Search the Community

Hello there So I have this cr*p on 2 laptop whom I installed andyos on both but I'm not sure this is the origin of g*.tmp.exe. Found threads here regarding this but after installing mbam it doesn't run. Help would greatly appreciated. Guy Addition.txt FRST.txt

Hey everyone! Question about ultra viewer. I'm ashamed to admit that one of those scammers got me to download it. I caught on after a little while. He was prenteding to be from PayPal shortly after I had opened a dispute. Ended up trying to get me to put a Google play card. He was pretty angry with me when I made it clear I caught on, do they usually stop once you say you know it's a scam? He did not receive any passwords or money. Just my email and name. I immediately changed every password and added extra security measures and also logged out of previous sessions. I also obviously uninstalled ultraviewer. How can I be sure it is gone? I scanned the computer using Malwarebytes and it came back clean. Does Malwarebytes get rid of it? Any help is greatly appreciated !

need help removing this cause for some reason it disappears and it dident appear for a good yea then its back on my task mananger and and even my malwarebytes is not picking it up for some reason is there anyway to get this removed without having to lose personal files and programs

I infected with Riskware.Bitcoin_miner they successfull detected and quarantine with Malwarbytes but keep come back after my PC startup, detect and success quarantine but keep appears again. And plus on some Key such F7/F3 aor TAB key keep auto press that I don't know What program or malware is working on. That special keys press when using terminal console or using Microsoft Word 2013. Please help me to resolve this.Regars Here is my addtion.txt and FRST.txt Addition.txt FRST.txt

To whom it may concern, Please do another review on the following site: https://www.cosmictone.com.au/

Malwarebytes Premium keeps detecting "PUP.Optional.365Stream". I let it quarantine and delete each instance, but they come back very quickly (hours). They return before the machine is rebooted. How do I locate the re-installer and remove it?

Hello, so I got a brand new pc and for some reason my malwarebytes found a 2 files that were under the category of "PUP" and it said Trojan.downloader.BDB. My pc is also super slow and freezes a lot and IT IS NEW! I have no idea what to do... Im so afraid theres still some trojan left in here ...

Hello, Im new to this forum and I would be extremely grateful if anyone here could give me some advice on how to remove encrypted syswow64, (possibly zero access rootkit), from several usbs that I got that have been infected when they where inserted in windows computers that I got that were attacked by hackers. The hackers installed a system administration server on my network and attacked my computers with some kind of synzcronization worm/virus that synced and even infected offline devices, (that contained Bluetooth and smartcard etc), like Television, digital TV box, dvd, printer and phones. Programs that I detected on my computers that they were using were among others, syswow64, bluetoothshare, various installation hooks, svchost, microsoft synchronization feeds, keyloggers, infrared, remote Control programs, malicious code and code changer programs etc. When I scan the usbs with regular virus Scans like Kaspersky or Norton they all comes out Clean and no names shows up during the scan but when I scan the usbs with microsoft forefront scanner it also comes out as Clean but during the scan all the rootkit names show up though. The names that comes up includes for example syswow64, catroot, system root: nearby devices, hkmmodule installation hook, netframework installation hook, microsoft feeds synchronization, subsystem spooler system, mobilesynch.exe, tablet/pcsynch.exe, rundll.32.exe and many more. I have run the scan on all photos separately that is stored on the usbs and the same rootkit names shows up during the scan on every single photo and also, when I did a test and removed all files from one usb, so that it was empty, all the names still showed up when I scanned it and I could also see that the rootkit, (although I cant see it as it is encrypted), took up 0,8 gb of space on the usb since there was only 7,2 gb left for me to use although the size of the usb is 8 gb so if the usb were really empty there should be 8 gb space left for me to use, not 7.2 gb. What I would like to know is if anyone here knows if theese types of encrypted rootkits is possible to remove at all fro usbs so that I can get my photos, and if so how? Is there any antivirus website where I can upload the photos that can Clean the rootkit completely out of the usb and photos or should I go visit some computer specialist store instead, or is it enough if I just burn the photos over to a dvd and then the rootkit will dissapear byitself, or is there nothing that can be done at all? Anyone that knows the answer to theese questions please feel free to send me messages either in this thread or you can send me private messages to my profile here on this forum aswell if you like. All answers are extremely appreciated

Hello. Could really use some help ASAP. Thank you guys for the support. All attachments are included. FRST.txt Addition.txt Threat Scan Log.txt

I had problems that had prevented me from installing or using any anti-virus software. I had to run a special build of Malwarebytes anti-rootkit from here to solve that problem and install Malware Bytes. Here's the forum where I posted my problems and was helped. I was redirected to this post and was able to do the threat scan; however, whenever I click on the link for the Farbar Recovery Scan tool, my browser closes. I am using Microsoft Edge as I had to uninstall both Google Chrome and Mozilla Firefox when they faced numerous problems and refused to open. I was strongly recommended to post here despite having Malware Bytes running on my computer. Here are the logs: quarantine log.txt threat log.txt system-log.txt mbar-log-2018-04-09 (12-49-04).txt mbar-log-2018-04-09 (17-18-19).txt

Please remove hxxps://penascoresorts.com from your block list. Thanks! log.txt

I've had this thing, (malware is my best guess) since june last year and all attempts to remove it from my system have failed. Even people i know working in fields that require moderate knowledge of malware/virus protection etc guided me throught different removal methods. Which sadly wasnt enough either. So after 3 lifetimes worth of removal guides,scans, support agents and programs u name it, It seemd when Malwarebytes was mentioned in all manners, it was always the top choice / unrivaled when it comes to malware removal. so took me this long to figure out asking for professional help her just might do it. Hope someone can help me out! Kind regards Kristian FRST.txt Addition.txt malwarebytes log.txt

Hello there, One of my machines using running on Windows Vista SP2 has a semi-serious problems, even i cannot name it. This is the final chance for me to figure out whether i'm safe or not. Here is the issue. I came across a malware a few years ago which is infected my machine through a non-secure JAVA web applet. After this infection, i immediately took some actions and tried neutralizing malware and cleaning as well, i also used Malwarebytes 1.x and 2.x series. After some years have passed, i still noticed that the nasty and non-existent registry entry of this malware is still visible by regedit, and GMER. I had no abnormal activity since then, and tried numerous rootkit removers listed below with following results: - GMER: Shows hidden driver service highlighted red but unable to remove / disable because it's not existed in fact (IMHO). - Sophos Anti-Rootkit: No malware is found, system is clean. - BitDefender Anti-Rootkit: No malware is found, system is clean (scan took very short though, not sure why). - Kaspersky TDSS Remover: No malware is found, system is clean. - Rootkit Hook Analyzer: No malware is found, system is clean. - Symantec TDSS Fix Tool: No malware is found, system is clean. -...and finally Malwarebytes Anti-Rootkit BETA along with Malwarebytes Premium (3.3.1) edition: System is clean, no malware is found. Although almost all of major removers say that the system is clean, i'm so picky that i have no idea why regedit and GMER display the presence of malware (PragmaXXXXX - random numbers), especially regedit shows error immediately when i click on this key as if it does NOT exist, but i can't do anything even i try a lot of methods including running regedit under SYSTEM account, running offline registry editor using recovery disc, and using command prompt. It seems a kind of very strange glitch in registry file, and it cannot be removed there eventhough the entry (PramaXXXXX) is shown. I'm attaching all the screenshots that would help on describing the issue, along with FRST log, addition.txt log and MBAM Anti-Rootkit log file. I'd be so grateful if there is any additional steps to take other than formatting the whole drive, as i have a lot of documents and installations with senstive configurations. Thanks in advance! Addition.txt FRST.txt system-log.txt

Today, Saturday, Jan 27, 2018, when I want to use my computer to look up over the web, my computer froze. I realized later it was MBAM that use up memory, kill the computer and my video card. Reboot helps, but MBAM immediately eats up all the available memory again. I have 32 GB installed running on a i7 chip. Luckily, I have a smartphone allows me to search and Google immediately shows me that people discovered the issue more than 16 hours ago. MBAM pinned a message in the forum I can't wait for them to fix to use my computer again. So I uninstall MBAM. BAM!! Of course it fixed the problem, my computer feels fresh again - running much faster than with MBAM. I am extremely surprised that my i7 chip with 32 GB is not enough to run MBAM. MBAM made EVERYTHING slow on my system, accessing the file system via File Explorer, running Firefox, Edge, Chrome, Opera all slows down extremely over time. The search made me realized that this "has" been an issue with MBAM in the past. I have been using MBAM premium for years but didn't realize that MBAM is the problem. I am glad MBAM kills itself to alert me to uninstall it and brings back my system performance I missed in the past. At least I am relief that the issue is caused by a single software rather than other issues I thought I was experienced but no solution was able to fix it until today.

Good Day, Back in early December ran Windows Defender and discovered that my Desktop three terabyte HD was infected with Tilken.B!cl virus. My Window 7 Ultimate operating system had been severely compromised so I replaced my HD with a new Sold State Drive. I remained committed to cleaning the old hard disk so I purchased a USB 3.1 PCI express and a docking station. This allowed me to do a full scan on the 3TB HD with the Window Malicious Software Removal Tool (MSRT) in about 36 hours. Attached are the images that show that at near the end of the scan 84 files had been identified as infected. This morning I expected to see a report on those infected files. I would also show you an image of the screen capture of the MSRT that stated No Malicious Software Was Detected. I also review the MRT.log file and not infections were identified. Could it be that Tilken.B!cl has a way of preventing its removal using MSRT? I noticed that there is a command line command for automatic removal which I will try next. I thought you might like to know about this issue. I am also running Malwarebytes 3.0 but so far it has not identified Tilken.B!cl as present. Also relative to MSRT, Malwarebytes is scanning slowly. After 43 hours only 2million files have been scanned. Any suggestions would be appreciated.

Hi there so i've recently noticed that my pc performance isn't at it's peak recently, I've done a few scans and i've came across that my computer is infected by a few trojans and i've spent the last couple of days trying to remove them, however they keep returning after I restart my computer. here are two of my scan reports. If it's not too much of ask, i'd appreciate any help that you can give

I'm not sure if this is a false positive or not, I did a threat scan and am asking for Malwarebytes staff to help me. It says I have a Trojan.Injector in my Razor Chroma Drivers in System32. I've quarantined the files, but haven't removed them. Please help. I've attached a copy of the report. Thanks! report.txt

I recently tried installing your root kit remover tool but I'm almost certain the root kit on my computer is denying me to run your tool. The root kit name is Smart Service prior to me checking with another service. Thank you and goodbye.

Hi, Can anyone help please? I have a proxy hijacker that keeps turning my proxy settings on. There are 7 files identified by malwarebytes, which I quarantined then deleted. I've also run Adwcleaner as instructed in previous topics on this. Would it help if I just left the files in quarantine on malwarebytes instead of deleting them? I've noticed on other forums that people have run a program called farbar recovery scan, then people have created a fix for them. Is anyone willing to do this for me? Am getting desperate, my laptop is unusable currently. Thanks! UPDATE: Adwcleaner claims there are no malicious files

Recently after each daily scan Malwarebytes has been reporting a particular PUP that it's asking if I want to quarantine. I always do want to, so I click on quarantine. However, I'd rather that Malwarebytes just quarantine all PUPs on its own without asking. In my settings under protection I have automatic quarantine turned on. Shouldn't it be doing this automatically? If not, is there something I'm missing? It never used to do this, but it's possible that one of the websites I visit is causing the PUP.

Hi Guys Please accept my thanks in advance for any assistance you can possibly offer me. I have noticed that I get random 'g****.tmp.exe' files loading into my windows / temp directory. These same files reappear after a manual delete and want to autorun too. Appreciate your time.

How do I remove kms-r@1n hook?

Hello. I have the same problem, can you help me? Thank you Hola, tengo el mismo problema, ¿podría ayudarme? Gracias.

This thread is for Aura, in regards to removing msidntfs.sys virus. FRST.txt Addition.txt malwarebytes.txt

So there is a scheduled task that runs every 3 hours on an old server 2003 machine. This used to be covered by MB3 and still is installed however the newest version of mb3.2 says server is no longer supported. I am a member of techbench and the toolset command line will run fine. However no matter which utility I do get to successfully run nothing is detecting anything. Ive tried MBAR, detect nothing, TDSSKiller detects nothing. When all tasks are deleted somehow another pops up that loads a batch that makes a ton of system changes and reschedules itself back in the scheduler. Have you guys seen, LSMOSEE.EXE before?