Mithax Posted July 30, 2013 ID:708964 Share Posted July 30, 2013 Hello, This evening i saw a process of macromedia.exe taking up alot of my CPU suddenly so i ran my MBAM and removed several things upon restarting my pc i noticed that it now pops up a shell.exe and Macromedia.exe system error every 10 seconds. It says it cant boot them due to missing miner.dll. Ive tried rescanning and also the the rootkit amongst other stuff but still the errors wont disappear. I will add the 2 things required in the sticky and the log of the MBAM when it removed those files. IF you could help me that would be awesome!attach.txtdds.txtmbam-log-2013-07-30 (21-10-18).txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 30, 2013 ID:708966 Share Posted July 30, 2013 Welcome to the forum. Please download and run RogueKiller 32 Bit to your desktop. RogueKiller 64 Bit <---use this one for 64 bit systems Quit all running programs. For Windows XP, double-click to start. For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run. Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything! Don't run any other options, they're not all bad!!!!!!! Post back the report which should be located on your desktop. (please don't put logs in code or quotes) P2P/Piracy Warning: 1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided. 2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Failure to remove such software will result in your topic being closed and no further assistance being provided. MrC Note: Please read all of my instructions completely including these. Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive <+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you. <+>The removal of malware isn't instantaneous, please be patient. <+>When we are done, I'll give to instructions on how to cleanup all the tools and logs <+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. ------->Your topic will be closed if you haven't replied within 3 days!<-------- (If I don't respond within 24 hours, please send me a PM) Link to post Share on other sites More sharing options...
Mithax Posted July 30, 2013 Author ID:708967 Share Posted July 30, 2013 Thanks for the quick reply, here is the roguekiller logRKreport0_S_07302013_225420.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 30, 2013 ID:708971 Share Posted July 30, 2013 Did you read my warning about Piracy????? ¤¤¤ geplande taken : 1 ¤¤¤[V2][sUSP PATH] KMS Activation for Office : C:\Windows\KMSAct.exe [x] -> gevonden This is used for one reason, to by pass MS office activation.P2P/Piracy Warning:1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.Failure to remove such software will result in your topic being closed and no further assistance being provided.Unfortunately I can't continue to help. MrC Link to post Share on other sites More sharing options...
Mithax Posted July 30, 2013 Author ID:708973 Share Posted July 30, 2013 No problem, thank you for ur time. I dont use office much anymore but i understand. SOrry to have taken up your time Link to post Share on other sites More sharing options...
MrCharlie Posted July 30, 2013 ID:708976 Share Posted July 30, 2013 That's the rules, as soon as a moderator or administration sees the post, they'll close it. So sorry, no sense continuing but that's the way it is. MrC Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 31, 2013 Root Admin ID:709017 Share Posted July 31, 2013 This topic will now be closed due to evidence of cracked or pirated software on this system.Piracy Policy Link to post Share on other sites More sharing options...
Recommended Posts