ihc Posted February 9, 2017 ID:1100566 Share Posted February 9, 2017 I've been having multiple issues with my newish Windows 10 PC and think I may be infected. Anything help would be appreciated. I've attached by diagnostic logs. Thanks Addition.txt FRST.txt mwb.txt Link to post Share on other sites More sharing options...
kevinf80 Posted February 10, 2017 ID:1100657 Share Posted February 10, 2017 Hello ihc and welcome to Malwarebytes, What exactly do you believe is wrong with your system, I do not see any obvious malware or infection in your logs....? Also run this indeth AV scanner: Go here and click 'SCAN NOW' under 'ESET Online Scanner' save to your Desktop. Turn off the real-time scanner of any existing antivirus program before performing the online scan. Here's how Right click on and select "Run as Administrator" In the new Window accept the terms of service In the new Window select "Enable detection of potentially unwanted applictions" then expand "Advanced Settings" In the new Window checkmark (tick) the entries as shown, make sure "Clean threats automatically" is not checkmarked. Now select "Scan" In the new Window new virus database signatures will download, Do Not Select Stop The Window will progress showing the scan in action.... In the new Window if no threats are found, select "Delete applications data on close" then select "Finish" no log is produced, confirm that in your reply... If threats are found the following Window will open: Click on "Select All" then "Save to Text file" name and save that file, attach to your reply. Now select "Do not clean" and then close out.... Thank you, Kevin Link to post Share on other sites More sharing options...
ihc Posted February 12, 2017 Author ID:1101347 Share Posted February 12, 2017 Hi. Thanks for your help. The ESET scan found no threats. I think I may have malware as Avast alerted me that it blocked malware (i've attached the screenshot of the alert) Link to post Share on other sites More sharing options...
kevinf80 Posted February 13, 2017 ID:1101349 Share Posted February 13, 2017 That address being flagged as malicious belongs to Microsoft. it leads to access to sign into your Microsoft account... The image you post does have a link to report a false positive... Any other issues or concerns....? Link to post Share on other sites More sharing options...
ihc Posted February 14, 2017 Author ID:1101631 Share Posted February 14, 2017 Thanks for your help. Should I be concerned that the popup occurred twice while the computer wasn't connected to the internet? Link to post Share on other sites More sharing options...
kevinf80 Posted February 14, 2017 ID:1101636 Share Posted February 14, 2017 That does sound odd for sure, in the image Avast is asking for a smart scan to be run, have you tried that...? I`ve not seen any obvious malware or infection in your logs up to now... I`d like you to run another couple of scans for another look. If Avast alerts to these scanners either accept the alert or turn Avast off to let them run.... Please download Zemana AntiMalware and save it to your Desktop. Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them.Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually. Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message. Next, Download and save RogueKiller to your Desktop from this link:https://www.fosshub.com/RogueKiller.html/setup.exe Right click setup.exe and select Run as Administrator to start installing RogueKiller. At the next window Checkmark "Install 32 and 64 bit versions, then select "Next" In the next window skip Licence I.D. and Licence Key, select "Next" In the next window make no changes and select "Next" In the next window leave both "Additional Shortcuts" checkmarked, then select "Next" In the next window make no changes and select "Install" RogueKiller will extract and complete installation, in the new window leave "Launch Roguekiller" checkmarked, then select finish. RogueKiller will launch. Accept UAC, then read and accept "User Agreements" In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan" When the scan completes select "Open Report" In the new Window select "Export text" name that file RK.txt, save to your Desktop and attach to your reply Let me see those logs in your reply.... Thank you, Kevin... Link to post Share on other sites More sharing options...
ihc Posted February 17, 2017 Author ID:1102611 Share Posted February 17, 2017 I ran Zemana and after scan finished I restarted my laptop manually. Something strange happened on reboot. I was logged into a Windows 10 temporary profile instead of my normal desktop... I shut down my computer and then rebooted it and it finally loaded my normal account/desktop. I've attached the Zemana log and will run Roguekiller now Zemana log.txt Link to post Share on other sites More sharing options...
kevinf80 Posted February 17, 2017 ID:1102617 Share Posted February 17, 2017 Zemana log is clean, nothing malicious was found... Post RK log when ready... Link to post Share on other sites More sharing options...
ihc Posted February 17, 2017 Author ID:1102618 Share Posted February 17, 2017 Here is RK log. Thanks for your help RK log.txt Link to post Share on other sites More sharing options...
kevinf80 Posted February 17, 2017 ID:1102620 Share Posted February 17, 2017 That log is also clean, do you still have concerns for your system...? Link to post Share on other sites More sharing options...
ihc Posted February 17, 2017 Author ID:1102621 Share Posted February 17, 2017 No, I'm guessing the Avast popup was a false positive and the Windows 10 issues are just bugs with the operating system... Thank you so much for your help! Link to post Share on other sites More sharing options...
kevinf80 Posted February 17, 2017 ID:1102623 Share Posted February 17, 2017 You`re very welcome, continue to clean up... Uninstall RogueKilller and Zemana http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down:"Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 18, 2017 Root Admin ID:1102735 Share Posted February 18, 2017 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts