Jump to content

Wasit12348

Members
  • Posts

    7
  • Joined

  • Last visited

Reputation

0 Neutral

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. Thank you very much. I really appreciate your help. 🤗
  2. I have ran the the fix and my issue seems to be completely gone. The fixlog is attached in the post and here is the Google Drive link to the Quarantine zip: https://drive.google.com/file/d/10MwXlYQMAOxSl8o3geef6-_ABtk_Grd1/view?usp=sharing Are there any more procedures I need to perform? Fixlog.txt
  3. Also I just realized, after running the fix and restarting the extension is not installing.
  4. Here are the all the files. Addition.txt Fixlog.txt FRST.txt
  5. Hey, Sorry for the late reply(time zone differences). So as per your instructions I ran the FRST fix and after restarting I re-scanned with FRST. The log files are attached to this post. Also, I know its very time consuming to read through the log files, so I really appreciate you volunteering to help others. Fixlog.txt Addition.txt FRST.txt
  6. Update: Disabling this file from my Startup List seems to stop the extension from installing. But I don't think its still a solution as the malware is still in my PC. The "Open File Location" button is greyed out in this file so I don't know where this file is located.
  7. I've come from this post by IhsanRocks: My issue seems to be very similar to this. An unknown extension by the name of "XUpdateFlow" keeps installing itself in my browser. This has caused a lot of issues. My Google and Facebook accounts have been compromised and I had to reset the passwords. I fear someone might have remote access to my PC. I have a feeling this extension might be storing passwords from my browser. Recently, I've also seen weird windows pop open for a second or two. My CPU usage suddenly gets very high and doesn't come down until the restart my PC. From the extension manager I've been able to locate the directory from where the extension is installed. "C:\ProgramData\Verhj\Manb\3F0CCBAB" - This is the directory. There are four files in this directory. Below is a screenshot for reference: These are the contents of the files: Note - The Javascript file seems to have a lot of random characters and the Png file is a blank solid white image. This is what I've tried: My first instinct was to remove the extension from my browser but it just reinstalled itself after a few minutes. Then I tried to disable the extension but it just resets to enabled the next time I restart my pc. I Scanned with Malwarebytes multiple times but the issue still exists. (I will note though, my CPU usage issue got fixed with Malwarebytes scan) I have also tried to delete certain folders and files associated with the extension but they just reappear the next time I restart my pc After searching for a solution I found Ihsan's post. I already did the first part of the Solution but couldn't proceed further because of cautions. This is the first part of the solution posted by kevinf80: https://forums.malwarebytes.com/topic/276987-unknown-extension-keeps-redownloading-itself/?do=findComment&comment=1471378 I scanned with Malwarebytes, AdwCleaner and FRST. The log files are attached in the post. I hope someone can help me resolve this issue. // I am currently using Microsoft Edge - Version 91.0.864.70 and 64bit Windows MalwarebytesLog.txt AdwCleaner[C00].txt AdwCleaner[S00].txt Addition.txt FRST.txt
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.