condorito18 Posted September 26, 2015 ID:992361 Share Posted September 26, 2015 Hi, I've run MBAM and it detects a hijack32 registry entry and nothing else. It then reports that it has successfully removed it, but when I run MBAM again, it returns. I also tried running RogueKiller and it detected a rogue process ("Proc.Injected") and killed it, in addition to many suspicious registry entries. I didn't 'fix' anything through RogueKiller so as to not damage my system. I've also run AdwCleaner. Attached are FRST.txt and Addition.txt. I've also attached a file with a couple of screenshots of the roguekiller screens in case that's useful. Thank you very much in advance. Condorito Addition.txtFRST.txtroguekillerdump.docx Link to post Share on other sites More sharing options...
condorito18 Posted September 26, 2015 Author ID:992370 Share Posted September 26, 2015 Hi, Here are more details. Also, the MBAM log is attached. The exact threat name is "Hijack.SHELL32". Also, every few minutes I get a notification from MBAM that access from my laptop to IP address 88.214.241.xxx has been blocked. Thanks! CondoritoMBAM_Log_9_26_15.txt Link to post Share on other sites More sharing options...
kevinf80 Posted September 26, 2015 ID:992373 Share Posted September 26, 2015 Hello and welcome,P2P/Piracy Warning:If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, 1.Download Malwarebytes Anti-Rootkit from this link: http://www.malwarebytes.org/products/mbar/2. Unzip the File to a convenient location. (Recommend the Desktop)3. Open the folder where the contents were unzipped to run mbar.exe4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)6. The following image opens, select Next.7. The following image opens, select Update8. When the update completes select Next.9. In the following window ensure "Targets" are ticked. Then select "Scan"10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed.11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.12. If no threats were found you will see the following image, Select Exit:13. Verify that your system is now running normally, making sure that the following items are functional: Internet access Windows Update Windows Firewall14. If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder.15. Select "Y" from your Keyboard, tap Enter.16. The fix will be applied, select any key to Exit.17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder:System - logMbar - log Date and time of scan will also be shownThanks,Kevin... Link to post Share on other sites More sharing options...
Naathim Posted October 5, 2015 ID:993779 Share Posted October 5, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts