garysl

Hi. All seems fine. No signs of any infection. I've run kprm as you asked and attached the log. Thanks kprm-20220921103800.txt

Hi, I've updated and/or uninstalled the applications, as per your list. Everything now appears to be up to date. Thanks once again.

Sorry, I didn't receive any notification that you'd posted, for some reason. I checked the site and didn't see any new post because it had gone onto a different page. My apologies. Anyway, I haven't noticed any further signs of infection and I I've attached the security check file. Thanks very much. SecurityCheck.txt

Hi, Re last message, logs attached. Thanks. FRST.txt mbytes log.txt Addition.txt AdwCleaner[C01].txt

Hi, I've run the Microsoft Safety Scanner, and it appears to have detected a couple of things, in the same places. Log attached. Thanks. msert.log

Fixlog attached. I haven't noticed any sign of infection. I'm very grateful for your help. Thanks very much. Fixlog.txt

Logs attached. Thanks. Addition.txt FRST.txt

I think Mcafee came pre-installed as a trial when I bought the computer. I uninstalled it because I used malwarebytes. I had no idea it was still there. I've used the removal tool and attached the log, Once again, thanks very much. mccleanup.log

Fixlog attached. Thanks. Fixlog.txt

Logs attached. Thanks Addition.txt FRST.txt

Hi, I've run Eset, as you suggested. It's detected two items. One is something within a free version of Avast anti-virus that it sees as unsafe (I don't use the programme) and the other is something linked to Windows Defender. I've attached the log. Thanks again. eset.txt

Hi, I didn't create that file C:\Users\garys\AppData\Roaming\credentials_12022022_012203.txt and I've deleted it. When I checked, I noticed another file, created on the same date, in the same folder, named Lazagne.exe. This appears to be a password collecting programme and I've deleted that as well. I've run the fix that you provided and it seems to have worked. I'm no longer getting any notifications from Malwarebyes. The log is attached. Thank you very much for your help. Fixlog.txt

Hi, Thanks for your reply. I don't have McAfee. The only anti-virus software that I'm running is Malwarebytes premium. It isn't detecting anything. I downloaded the Malwarebytes Anti-Rootkit software and that discovered 7 pieces of malware, which it then cleaned. I rebooted but continued to receive the same notification about Windows Powershell attempting to contact a blocked website. I have rerun MBAR and it is now saying everything is clean (despite the ongoing notifications) I have attached the logs from the anti-rootkit scan with the detection and subsequent run, where it detected nothing, in my first message. The log from Malwarebytes premium is in the second message, I have also run Microsoft's windows malware removal tool and that hasn't detected anything either. Thanks

Hi, Logs from Farbar and Malwarebytes scan attached. Addition_09-09-2022 18.57.09.txt FRST_09-09-2022 18.57.09.txt mbytes.txt

Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 09/09/2022 Protection Event Time: 17:40 Log File: adc478fa-3055-11ed-9f3e-000000000000.json -Software Information- Version: 4.5.13.208 Hi, I'm receiving constant notifications that Malwarebytes is blocking an outbound connection, from my laptop. Scans on Malwarebytes have not detected any threats, however, I downloaded and used MBAR rootkit, which did discover some issues. After "cleaning" the system, I rebooted, as required, but the notifications still persist. Are you able to help? I've attached the MBAR logs and the notification log. Thanks t Components Version: 1.0.1740 Update Package Version: 1.0.59845 Licence: Premium -System Information- OS: Windows 11 (Build 22000.856) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Malware Domain: IP Address: 103.212.182.45 Port: 1177 Type: Outbound File: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (end) mbar-log-2022-09-09 (15-49-14).txt mbar-log-2022-09-09 (17-19-20).txt