moetee Posted September 30, 2018 ID:1272438 Share Posted September 30, 2018 I noticed, my ESET was gone (not appearing in my tool bar) Thread is here: https://forum.eset.com/topic/17024-is-this-a-new-glitch/?tab=comments#comment-84085 But, now I literally just noticed Malware is completely removed off my system???????? Why did this happened?? How can I be sure a malware or virus did this? or a common issue with MWB ? Link to post Share on other sites More sharing options...
moetee Posted September 30, 2018 Author ID:1272444 Share Posted September 30, 2018 Anyone? Link to post Share on other sites More sharing options...
nasdaq Posted September 30, 2018 ID:1272509 Share Posted September 30, 2018 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Download the version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions Link to post Share on other sites More sharing options...
moetee Posted September 30, 2018 Author ID:1272516 Share Posted September 30, 2018 Thank you. Please see attached. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 30, 2018 ID:1272546 Share Posted September 30, 2018 Hi, Please open the uninstallclean.bat with Notepad and make sure it's not deleting any of the MBAM or any other good folders. HKU\S-1-5-21-757775073-97403487-538562982-1001\...\RunOnce: [Hide My IP Uninstall] => C:\Users\Moe\AppData\Local\Temp\uninstallclean.bat [946 2018-09-16] () <==== ATTENTION Did you install this service? S2 MBAMIService; C:\ProgramData\MB3Install\MBAMIService.exe [170496 2018-09-19] (Malwarebytes) [File not signed] If not open the Task Manger and disable this service. === Reinstall Malwarebytes from this site:https://www.malwarebytes.com/ Scan the computer. After a restart let me know if the program is still around. Link to post Share on other sites More sharing options...
moetee Posted September 30, 2018 Author ID:1272556 Share Posted September 30, 2018 21 minutes ago, nasdaq said: Hi, Please open the uninstallclean.bat with Notepad and make sure it's not deleting any of the MBAM or any other good folders. Did you install this service? S2 MBAMIService; C:\ProgramData\MB3Install\MBAMIService.exe [170496 2018-09-19] (Malwarebytes) [File not signed] If not open the Task Manger and disable this service. === Reinstall Malwarebytes from this site:https://www.malwarebytes.com/ Scan the computer. After a restart let me know if the program is still around. Yes, I installed it but removed it. Where is the uninstallclean.bat file ? Link to post Share on other sites More sharing options...
nasdaq Posted October 1, 2018 ID:1272719 Share Posted October 1, 2018 Hi, Yes, I installed it but removed it. Where is the uninstallclean.bat file ? What is left is only an entry in the Registry. This fix will remove these regisgtry entries. HKU\S-1-5-21-757775073-97403487-538562982-1001\...\RunOnce: [Hide My IP Uninstall] => C:\Users\Moe\AppData\Local\Temp\uninstallclean.bat S2 MBAMIService; C:\ProgramData\MB3Install\MBAMIService.exe Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Is Malwarebytes installed and work correctly? fixlist.txt Link to post Share on other sites More sharing options...
moetee Posted October 8, 2018 Author ID:1274042 Share Posted October 8, 2018 On 10/1/2018 at 1:17 PM, nasdaq said: Hi, What is left is only an entry in the Registry. This fix will remove these regisgtry entries. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Is Malwarebytes installed and work correctly? fixlist.txt For some reason, before doing what you just mentioned above, I rebooted and malware appeared...why is that and why did it actaully disppear from the system? And scam was just done and no threats. Link to post Share on other sites More sharing options...
nasdaq Posted October 8, 2018 ID:1274135 Share Posted October 8, 2018 Hi, You quoted my last suggested fix. I need to see the Fixlog.txt created after the fix. === If not already done please reinstall Malwarebytes scan the computer and post the log for my review. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 7, 2018 Root Admin ID:1279756 Share Posted November 7, 2018 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts