Bingo321

Thank you for your help, I ran it and looked through the log file and it appears to have found and removed all the entries in the registry and removed the process. I appreciate your help, and hope you understand my frustration with this. One last question, would it be possible to get Wondershare added to the list of Malware that MB looks for and removes?

I have already manually deleted the folder under C:\Program Files (x86)\Wondershare Will this still work?

The problem is that Wondershare is Malware and is installed on my machine. Malware bytes does not detect it for some reason. I've had to manually remove it. It is not listed as an installed program either when you look under Programs in control panel. I did not install it. It is also a memory hog, and is a known bad actor. I don't understand why MalwareBytes doesn't detect and remove it.

Spelling error in post above. Program should be spelled Wondershare. Look for Wondershare Application Framework as a running process or WsAppService.exe Malware Bytes does NOT detect or remove it.

Just want to let you know that a key logger has been installed on my computer by a program that originated from China called Wundershare that MalWare bytes did not detect, and it appears this is the source of the password compromise and subsequent emails. I think you are making a very dangerous assumption telling folks that these types of emails are harmless and come from data breaches or other sources. Password compromise via key loggers is probably the single most dangerous type of virus/malware out there, and has the potential do real damage to people in numerous ways. Consider electronic banking for just one example. This should be taken more seriously.

By the way, Wondershare doesn't even show up as an installed program anywhere in control panel. The only place I find reference to it is in my startup services

Isn't Malware Bytes supposed to catch and block programs like Wondershare? I've found a ton of information about it pointing to all kinds of malware, including key loggers.

FYI, I found a questionable application called Wondershare Application Framework in my startup services.

I believe my PC is infected and I need some help. Malware Bytes scan shows no threats, but I have some evidence of an infection. Files are attached. See thread on Save Yourself Email virus. Addition.txt FRST.txt

This is exactly what I did above. I attached the files in the second post and I made a post in this very section asking for help. I'm confused, do I need to ask for help again?

No, the email I received is different from those posted. Also, about two weeks ago I got a spam email and when I opened it in Outlook, a command window opened in the background and ran a script and closed before I could do anything. Right after that I notices some of the view settings in MS Outlook had been changed. This week I logged into a site and used this password and selected "save password" in Firefox. Today I got an email with this password in it and saying they know my passwords. It all happened in sequence, and I do believe this PC is indeed infected with something that is looking at my cookies. This was not an email account password, and it was not a password that has ever been compromised in a data breach. Malware bytes scans came up clean afterwards. I'm at the point where I guess I'm going to have to nuke the PC and start all over, but I had hoped someone on here could help before I have to do that. Please don't brush this off as an email scam, I do believe this machine is indeed infected, and I'm hoping someone here will take this threat seriously.

I have also read site that list REMOVAL INSTRUCTIONS for this virus. https://howtoremove.guide/remove-save-you-email/ So this leads me to believe there may indeed be something on my PC, and the password it found was one that I had saved in a cookie in Firefox. I'm attaching the FBAR files and hoping someone can help me. Addition.txt FRST.txt

My PC is infected with the Save Yourself email virus despite Malware Bytes showing repeated clean scans. I need help removing it, it has already recorded and emailed me confirmation it knows one of my passwords. I thought Malware Bytes would have protected me from this, but apparently it still got through.