Jump to content


  • Posts

  • Joined

  • Last visited


0 Neutral
  1. Hi, All seems to be running fine. If anything comes up I'll let you know. Thanks again for all your help. Jake
  2. Hi, I've ran the update and here is the latest version. Thanks, Jake
  3. also, I've seen under optional updates, I can update to version 20H2. Do you want me to complete this before moving further?
  4. Hi, in response to your earlier message. No I bought this computer new, prebuilt about 18 months ago. Only ever used by me. When installing windows on it however, I did use a grey key. This may explain that.
  5. Thanks. Just ran that. Attached is the file SecurityCheck.txt
  6. Hi, Sorry if I didn't explain that well, I ran malwarebytes which returned those PUP alerts. I then quarantined and deleted them. The paths shown in the log have now been removed. I've uninstalled all avast related stuff and ran FRST with the fixlist saved. Attached are the results. Thanks, Jake Fixlog.txt
  7. Hi, I'm posting the results of the FRST scan after running the chrome cleanup instructions. Also I'm attaching the results of the malwarebytes scan I did after cleaning up chrome. It appeared to pick up some kind of PUP. My computer appears to be running as normal on the surface now. Still concerned other malicious stuff could be going on. Thanks, Jake Addition.txt FRST.txt mwb2.txt mwb1.txt mwb3.txt
  8. Hi, I have managed to remove the extension and stop the files/folders from reoccurring when I restart my computer. I saw a microsoft forum post where users were experiencing the same problem as myself, as recently as this week. See here https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/uaskembed-chrome-extension-virus/59297d4e-70fc-4b0d-9fe1-d3e5376ddb79?messageId=6d115e99-2df8-4545-a44a-a823f01bf186 I am user jake0400 and user AW gave a working solution. To remove it and stop it returning, There was a Task Scheduler entry: \Microsoft\Windows\BrokerInfrastructure\AddresMmRes I deleted this. Then I deleted the following. C:\ProgramData\ScriptsReal\TretWord\xmsds_Jonavider.dll C:\ProgramData\Focx The Focx folder deletes with no problems. In my case, the folder and files TretWord\xmsds_Jonavider.dll were unviewable even with show hidden folders and I had no admin privileges or ownership of them. After changing ownership back to myself I wiped the whole C:\ProgramData\ScriptsReal folder and this killed it. Unfortunately, I didn't think to zip the other folder and send it here, It was late for myself and I was happy to be rid of the problem. Apologies for attempting something not instructed by you, I have massively appreciated your help. If it's ok with you, I will clean my google chrome and post the FRST log here. Thanks, Jake
  9. Thanks, I will work through those tasks asap. Was there anything unusual about that folder? Jake
  10. Hi, Thank you both, Attaching the folder now Jake Focx.zip
  11. So done a little more looking and found a suspicious extension in chrome that I've already tried deleting twice. It's called uSecureSkip. When I follow the extension source, I find a hidden folder called focx, I have no memory of this prior to the problems I'm having and it keeps reinstalling itself when deleted. The extension was not present before the problems I'm having, I regularly check my extensions as I have some for language learning. Deleting the folder and reinstalling chrome doesn't seem to kill it. I've attached some screenshots of what I'm finding, Any further help appreciated. Thanks, Jake
  12. Hi, I've just opened my browser again (chrome) and seen that the bing hijack is still there unfortunately. Here's a search followed by what bing throws up unprompted.
  13. Hi, @AdvancedSetup I've ran the fix, Attached is the fixlog. Thanks again for your help, Are there any further steps? Jake Fixlog.txt
  14. Hi, Attaching the files as instructed. no files were picked up this time for malwarebytes or adwcleaner but I've posted the logs regardless. Thanks, Jake Addition.txt FRST.txt step1.txt step2.txt
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.