Jump to content

pikachuop

Members
 View Profile  See their activity

  • Posts

    13

  • Joined

  • Last visited

 Content Type 

Posts posted by pikachuop

    Does Malwarebytes remove DDOS?

    in Malwarebytes for Windows Support Forum

    Posted · Edited by AdvancedSetup
    updated font issue

    Okay, I downloaded VPN Master then I found it to be fishy. I removed it from Chrome and went onto Google to search about it. I heard that it collects following: 

    • Your IP address
    • Your internet service provider (ISP)
    • Connection timestamps
    • Size of data transferred
    • Usage statistics
    • Platform, browser, and application version
    • Mobile device information, such as your IMEI code
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     

    Im very concerned and would like to remove those things. I think it DDOS'ed me.

     

    Virus redownloads themselves after delete them in quarantine

    in Resolved Malware Removal Logs

    Posted

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-12-2019
    Ran by LIGHTNING (administrator) on MCQUEEN (Dell Inc. Inspiron 3647) (17-12-2019 11:39:06)
    Running from C:\Users\LIGHTNING\Downloads
    Loaded Profiles: UpdatusUser & LIGHTNING (Available Profiles: UpdatusUser & LIGHTNING)
    Platform: Windows 8.1 (Update) (X64) Language: English (United States)
    Default browser: Chrome
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
    (CyberLink Corp. -> CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
    (Dell Inc. -> ) C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
    (Dell Inc. -> PC-Doctor, Inc.) C:\Program Files\My Dell\uaclauncher.exe
    (Dell Inc. -> SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
    (Dell Inc. -> SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
    (Dell Inc. -> SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
    (Discord Inc. -> Discord Inc.) C:\ProgramData\LIGHTNING\Discord\app-0.0.305\Discord.exe
    (Discord Inc. -> Discord Inc.) C:\ProgramData\LIGHTNING\Discord\app-0.0.305\Discord.exe
    (Discord Inc. -> Discord Inc.) C:\ProgramData\LIGHTNING\Discord\app-0.0.305\Discord.exe
    (Discord Inc. -> Discord Inc.) C:\ProgramData\LIGHTNING\Discord\app-0.0.305\Discord.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Grid Republic (COMPUTATIONAL CHARITY PROJECT INC) -> Charity Engine) C:\Program Files\BOINC\boinc.exe
    (Grid Republic (COMPUTATIONAL CHARITY PROJECT INC) -> Charity Engine) C:\Program Files\BOINC\boinctray.exe
    (Grid Republic (COMPUTATIONAL CHARITY PROJECT INC) -> Charity Engine) C:\Program Files\BOINC\charityengine.exe
    (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.22013_x64__8wekyb3d8bbwe\livecomm.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
    (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
    (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (Opera Software AS -> Opera Software) C:\Users\LIGHTNING\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
    (Opera Software AS -> Opera Software) C:\Users\LIGHTNING\AppData\Local\Programs\Opera\assistant\browser_assistant.exe
    (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Qualcomm Atheros -> ) [File not signed] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ActivateDesktop.exe
    (Qualcomm Atheros -> Qualcomm®Atheros®) [File not signed] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
    (Qualcomm Atheros -> Windows (R) Win 7 DDK provider) [File not signed] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
    (Roblox Corporation -> Roblox Corporation) C:\Users\LIGHTNING\AppData\Local\Roblox\Versions\version-53eb96b404e6400c\RobloxPlayerBeta.exe

    ==================== Registry (Whitelisted) ===================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-08] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
    HKLM\...\Run: [boinctray] => C:\Program Files\BOINC\boinctray.exe [69952 2018-01-19] (Grid Republic (COMPUTATIONAL CHARITY PROJECT INC) -> Charity Engine)
    HKLM\...\Run: [boincmgr] => C:\Program Files\BOINC\charityengine.exe [8662848 2018-01-19] (Grid Republic (COMPUTATIONAL CHARITY PROJECT INC) -> Charity Engine)
    HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
    HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
    HKLM-x32\...\Run: [GamingWonderland AppIntegrator 32-bit] => C:\PROGRA~2\GAMING~2\bar\1.bin\AppIntegrator.exe
    HKLM-x32\...\Run: [GamingWonderland AppIntegrator 64-bit] => C:\PROGRA~2\GAMING~2\bar\1.bin\AppIntegrator64.exe
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-10-06] (Oracle America, Inc. -> Oracle Corporation)
    HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
    HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [132736 2013-09-05] (Qualcomm Atheros -> Qualcomm®Atheros®) [File not signed]
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\Run: [GoogleChromeAutoLaunch_62DB3EF159A438D446D5ECA966C038A0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1704944 2019-12-07] (Google LLC -> Google LLC)
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\Run: [Discord] => C:\Users\UpdatusUser\AppData\Local\Discord\app-0.0.301\Discord.exe
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\Run: [McAfeeSafeConnect] => C:\Program Files (x86)\McAfee Safe Connect\McAfee Safe Connect.exe
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\MountPoints2: {1a60250b-b308-11e3-8255-001e101f9add} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\MountPoints2: {fc066ebc-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\MountPoints2: {fc066ecc-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\MountPoints2: {fc066f5c-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\...\MountPoints2: {fc067785-ae55-11e3-8254-001e101f6b30} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\Run: [Opera Browser Assistant] => C:\Users\LIGHTNING\AppData\Local\Programs\Opera\assistant\browser_assistant.exe [2771992 2019-12-12] (Opera Software AS -> Opera Software)
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\MountPoints2: {1a60250b-b308-11e3-8255-001e101f9add} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\MountPoints2: {fc066ebc-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\MountPoints2: {fc066ecc-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\MountPoints2: {fc066f5c-ae55-11e3-8254-5435305ea4e8} - "D:\AutoRun.exe" 
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\...\MountPoints2: {fc067785-ae55-11e3-8254-001e101f6b30} - "D:\AutoRun.exe" 
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\79.0.3945.79\Installer\chrmstp.exe [2019-12-12] (Google LLC -> Google LLC)
    HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.110\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    HKLM\Software\...\Authentication\Credential Providers: [{ACFC407B-266C-8504-8DAE-F3E276336E4B}] -> C:\Windows\system32\AthCredentialProvider.dll [2013-09-05] (Qualcomm Atheros -> Qualcomm®Atheros®) [File not signed]
    HKLM\Software\...\Authentication\Credential Provider Filters: [{ACFC407B-266C-8504-8DAE-F3E276336E4B}] -> C:\Windows\system32\AthCredentialProvider.dll [2013-09-05] (Qualcomm Atheros -> Qualcomm®Atheros®) [File not signed]
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

    ==================== Scheduled Tasks (Whitelisted) ============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {018C0B74-8B85-4808-AA29-4A7077D26E27} - System32\Tasks\Norton Product InstallerIdle => C:\ProgramData\NortonInstaller\NSSInstallStub.exe
    Task: {02CB3A41-7749-4B4A-9713-22B20D2E7D41} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-09-02] (Google Inc -> Google Inc.)
    Task: {0AF1CB58-A7C7-4506-8E43-289111223575} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [979024 2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {0C1BBFC1-D43B-4570-A20D-64E6D5A241D0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [144200 2015-09-02] (Google Inc -> Google Inc.)
    Task: {13BD2F4F-8F57-48A2-A16E-BA8AB596402E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {38608A99-90E6-4BB7-91BC-F61A08BEFFC9} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\My Dell\uaclauncher.exe [1183224 2013-08-22] (Dell Inc. -> PC-Doctor, Inc.)
    Task: {4FEAD451-36EE-4DE8-8485-133783DC5CE5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [979024 2019-02-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {544F3AFC-5836-4E14-8584-70BD7C4869BD} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {5C714337-DA15-4E27-8866-439185CFBF87} - System32\Tasks\Opera scheduled Autoupdate 1527330269 => C:\Users\LIGHTNING\AppData\Local\Programs\Opera\launcher.exe [1528344 2019-12-12] (Opera Software AS -> Opera Software)
    Task: {6C510385-D794-4DB8-A3CE-D07647BE6185} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-12-10] (Adobe Inc. -> Adobe)
    Task: {6D524461-9F68-4F7F-A431-74899483ADD9} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [1183224 2013-08-22] (Dell Inc. -> PC-Doctor, Inc.)
    Task: {725E0836-A2D8-4767-9916-CFB7B081C84B} - System32\Tasks\{4E0E4EA6-13E0-44DB-9806-6963C45FFDE6} => C:\Windows\system32\pcalua.exe -a "c:\program files\bytefence\ByteFence.exe" -c /uninstall
    Task: {74BC6E07-96F7-4174-8648-F59A3ED8E02C} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
    Task: {7B54FDFF-3311-4916-B6B7-B39D4675A450} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_303_pepper.exe [1453112 2019-12-10] (Adobe Inc. -> Adobe)
    Task: {8200EEBF-713D-4130-B271-D6AB8A39A6D3} - System32\Tasks\{75D45CD3-6118-4656-B2B0-E584B1C83F1B} => C:\Windows\system32\pcalua.exe -a C:\Users\LIGHTNING\AppData\Local\Roblox\Versions\version-a6e1765288a24d79\RobloxPlayerLauncher.exe -c -uninstall
    Task: {9107FEA9-7755-45C6-9F31-48301F4B58CC} - System32\Tasks\Opera scheduled assistant Autoupdate 1547475227 => C:\Users\LIGHTNING\AppData\Local\Programs\Opera\launcher.exe [1528344 2019-12-12] (Opera Software AS -> Opera Software)
    Task: {AE742098-AA89-420F-B1C3-685606CE8B3A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {BAEF3D1F-2846-4C6D-9B87-1515677B90C0} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [340440 2013-03-22] (CyberLink Corp. -> CyberLink Corp.)
    Task: {BDD09ABA-59AD-40AF-ABCC-A0FF05C1F7F9} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-2348119855-2733304836-2382047267-1002 => {F063A606-6748-4B89-82A0-3D19D94CE8D3} C:\Windows\System32\VaultRoaming.dll [92672 2014-10-29] (Microsoft Windows -> Microsoft)
    Task: {DBAAB1C5-0B8D-47EA-B7DF-ACB9707C8DA1} - System32\Tasks\BlueStacksHelper => C:\ProgramData\BlueStacks\Client\Helper\BlueStacksHelper.exe [745480 2019-04-16] (BlueStack Systems, Inc. -> BlueStack Systems, Inc.)
    Task: {DC2A8AB8-798F-405D-BD49-B4E9A6E617E1} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [410792 2017-01-13] (Microsoft Corporation -> Microsoft Corporation)
    Task: {E02FC250-CD5C-4ECD-B2B3-5D29ECF7344A} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [110144 2013-03-05] (CyberLink Corp. -> CyberLink)
    Task: {E6E48793-7D98-457D-8E7A-B77D84D88DDC} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [428536 2013-08-22] (Dell Inc. -> PC-Doctor, Inc.)
    Task: {EBF84E3F-D7B4-4EC5-A522-52C4006A32CC} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [1905072 2019-09-19] (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{E727F945-5873-4B7D-90F0-65AA6EDB42C1}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
    HKU\S-1-5-21-2348119855-2733304836-2382047267-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
    SearchScopes: HKLM -> DefaultScope {99687BD2-F9EF-4FE8-9EE2-7A546C917DBC} URL = 
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM -> {26080cad-4adc-49ac-8c63-eda16e595cbd} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
    SearchScopes: HKLM -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
    SearchScopes: HKLM-x32 -> DefaultScope {99687BD2-F9EF-4FE8-9EE2-7A546C917DBC} URL = 
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM-x32 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1001 -> DefaultScope {3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} URL = 
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1001 -> {26080cad-4adc-49ac-8c63-eda16e595cbd} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1001 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = 
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1001 -> {99687BD2-F9EF-4FE8-9EE2-7A546C917DBC} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggbc_14_41_ie&cd=2XzuyEtN2Y1L1Qzu0CzztC0FyCyCtAzztDtC0FyC0B0AyByDtN0D0Tzu0StCtDtCyEtN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyC0C0B0ByC0AyB0CtG0F0C0FtBtG0EyEzz0BtGyD0B0FyBtGtD0AyB0F0ByByB0AyB0EyB0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EtD0DyE0EtD0FtCtG0EyByEzztGyEtAyByBtG0AzzyEtBtG0C0D0A0DtByE0CtCyB0EyB0C2Q&cr=828649445&ir=
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1001 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1002 -> {26080cad-4adc-49ac-8c63-eda16e595cbd} URL = 
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1002 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = 
    SearchScopes: HKU\S-1-5-21-2348119855-2733304836-2382047267-1002 -> {f7bb050c-e116-44da-89c2-6f2b68c54836} URL = 
    BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2019-06-26] (Microsoft Corporation -> Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_221\bin\ssv.dll [2019-09-23] (Oracle America, Inc. -> Oracle Corporation)
    BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2019-08-18] (Microsoft Corporation -> Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_221\bin\jp2ssv.dll [2019-09-23] (Oracle America, Inc. -> Oracle Corporation)
    Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2018-10-16] (Microsoft Corporation -> Microsoft Corporation)
    StartMenuInternet: IEXPLORE.EXE - iexplore.exe

    FireFox:
    ========
    FF DefaultProfile: ph77189g.default-1560782019535
    FF ProfilePath: C:\Users\LIGHTNING\AppData\Roaming\Mozilla\Firefox\Profiles\ph77189g.default-1560782019535 [2019-12-17]
    FF Plugin: @java.com/DTPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\dtplugin\npDeployJava1.dll [2019-09-23] (Oracle America, Inc. -> Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\plugin2\npjp2.dll [2019-09-23] (Oracle America, Inc. -> Oracle Corporation)
    FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Users\LIGHTNING\Downloads\VLC\npvlc.dll [No File]
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel® Identity Protection Technology Software -> Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel® Identity Protection Technology Software -> Intel Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2018-10-16] (Microsoft Corporation -> Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-13] (Microsoft Corporation -> Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [No File]
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [No File]
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.35.422\npGoogleUpdate3.dll [2019-12-14] (Google LLC -> Google LLC)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.35.422\npGoogleUpdate3.dll [2019-12-14] (Google LLC -> Google LLC)
    FF Plugin HKU\S-1-5-21-2348119855-2733304836-2382047267-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\LIGHTNING\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-09-05] (Unity Technologies ApS -> Unity Technologies ApS)

    Chrome: 
    =======
    CHR HomePage: Default -> hxxp://google.com/
    CHR StartupUrls: Default -> "hxxp://google.com/"
    CHR Notifications: Default -> hxxps://play.pokemonshowdown.com; hxxps://www.youtube.com
    CHR Profile: C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default [2019-12-17]
    CHR Extension: (Angry Birds) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-12-20]
    CHR Extension: (AdBlock — best ad blocker) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2019-12-07]
    CHR Extension: (BTRoblox - Making Roblox Better) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbkpclpemjeibhioopcebchdmohaieln [2019-11-01]
    CHR Extension: (Roblox+) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfbnmfgkohlfclfnplnlenbalpppohkm [2019-09-30]
    CHR Extension: (Grammarly for Chrome) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2019-12-15]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-05]
    CHR Extension: (Chrome Media Router) - C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-12-15]
    CHR Profile: C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\System Profile [2018-06-11]
    CHR HKLM\...\Chrome\Extension: [Ìÿ] - <no Path/update_url>
    CHR HKU\S-1-5-21-2348119855-2733304836-2382047267-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [Ìÿ] - <no Path/update_url>
    CHR HKLM-x32\...\Chrome\Extension: [Ìÿ] - <no Path/update_url>
     

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Browser not sync. 5 year old me put that name, dont ask why.

    Addition.txt

    Virus redownloads themselves after delete them in quarantine

    in Resolved Malware Removal Logs

    Posted

    They are ALWAYS alot of Ask.com Viruses and Astromenda.com viruses. Im writing this because the viruses are slowing down my pc. There are duplicates of them. I have scanned alot of times and they are still there. Tho the number changes. It becomes smaller.  They dont change my chrome startup page.

     

     

    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 12/16/19
    Scan Time: 2:12 PM
    Log File: 008f40cc-1fcb-11ea-91dd-5435305ea4e8.json

    -Software Information-
    Version: 4.0.4.49
    Components Version: 1.0.781
    Update Package Version: 1.0.16242
    License: Free

    -System Information-
    OS: Windows 8.1
    CPU: x64
    File System: NTFS
    User: MCQUEEN\LIGHTNING

    -Scan Summary-
    Scan Type: Threat Scan
    Scan Initiated By: Manual
    Result: Completed
    Objects Scanned: 365350
    Threats Detected: 15
    Threats Quarantined: 0
    Time Elapsed: 27 min, 4 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Detect
    PUM: Detect

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 0
    (No malicious items detected)

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 2
    PUP.Optional.ASK, C:\USERS\LIGHTNING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 2, 454827, , , , 
    PUP.Optional.Astromenda, C:\USERS\LIGHTNING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 298, 455058, , , , 

    File: 13
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.ldb, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.ldb, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000012.ldb, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000013.log, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000014.ldb, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\Users\LIGHTNING\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 2, 454827, , , , 
    PUP.Optional.ASK, C:\USERS\LIGHTNING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 2, 454827, 1.0.16242, , ame, 
    PUP.Optional.Astromenda, C:\USERS\LIGHTNING\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, 298, 455058, 1.0.16242, , ame, 

    Physical Sector: 0
    (No malicious items detected)

    WMI: 0
    (No malicious items detected)


    (end)

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.