cannot get rid of roraccoon

[nasdaq]

Hi,

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

I found this in you logs. It looks OK but I think I was wrong.
If you know what it is DO NOT RUN THE fix as suggested.

(EpsilonCharon Ltd.) C:\ProgramData\EpsilonCharonMKL\EpsilonCharonMKL.exe

CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
R2 EpsilonCharonMKL; C:\ProgramData\EpsilonCharonMKL\EpsilonCharonMKL.exe [1350080 2018-09-07] (EpsilonCharon Ltd.)
C:\ProgramData\EpsilonCharonMKL

Let me know if the problem persists.

fixlist.txt

[ChesChapman]

Does not look like anything that I know. Downloaded your attached fixlist file and ran FRST and clicked fix once. Log file is attached.

Ran malwarebytes scan, found 2 occurences of roraccoon same place log file is attached

 

problem persists

Fixlog.txt

malwarescxan-9-28.txt

[nasdaq]

Hi,

I just look at your TdssKiller log and the compromised files were identified.

I taught you knew about it so I let it be.

Run the TDsskiller tool and fix these entries.

16:04:21.0286 5636  Suspicious service (NoAccess): EpsilonCharonMKL

16:04:21.0358 5636  EpsilonCharonMKL ( LockedService.Multi.Generic ) - warning
16:04:21.0358 5636  EpsilonCharonMKL - detected LockedService.Multi.Generic (1)

Restart the computer normally.

Run my last Farbar  fix one one time.

Let me know if the problem persists.

[ChesChapman]

Nasdaq - It appears that all of your efforts have finally removed the two Roraccoon Threats.

We have performed many functions and rebooted many times. The Malwarebytes scans

now show ZERO Threats -- constantly!

 

We appreciate your thorough approach. Thank You for your perseverance, tenacity and 

patience. The result was accomplished only with the benefit of your knowledge and expertise.

 

Thank you for sticking with us.......and correcting the problem.........ChesChapman

 

 

[nasdaq]

Glad we could help.

 

If not already done delete the folder in bold. Not sure if it was deleted by the RogueKiller Program.

C:\ProgramData\EpsilonCharonMKL

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks