Jump to content

I need help..


Recommended Posts

So, today I got some kind of infection on my pc (windows 10) for the very first time in my life.

I don't know what kind of "virus" it was but I can list down what it did:

-Blocked my internet connection (which I solved for now)

-Disabled windows defender and other Anti-malwares (regedit)

-It somehow messed with my administrator rights and it is disabling me from deleting certain programs

The real problem:

-Windows defender didn't find anything (expected)

-Malwarebytes found over 200 infections

-Malwarebytes removed them

-I rebooted pc

-Problems are back and I cannot uninstall/reinstall/open malwarebytes (Unable to connect to service + No admin rights, wtf im the only user)

I feel helpless :/

Link to post
Share on other sites

Hello CariaN and welcome to Malwarebytes,

My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please:

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Change the download folder setting in the Default Browser only. so all of the tools we may use are saved to the Desktop:

user posted imageGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. user posted image
Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

user posted imageMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. user posted image Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

user posted imageInternet Explorer - Click the Tools menu in the upper right-corner of the browser. user posted image Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

user posted imageChange default download folder location in Edge -Boot to a user account with admin status, select start > file explorer > right click on "Downloads" folder and select "Properties"

In the new window select "Location" tab > clear the text field box and type in or copy/paste %userprofile%\Desktop > select "Apply" then "OK"

Be aware you are not changing the Browser download folder location, you are changing the user’s download directory location.....

Next,

Follow the instructions in the following link to show hidden files:

http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs...

Thank you,

Kevin..
Link to post
Share on other sites

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes, select > "settings" > "protection tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes deal with any found entries... Then select "Export Summary" then "Text File (*.txt)" name that log and save , you can copy or attach that to your reply...


Next,

Download AdwCleaner by Xplode onto your Desktop.

Or from this Mirror

  • Double click on Adwcleaner.exe to run the tool
  • Click on the Scan in the Actions box
  • Please wait fot the scan to finish..
  • When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
  • Click on the Cleaning box.
  • Next click OK on the "Closing Programs" pop up box.
  • Click OK on the Information box & again OK to allow the necessary reboot
  • After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts. (re-enable when done)
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Next,

Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...

  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
  • If no threats were found please confirm that result....


The Virus Removal Tool scans the following areas of your computer:

  • Memory, including system memory on 32-bit (x86) versions of Windows
  • The Windows registry
  • All local hard drives, fixed and removable
  • Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

Let me see those logs, also tell me if there are any remaining issues or concerns...

Thank you,

Kevin...

 

 

fixlist.txt

Link to post
Share on other sites

Hello again CariaN,

The choice is really down to you, before you make a decision i`d like you to try something for me.... i want you to check to see if any untrusted certificates have been created by the infection we`ve moved with FRST.

See if you can do the following, read through a couple of times, or print off the instructions..
 
  • Select Windows key and R key together,,
  • In the Run dialog box type MMC, and then click OK.
  • The Microsoft Management Console (MMC) appears.
  • In the MMC, on the Console menu, click File then Add/Remove Snap-in....
  • In the Add or Remove Snap-in dialog box, click Certificates, and then click Add.
  • In the Certificates snap-in dialog box, click My User Account, and then click Finish.
  • click OK on Add or Remove Snap ins.
  • Expand the Certificates Current User node by double click
  • Expand UnTrusted Certification by double click
  • Double Click Certificates Trust List.
  • The details pane appears, showing all of the root CA certificates that are currently untrusted.



Is there an untrusted Certificate for Malwarebytes or any other Security Programs...?

Thank you,

Kevin

Link to post
Share on other sites

Well I think we found the right thing! Take a look at this picture (Don't mind the language)

 

Also I suspected that something like this would be going on as I couldn't run MWB as admin.

 

Can I remove them just by clicking delete or will they reappear.

 

Also do I then continue from the part where I had to open MWB?

 

Thanks once more for your time!

wellfuck.PNG

Link to post
Share on other sites

The account you are using does it have admin status, i`ve done couple other threads and all work ok with the instructions I listed, same for you.... Maybe we`ve missed something...

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

 

Link to post
Share on other sites

Yes infection back on main system... Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please download Zemana AntiMalware and save it to your Desktop.
 
  • Install the program and once the installation is complete it will start automatically.
  • Without changing any options, press Scan to begin.
  • After the short scan is finished, if threats are detected press Next to remove them.
    Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.
     
  • Open Zemana AntiMalware again.
  • Click on user posted image icon and double click the latest report.
  • Now click File > Save As and choose your Desktop before pressing Save.
  • Attach saved report in your next message.

Post those logs, also try Certificate removal again...

 

Thank you,

Kevin

 

fixlist.txt

Link to post
Share on other sites

Here is the FRST-fixlog. The fix didn't help at all = Still can't access MWB or defender as they are blocked!

But zemana actually opened and managed to do the scan without any interruptions or shutdowns.

Here's the log, it has Finnish in it but basically one file got fixed and 8 put to quarantine. Everything went well.

Fixlog.txt

2017.05.08-22.58.58-i0-t92-d9.txt

Link to post
Share on other sites

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

fixlist.txt

Link to post
Share on other sites

Okay I think we finally got it solved!

I reinstalled MWB and when I did so it warned me of errors with the drivers located at C:\Windows\System32\Drivers

However I skipped the warning message and the installation finished and MWB worked normally.

I did the scan and it found nothing, but still the same error with MWB and Windows Defender being turned off kept appearing.

I continued the instructions in reply #4 and did the adware and junkware scans. I think atleast something was found.

Then I did the sophos scan which took a while but it found something. I don't think that what it found was malware as I have had the file for a long time.

 

How can I now be sure that all the infections are gone and there are no settings being left so that I'm vulnerable for new problems.

 

Thanks! -Paavo

 

(Scans included)

 

 

Also one more thing. The infection disabled my control center from the bottom right corner of my desktop how do I get it back :)

MB-scan.txt

AdwCleaner[C0].txt

JRT.txt

SophosVirusRemovalTool.log

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.