Koneko Posted March 21, 2018 Author ID:1226154 Share Posted March 21, 2018 Technically nothing...I can try to quaritine the ones listed by running the same check with that function on. The 2 at the top are just other antivrius programs. The two at bottom I have no idea if they are needed or just the same. The other normal emsisoft scan just started running caught both of them and listed them as "rootkit.smartservice (a)". Does windows 10 really protect against rootkits like they say? Because I know 7 doesn't. Link to post Share on other sites More sharing options...
kevinf80 Posted March 21, 2018 ID:1226156 Share Posted March 21, 2018 Those two drivers you have identified get no hits on Google so are more than likely malicious.. C:\Windows\System32\drivers\csbxmpwz.sys C:\Windows\System32\drivers\msdvrxto.sys Does the scanner you`ve used not delete or quarantine found entries..? Link to post Share on other sites More sharing options...
Koneko Posted March 21, 2018 Author ID:1226157 Share Posted March 21, 2018 the emsisoft that is running detected the bottom 2 as "smartservice(A)" and while trying to get back to you here...the following came up. So I think the router got hacked too, which could be the root of my problems. Link to post Share on other sites More sharing options...
kevinf80 Posted March 21, 2018 ID:1226159 Share Posted March 21, 2018 I`ve mentioned before that there is only one way to defeat smartservice infection, I gave you those instructions very early in your last thread. Those instructions are tried and tested and do work on Windows 7, Windows 8, Windows 8.1 and Windows 10. Link to post Share on other sites More sharing options...
Koneko Posted March 22, 2018 Author ID:1226454 Share Posted March 22, 2018 actually its made no difference. the router actually got hacked.....took over 4 hours for them to even reset it...although I doubt they did a reformat of the router. So while that was being done I just did a factory reset. just using an old single core XP with nothing important on it right now till I'm sure the router is more secure. The picture below is what alerted me to something in the router....because at the time that computer was being factory reset and not connected. So did that message mean the router was waiting for that system to come back on? AT&T says the router wasn't comprimized, yet it looks it was. The message actual targets the gaming computer...not the one I'm typing here. So when I was looking for info on this computer last night...that window popped up with that message. I got off and called AT&T and was off line for 4-5 hours. so i'm reading up on that alert right now as i've never seen it before. Link to post Share on other sites More sharing options...
kevinf80 Posted March 23, 2018 ID:1226508 Share Posted March 23, 2018 Thanks for the update, what is the status of main PC after the factory reset. I assume your router is now ok...? Link to post Share on other sites More sharing options...
Koneko Posted March 23, 2018 Author ID:1226515 Share Posted March 23, 2018 I thought I would wait till later to do the windows update again...didn't even get through it all. Got found again and blaster virus on router shut out any checks for it. The XP here is ok, yet it looks like I'm being specifically targeted and searched out. I know 2wire has exploits but AT&Ts tech support doesn't know anything. When a tech support supervisor says you only need to run windows defender with its firewall....I know they don't know anything. I honestly thought I did better this time. I installed powershell 5.1 first instead of keeping the old 2.0 it was installed with, put on .net 4.7 on over what it had, then did HP updates, and AMD cpu/gpu updates/drivers.....then the rest of windows....never got finished with windows. I'm outa ideas right now....and really frustrated. Link to post Share on other sites More sharing options...
Koneko Posted March 23, 2018 Author ID:1226521 Share Posted March 23, 2018 I did mange to change to a new IP out of 196 listing, and then change the name after. I was even trying out the new version of opera, over IE, or firefox...to stay off the main ones people use too. Link to post Share on other sites More sharing options...
kevinf80 Posted March 23, 2018 ID:1226530 Share Posted March 23, 2018 Until you are clear of this ever returning problem is worthwhile doing another reset on your router, when that is complete turn off wireless broadcasting. When that is complete only connect your PC to the router with an ethernet cable. When the router is set and working go for another factory reset on your gaming PC, when that is completed make good all the required Windows updates... Regarding security, my set up follows: Windows own Firewall - http://www.thewindowsclub.com/how-to-configure-windows-7-firewall Windows Defender - https://www.howtogeek.com/220232/how-to-use-the-built-in-windows-defender-antivirus-on-windows-10/ Malwarebytes Premium - https://www.malwarebytes.com/premium/ Works very well with Defender.. Obviously the paid for version is required for realtime protection. UnChecky - https://unchecky.com/ helps to stop unwanted extras when installing certain free software.. McShield - http://www.mcshield.net/ Protectes your system when USB devices are plugged in... All the above are free except for Malwarebytes Premium..... Link to post Share on other sites More sharing options...
Koneko Posted March 25, 2018 Author ID:1226897 Share Posted March 25, 2018 thanks changing the ip address, and name and that seems to have helped. Did a factory re-install and things are looking good now. Shut down the wireless too and using only cables. A friend at work said that his gaming computer seemed to be targeted too, but not his kids or wifes. We concluded its because each of us has dual graphics cards which probably makes us higher valued targets for mining too. thanks for the unchecky and mcshield. Gonna keep the gaming system offline for a while too...help it disappear. Link to post Share on other sites More sharing options...
kevinf80 Posted March 25, 2018 ID:1226947 Share Posted March 25, 2018 Hello Koneko, Good to hear you`ve finally got the better of the ongoing nemisis. The wireless disconnection and cable connection will stop anyone in close proximity hacking into your router, modern routers do broadcast very strong signals that can be picked up from a hundred meters or so. Also cable connection gives better speeds, wireless can make big reductions.. Take care and surf safe, Kevin Link to post Share on other sites More sharing options...
kevinf80 Posted March 31, 2018 ID:1228755 Share Posted March 31, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts