Search the Community

So ive got this issue where, everytime i open my league of legends client, its suddenly crash and detects the svchost.exe as a mawalre, even tho i delete it many times it just restore automatically. thanks in advance

Sorry if this is the wrong forum to post this in. This is my first time posting on these forums. I was wondering if there's a way to confirm if a USB flash drive is free of viruses, malware, and/or ransomware? I used this USB flash drive back on Feb. 23rd with a computer (Windows XP) that was a part of a network. The server was infected with Ransomware and all the files on the shared network were encrypted on Feb. 25th. Supposedly nobody used any of the computers on the network on the 25th, so I suspect that the infection happened earlier and activated the Ransomware at a later date (I don't know if this is even possible). I always remove the flash drive from the computer when I'm not using it, however, since I don't know when exactly the infection occurred, I really don't know if it was infected or not. The tech that was hired was unable to decrypt the files and couldn't contact the hacker to pay the ransom, so we ended up replacing the computer with Windows 10 and restoring some of the files from an older backup. There are files I'd like to transfer from the flash drive to the new Windows 10 computer (Computer #1) and to an older spare computer running Windows XP (Computer #2), as the backup the tech used did not have copies of these files. After avoiding the flash drive for weeks, I decided to test it out on Computer #1 (Apr. 3rd), since I thought Windows 10 would be more secure. After plugging it in, there was a notification saying "There is a problem with this drive. Scan the drive now and fix it." I ran Windows Defender and the scan detected "no threats" on the USB flash drive. I also ran a full system scan and it was also clean. Since then, I have been saving documents to the flash drive and opening files on it (always while using Computer #1), but I've refrained from copying the flash drive's files to Computers #1 and #2 because of a lingering fear of infection. Every time I plug it in, I always get the same notification to scan & fix it, but every time I scan it with Windows Defender, no threats are ever found. It's been over two weeks now since I've tried inserting the flash drive and nothing bad has happened to Computer #1 (or the rest of the network for that matter). I've avoided using the flash drive on Computer #2, because I worry Windows XP will be more vulnerable or the infection will only effect XP but not 10. Questions: 1) MAIN QUESTION: Is the USB Flash Drive safe to use (free of Ransomware, Malware, Viruses, etc.)? 2) Does Ransomware usually wait a period of time before activating or take awhile to encrypt files? 3) Are Windows Defender and Avast Antivirus even capable of detecting Ransomware or am I wasting time running scans with them? 4) Have I made a big mistake by opening files on the flash drive with Computer #1, and spread malware on the network? 5) Does Ransomware even make copies of itself and spread like viruses do? EDIT: Another thing I noticed is that the Flash Drive is supposed to have a size of 16 GB, but according to Windows Explorer, its total size is only 14.9 GB. Is this just false advertisement of the product, or is something wrong with the flash drive? Notes: USB Flash Drive: SanDisk Cruzer Glide 16GB Computer #1: Windows 10 Computer #2: Windows XP (Service Pack 3) Windows Defender: Updates automatically (up to date) - for Computer #1 Avast Antivirus: Updates automatically (up to date) - for Computer #2 * The USB Flash Drive is usually plugged into a computer for 2 hours or less. I very rarely leave it in for a long duration. Thanks for your help, T-Ruth

Every time I open chrome, Avast blocks a website named Deloton.com. I've been doing some research and it seems it is a bowser hijacker that injects adds into your bowser. I'm glad avast is able to block it, but how do I remove it completely? Both Malwarebytes and Avast detect nothing. I attached Avast notice of block and the requested logs. Thanks. FRST.txt Addition.txt Malwarebytes.txt

Hello. Long time Malwarebytes user; I love your program. That said, this detection seems a bit off. At my latest scan, just after updating Avast, I recieved a notification that: C:\ProgramData\AVAST Software\Avast\gf2engine\reganalyze.dat contained Spyware.Pony. It seems kind of a strange place for Spyware to pop up, especially Pony, as it is primarily distributed via malicious Emails, and I practically never use my Email except to confirm account registration on reputable websites. Unfortunately, when trying to restore the file to upload it with my log, Malwarebytes gives a rather unhelpful "Access is denied" message, not allowing me to, so it appears I cannot send it. Edit: I am also including the MBAMSERVICE.log. After looking around the forum a bit, I figure it may be of some use, potentially. Edit 2: I have gotten Avast to re-download the file. I will run MalwareBytes again to check if it is still detected. detectlog.txt MBAMSERVICE.LOG

All 3 of my computers were affected with no protection (or disabled) on MB. Yet there were other strange things going on as well. Not sure if it was a Malwarebytes Premium or Avast free update that started it all. I didn't have high resource usage, but couldn't open programs, etc. Avast ui wouldn't load and upon repair it said Malwarebytes was an infection. Also, just recently I started getting the MB couldn't load the rootkit driver. I have what I believe was the latest updates package 1.0.3804 - v3.3.1.2183 - components 1.0.262 (MB Premium) - for windows 7 64-bit Using Revo uninstaller I uninstalled Avast (and all associated registries) in advanced mode. Rebooted and MB is all good. Two questions: Does anyone really know if it was MB or Avast that created the havoc? Does anyone have recommendations for an Avast free replacement? Bitdefender OK?

Avast AV has apparently bought a number of rivals such AVG and also programs such as CCleaner. From my recent experience, it would seem that the free version of Avast AV disables or blocks Malwarebytes Web Protection. Here is the experience I had. (1) I updated CCleaner (the free version). (2) A question popped up, asking if I would like to install Avast. I declined, i.e. un-ticked the box. My preference was denied and Avast Free was nevertheless installed. (3) I tried to uninstall Avast, but could not get it completely uninstalled. (4) After doing some research on the internet, I discovered that a special Avast utility, Avastclear, had to be downloaded and run, and that the "complete uninstallation" of Avast had to be done in Windows Safe Mode. This is of course something not known to most people innocently updating CCleaner. (5) Avast seemed to be fully uninstalled after running Avastclear in Safe Mode. But soon Avast Free was back on my computer, seemingly smuggled in via CCleaner or perhaps another program being installed. I certainly did not download and install it myself. (6) I noticed two alarming results. Firstly, the unauthorized re-installation of Avast Free did not automatically disable Windows Defender, as it should have done. Both Windows Defender and Avast Free were running on my computer, in conflict with each other. Secondly, Malwarebytes Web Protection was switched off and could not be switched back on. (7) The only way I could navigate out of the situation, was to uninstall Avast Free again, using Avastclear, and also uninstall Malwarebytes and re-install it with the latest installer. (8) Once the apparent Avast grip on Malwarebytes (and on Windows Defender) was removed, and my computer restarted, Malwarebytes Web Protection could be switched on again. Something seems to be afoot with Avast Free...

Hi, I've just recently been getting the error: progid atkexcom axdata every start-up for a week now. I've scanned with AVAST Boot Scan and it detected a corrupted registry. Sadly, I wasn't able to record this. However, I've spent hte last hour scanning with Malwarebytes and the same things keep popping up. They have been deleted and quarantined over and over again, but they keep coming back. Everytime they were quarantined, Chrome closes. Here is the Report: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 12/9/17 Scan Time: 7:52 PM Log File: 8032dc26-dd1a-11e7-9808-bcee7b5bf6a5.json Administrator: Yes -Software Information- Version: 3.3.1.2183 Components Version: 1.0.236 Update Package Version: 1.0.3454 License: Free -System Information- OS: Windows 10 (Build 16299.98) CPU: x64 File System: NTFS User: DESKTOP-OQMC7JC\John Anrei Sy -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 353224 Threats Detected: 3 Threats Quarantined: 3 Time Elapsed: 4 min, 39 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 3 PUP.Optional.BuenoSearch, C:\USERS\JOHN ANREI SY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, [3095], [455061],1.0.3454 PUP.Optional.BuenoSearch, C:\USERS\JOHN ANREI SY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, [3095], [455061],1.0.3454 PUP.Optional.BuenoSearch, C:\USERS\JOHN ANREI SY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, [3095], [455061],1.0.3454 Physical Sector: 0 (No malicious items detected) (end) Thank you for your help.

Our website uses Sucuri's Web Application Firewall and Sucuri Website Monitoring with a clean bill of health, yet is on the blacklist. We had also experienced this with AVAST back in September. We have also updated Sucuri support about the issue. Please delist from the blacklist IP: 192,124,249,108 Host: hxxp://hamiltondiocese.com malwarebytes-report.txt

Good afternoon, I'm running Malwarebytes Premium version as anti-malware and Avast Internet Security (non-free) on my computer as anti-virus. Since last week, MWB is sending notification of blocked outgoing connection (without mentioning any program) to the same IP address once per day and everyday at the same time. The address is 91.214.44.139. I'm not surfing the internet or doing anything specific when it happens. When I search the internet it says the corresponding hostname is vpn-gw-rod-003.lux0-alt.ff.avast.com so it seems related to Avast. What bugs me is that I'm not using Avast VPN feature and MWB does not confirm the connection source program. Is it a false positive? Thanks

I clicked on a link to a news article on Yahoo and my Avast Anti-virus went off saying it aborted a connection with it because it was infected with the above trojan. I scanned with both Avast and Malwarebytes and nothing came up. I would go to the Avast forums but I trust you guys more. Am I infected and just not know it, or am I safe and this is a false positive? Can we run some tests? Here's the malwarebytes scan log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 9/26/17 Scan Time: 7:17 PM Log File: f57f60a1-a2a3-11e7-adf0-0090f5f744dc.json Administrator: Yes -Software Information- Version: 3.2.2.2018 Components Version: 1.0.188 Update Package Version: 1.0.2889 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Brandon-PC\Brandon -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 334046 Threats Detected: 0 (No malicious items detected) Threats Quarantined: 0 (No malicious items detected) Time Elapsed: 9 min, 59 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) (end)

Keep in mind exclusions are not supposed to be necessary but I recommend them. Better safe than sorry. For Malwarebytes.

Scan indicated Avast as MALWARE. Question: Is Avast competent & acceptable virus protection ? Thank U

For the past month, Avast has been blocking threats in Chrome, usually with the same log description as the screenshot I've attached. I did a scan with Malwarebytes and it couldn't find any threats so I decided to start a free trial to activate real-time protection. Now Malwarebytes constantly gives me notifications that it has blocked redirects/pop-ups from www.tradeadexchange.com and popcash.net. I reinstalled Firefox and immediately upon opening it, Malwarebytes blocked the redirect so I don't believe this a Chrome issue. I have tried disabling Adblock/Ublock from Chrome but it has not made a difference. Avast, AdwCleaner, Windows Defender, and Spybot have not found any real threats beyond browser cookies. I even purchased Hitman Pro but it too has not turned up anything concerning. I don't have any unknown programs or processes and according to Avast's logs, this issue began around August 4th, 2017. No significant changes were made to the system at this time and I did not install any unknown programs. Today's Malwarebytes log shows two new domains blocked: www.liveadexchanger.com and www.1-1ads.com. the 8/31 log shows a threat from preview.ibb.co. I also added the following to my hosts file but it hasn't made a difference: 127.0.0.1 www.tradeadexchange.com 127.0.0.1 popcash.net Any help in getting rid of this annoying issue would be welcome. I'm tired of seeing threat notifications. I am currently scanning with Sophos Virus Removal Tool and will post the log here when it's finished. Cheers AdwCleaner[S3].txt HitmanPro_20170901_1356.log malwarebytes8-30.txt malware9-1.txt malwarebytes8-31.txt

Hi everyone, My name is Ryan and I'm new to the community, and I'm coming to you all with some irritable reasons. I have had the most persistent malware infecting (I think only chrome - on Win 10) for the past 2 weeks with no avail. Currently I have used JRT, AdwCleaner, HitManPro, Malwarebytes and Avast. The last two never seem to detect anything, while the first three detect and delete, detect and delete, detect and delete... without permanently resolving my issue! I have removed all suspicious chrome extensions, reset my chrome several times, and even remain logged out of my chrome account with no avail - it keeps coming back essentially in the form of ad redirects. The most unusual element of this is whenever I click on any google docs urls it immediately turns into an ad redirect that malwarebytes blocks (even when not signed into chrome). I'm at a loss and not entirely sure what to do. I've attached some screenshots detailing some logs/readouts of what I've encountered so far in terms of problems. If there are any experts out here who can help me purge my chrome of this adware I would be overly appreciative (especially with regards to saving the money I'd have to spend on a computer guy). Best, Ryan P.S. HitManPro sometimes detects up to 25 tracers including the conduit, and I've managed to bring AdwCleaner to 3-4 each time. Funny thing is they usually detect nothing until I re-open chrome from my taskbar on Windows 10. The blocked site by malwarebytes is also the result of clicking a google docs link.