Jump to content

Removing coin-miner macromedia.exe & shell.exe

Mess

By Mess
in Resolved Malware Removal Logs

 Share

Recommended Posts

MrCharlie

MrCharlie

Posted
Posted

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : Adobe Flash Updater ("C:\ProgramData\svsupdates0\rpeulaaql.exe") [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-515967899-1214440339-682003330-12126[...]\Run : Adobe Flash Updater ("C:\ProgramData\svsupdates0\rpeulaaql.exe") [-] -> FOUND

[sTARTUP][sUSP PATH] Skype.lnk @Dave : C:\Users\Dave\AppData\Roaming\WindowsLogonS\usft_ext.exe.vbs [-] -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)

[sUSP PATH] shell.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\shell.exe [-] -> BEEINDIGD [TermProc]

[sUSP PATH] macromedia.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\macromedia.exe [-] -> BEEINDIGD [TermProc]

[RESIDUE] macromedia.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\macromedia.exe [-] -> BEEINDIGD [TermProc]

[RESIDUE] shell.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\shell.exe [-] -> BEEINDIGD [TermProc]

[RESIDUE] macromedia.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\macromedia.exe [-] -> KILLED [TermProc]

[RESIDUE] shell.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\shell.exe [-] -> KILLED [TermProc]

Now click Delete on the right hand column under Options

-------------

Download a fresh copy of FRST and scan the system as before...post the log.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted
Run RogueKiller again and delete any of these if found as you did before:

¤¤¤ Bad processes : 2 ¤¤¤
[sUSP PATH] macromedia.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\macromedia.exe [-] -> BEEINDIGD [TermProc]
[sUSP PATH] shell.exe -- C:\Users\Dave\AppData\Roaming\WindowsLogonS\shell.exe [-] -> BEEINDIGD [TermProc]
 
¤¤¤ Registry Entries : 5 ¤¤¤
[RUN][sUSP PATH] HKCU\[...]\Run : Adobe Flash Updater ("C:\ProgramData\svsupdates0\rpeulaaql.exe" [-]) -> FOUND
[RUN][sUSP PATH] HKUS\S-1-5-21-515967899-1214440339-682003330-12126\[...]\Run : Adobe Flash Updater ("C:\ProgramData\svsupdates0\rpeulaaql.exe" [-]) -> FOUND
 
¤¤¤ Startup Entries : 1 ¤¤¤
[Dave][sUSP PATH] Skype.lnk : C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk @C:\Users\Dave\AppData\Roaming\WindowsLogonS\usft_ext.exe.vbs /Arguments:Shortcut [-][-] -> FOUND
 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Then.........
 
 
Download the attached fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
The tool will create a log  (Fixlog.txt) please post it to your reply.
 
MrC
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.