Thompa

# DelFix v1.013 - Logfile created 11/12/2017 at 22:24:56 # Updated 17/04/2016 by Xplode # Username : Thomas - THOMAS-PC # Operating System : Windows 10 Enterprise (64 bits) ~ Activating UAC ... OK ~ Removing disinfection tools ... Deleted : C:\FRST Deleted : C:\Users\Thomas\Downloads\FRST-OlderVersion Deleted : C:\Users\Thomas\Downloads\Addition.txt Deleted : C:\Users\Thomas\Downloads\Fixlog.txt Deleted : C:\Users\Thomas\Downloads\FRST.txt Deleted : C:\Users\Thomas\Downloads\FRST64.exe ~ Creating registry backup ... OK ~ Cleaning system restore ... Deleted : RP #2 [Checkpoint by HitmanPro | 12/04/2017 22:48:20] Deleted : RP #4 [Restore Point Created by FRST | 12/07/2017 00:14:00] Deleted : RP #6 [Restore Point Created by FRST | 12/07/2017 00:16:28] Deleted : RP #7 [Windows Update | 12/11/2017 15:50:33] New restore point created ! ~ Resetting system settings ... OK ########## - EOF - ##########

Yes, I'm still here. Everything is back to normal.

Absolutely! Here it is and thanks again for the help. Quarantine.zip

Here is the fixlog.txt file. Ran FRST and it seems the Bitcoinminer is gone now. No spawned processes for 10 minutes. I'll test more tomorrow and let you know, it's getting late now. So far so good Big thanks! Fixlog.txt

Hi Aura Thanks for looking into my problem. I cant see the fixlist.txt.

Hi This is my first post here and I'll try to follow the guidelines. I have a problem with a process names svchst.exe using all my CPU. Several instances can occur. If i kill the process it will respawn after a while. The description is Windows Spyware Service. Checking with Process Explorer the svchst.exe process parent is a cmd.exe which is unsigned. The same cmd.exe is also parent to a conhost.exe, also unsigned. I cant see the filepath to any of the files. Checking the properties->TCP/IP tab on svchst.exe it shows there is a connection: TCP MYIP:52361 163.172.226.131:3333 ESTABLISHED What to do? Thanks in advance Malwarebytes Threat Scan log.txt FRST.txt Addition.txt