiJackThis. Here is official fork https://github.com/dragokas/hijackthis

Yes, disable Malwarebytes also and yes, you should download new fixlist.txt file as well.

@Tevervin, you should inform Helpers that you've already got help at several other forums.