Teodoro Posted April 22, 2017 ID:1119239 Share Posted April 22, 2017 Hey guys, So there is this virus/malware whatever you want to call it which bothers me every time I start my computer. Once windows 7 boots up . As soon as the files are created in the temp folder it also starts in processes and my cpu cores ( 2 of them ) are on 100% Once I kill the process and delete the tmp.exe file everything is back to normal Any solution for this problem? Please Help! Thanks. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted April 22, 2017 ID:1119247 Share Posted April 22, 2017 Hello Teodoro and welcome to Malwarebytes, My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please: Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good... Continue with the following: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download Malwarebytes version 3 from the following link:https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions.... When the install completes and is updated do the following: Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes deal with any found entries... Then select "Export Summary" then "Text File (*.txt)" name that log and save , you can copy or attach that to your reply... Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed... Next, Please download Junkware Removal Tool to your desktop. Shut down your protection software now to avoid potential conflicts. (re-enable when done) Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved to your desktop and will automatically open. Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en 64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs, also tell me if there are any remaining issues or concerns... Thank you, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Teodoro Posted April 22, 2017 Author ID:1119261 Share Posted April 22, 2017 (edited) Hello thank you for your reply and help here is all what you have asked . it still generating this *****.temp.exe on the windows temp folder :/ i hope we find a solution malwarebytres summary.txt AdwCleaner[S10].txt mrt.log JRT.txt Edited April 22, 2017 by Teodoro Link to post Share on other sites More sharing options...
kevinf80 Posted April 22, 2017 ID:1119263 Share Posted April 22, 2017 Can i also see the log (fixlog.txt) from the first step FRST fix... Also tell me if there are any remaining issues or concerns.....? Link to post Share on other sites More sharing options...
Teodoro Posted April 22, 2017 Author ID:1119264 Share Posted April 22, 2017 ops here it is ... the problem is still the same Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted April 22, 2017 ID:1119265 Share Posted April 22, 2017 Thank you, run the following and post the produced log... Download and save RogueKiller to your Desktop from this link:https://www.fosshub.com/RogueKiller.html/setup.exe Right click setup.exe and select Run as Administrator to start installing RogueKiller. At the next window Checkmark "Install 32 and 64 bit versions, then select "Next" In the next window skip Licence I.D. and Licence Key, select "Next" In the next window make no changes and select "Next" In the next window leave both "Additional Shortcuts" checkmarked, then select "Next" In the next window make no changes and select "Install" RogueKiller will extract and complete installation, in the new window leave "Launch Roguekiller" checkmarked, then select finish. RogueKiller will launch. Accept UAC, then read and accept "User Agreements" In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan" When the scan completes select "Open Report" In the new Window select "Export text" name that file RK.txt, save to your Desktop and attach to your reply Post that log.... Thank you, Kevin Link to post Share on other sites More sharing options...
Teodoro Posted April 22, 2017 Author ID:1119267 Share Posted April 22, 2017 i will as soon as this finish scanning thank you very much Link to post Share on other sites More sharing options...
Teodoro Posted April 22, 2017 Author ID:1119277 Share Posted April 22, 2017 1 hour ago, kevinf80 said: Thank you, run the following and post the produced log... Download and save RogueKiller to your Desktop from this link:https://www.fosshub.com/RogueKiller.html/setup.exe Right click setup.exe and select Run as Administrator to start installing RogueKiller. At the next window Checkmark "Install 32 and 64 bit versions, then select "Next" In the next window skip Licence I.D. and Licence Key, select "Next" In the next window make no changes and select "Next" In the next window leave both "Additional Shortcuts" checkmarked, then select "Next" In the next window make no changes and select "Install" RogueKiller will extract and complete installation, in the new window leave "Launch Roguekiller" checkmarked, then select finish. RogueKiller will launch. Accept UAC, then read and accept "User Agreements" In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan" When the scan completes select "Open Report" In the new Window select "Export text" name that file RK.txt, save to your Desktop and attach to your reply Post that log.... Thank you, Kevin 1 hour ago, Teodoro said: i will as soon as this finish scanning thank you very much i cant open the websites i used to open after roguekiller scann not even this website ! i am now from my laptop Link to post Share on other sites More sharing options...
Teodoro Posted April 22, 2017 Author ID:1119280 Share Posted April 22, 2017 i found a way to fix it and here is the txt file .... but i am wondering why after using the rogue program i couldn't open any webste no matter what not even google or facebook RogueKiller txt.txt Link to post Share on other sites More sharing options...
kevinf80 Posted April 23, 2017 ID:1119322 Share Posted April 23, 2017 RogueKiller scan was purely diagnostic, none of the listed entries were changed or removed during the scan.... Can you UNinstall or Remove any cracked or illegal software running on your system, when that is complete run RogueKiller again as you did previously and post the fresh log... Please be aware of Malwarebytes Piracy Guidelines Quote Malwarebytes does not condone nor support piracy in any shape or form. Any discussion topics that ask for help with pirating software, circumventing copy protection, or any other illegal activities related to copy righted content in any form will be closed and locked. If you feel this is ever done in error, please report the post or PM an Administrator. As a reminder, using pirated software or utilities that allows one to pirate software (e.g. cracks, key generators, registration/license removal, redirection, or workaround utilities, etc.) is not a safe practice and can lead to malware infection, ransomware attack, or even legal action. Because of these risks, we always recommend that you remove any pirated software or pirating utilities before asking for support on our forums in order to improve our ability to best support you and to help protect yourself and your data from malware or other piracy related consequences. Thank you, Kevin... Link to post Share on other sites More sharing options...
Teodoro Posted April 23, 2017 Author ID:1119368 Share Posted April 23, 2017 i must say after i run rogue my i don't have the generated trojan on my system any more Link to post Share on other sites More sharing options...
kevinf80 Posted April 23, 2017 ID:1119383 Share Posted April 23, 2017 I find that very odd, the RK scan did not remove anything...? Link to post Share on other sites More sharing options...
Teodoro Posted April 24, 2017 Author ID:1119581 Share Posted April 24, 2017 i don't know but when i finish the scan rogue program found about 15 threats so i remove them with the program and after all was ok thank you very much for your help Link to post Share on other sites More sharing options...
kevinf80 Posted April 24, 2017 ID:1119584 Share Posted April 24, 2017 (edited) Are you saying your system is now clean, you have no remaining issues or concerns......? If that is correct continue with the following to clean up... Uninstall Uninstall RogueKiller http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down:"Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Edited April 24, 2017 by kevinf80 Link to post Share on other sites More sharing options...
Teodoro Posted April 26, 2017 Author ID:1120024 Share Posted April 26, 2017 is clean now yes i wouldn't like to remove the tools as i wanna keep them for future ... thank you very much i highly appriciate your help Kevin ... you have been very helpful indeed !!! Link to post Share on other sites More sharing options...
kevinf80 Posted April 26, 2017 ID:1120078 Share Posted April 26, 2017 Thank you for the update, good to hear your system is responding as expected... Regards, Kevin Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 27, 2017 Root Admin ID:1120256 Share Posted April 27, 2017 Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts