INEEDHEELP Posted October 30, 2018 ID:1278293 Share Posted October 30, 2018 So recently, my antivirus stated showing me this error regarding the fact that I'm trying to open a website, that I'm not actually opening. I checked the Internet and found out, it could be a malware. I have utilized various malware-removal softwares but none of them seem to work. The website that the malware/virus is trying to open is "cdn.systemupdates.site/updates.txt" Should I be worried about this or is it a false error. I've found no serious damage to my system, but this warning just seems popping up every half hour or something. I've tried various softwares, I've tried various scans and none of them have worked, pls I need help here. Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2018 ID:1278295 Share Posted October 30, 2018 Hello INEEDHEELP and welcome to Malwarebytes, Continue with the following: If you do not have Malwarebytes installed do the following: Download Malwarebytes version 3 from the following link:https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. If necessary select the Blue Help tab for video instructions.... When the install completes or Malwarebytes is already installed do the following: Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following: Click on the Report tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.htmlNote: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin.... Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 30, 2018 Author ID:1278301 Share Posted October 30, 2018 Thanks I'll try this, i already have malwarebytes btw Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2018 ID:1278304 Share Posted October 30, 2018 Thanks for the update, my response was generic reply so I copy/paste for quickness. I guess most people who come here already have Malwarebytes... Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 30, 2018 Author ID:1278306 Share Posted October 30, 2018 So I run the AdwCleaner and found 35 threats and here is the result: # ------------------------------- # Malwarebytes AdwCleaner 7.2.4.0 # ------------------------------- # Build: 09-25-2018 # Database: 2018-10-23.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 10-30-2018 # Duration: 00:00:04 # OS: Windows 8.1 Pro # Cleaned: 33 # Failed: 2 ***** [ Services ] ***** Deleted WCAssistantService ***** [ Folders ] ***** Deleted C:\Users\Admin\AppData\Roaming\DRPSu Deleted C:\ProgramData\Tencent Deleted C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent Deleted C:\Users\Admin\AppData\Roaming\Tencent Deleted C:\ProgramData\Speedbit Deleted C:\Program Files (x86)\Common Files\Speedbit Deleted C:\Users\Admin\AppData\Roaming\Speedbit Deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion ***** [ Files ] ***** Deleted C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\j5r08zg4.default-1537187983965\searchplugins\securesearch.xml ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** Deleted HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Reason\ReasonByteFence Deleted HKLM\System\CurrentControlSet\Services\EventLog\Application\ByteFenceService Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion Deleted HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-701553515-1864625768-3024844170-1001\Software\SpeedBit Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A} Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD} Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{1ED62E2E-89B2-4A02-9C6C-4FF2E49732E1} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{BF2A624C-1C4E-43EA-8C00-ED8E11782C59} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{DC9CFE99-DAFB-4474-A9A9-A9A66AAD03EB} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{AEC39A7F-7930-4389-8DE4-709F9DDA0BE2} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{D01EBCC5-7838-4DAC-82D4-B1D4DC2E6062} Deleted HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{41DCDC21-DDDF-4B33-8AE6-84AAE208951C} Deleted HKLM\Software\Classes\METNSD Deleted HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C0C3A6C6-03BC-4195-8FCB-AEA091301353} Deleted HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\AboutUrls|Tabs Deleted HKCU\Software\Lavasoft\Web Companion Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com Deleted HKU\S-1-5-18\Software\Microsoft\.NETFramework\SQM\Apps\WebCompanionInstaller.exe Deleted HKCU\Software\Microsoft\.NETFramework\SQM\Apps\WebCompanionInstaller.exe Deleted HKU\.DEFAULT\Software\Microsoft\.NETFramework\SQM\Apps\WebCompanionInstaller.exe ***** [ Chromium (and derivatives) ] ***** Not Deleted Search Manager ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** Not Deleted api.bing.com ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [4797 octets] - [30/10/2018 16:57:48] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ########## Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 30, 2018 Author ID:1278307 Share Posted October 30, 2018 Hey, so earlier on I hadn't run this as Administrator and I figured that might create some "problems" so I run it again and well, I found 4 more threats. What worries me is the fact that 2 of them failed to be deleted just like earlier on, this is the report: # ------------------------------- # Malwarebytes AdwCleaner 7.2.4.0 # ------------------------------- # Build: 09-25-2018 # Database: 2018-10-23.1 (Cloud) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 10-30-2018 # Duration: 00:00:02 # OS: Windows 8.1 Pro # Cleaned: 2 # Failed: 2 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** Deleted C:\ProgramData\Tencent Deleted C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** No malicious registry entries cleaned. ***** [ Chromium (and derivatives) ] ***** Not Deleted Search Manager ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** Not Deleted api.bing.com ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* AdwCleaner[S00].txt - [4797 octets] - [30/10/2018 16:57:48] AdwCleaner[C00].txt - [4341 octets] - [30/10/2018 16:58:28] AdwCleaner[S01].txt - [1519 octets] - [30/10/2018 17:05:48] ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ########## Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 30, 2018 Author ID:1278308 Share Posted October 30, 2018 I also performed the Farbar Recovery scans, but I'm not sure how they work The text was too long to paste, so I attached it And once again, Thank you, Kevin. I hope you have a great day FRST.txt Addition.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2018 ID:1278430 Share Posted October 30, 2018 Hiya INEEDHEELP, Thanks for those logs, continue... Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Please download Zemana AntiMalware and save it to your Desktop. Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them.Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually. Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system....https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs in your reply, also tell me if there are any remaining issues or concerns... Thank you, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 31, 2018 Author ID:1278593 Share Posted October 31, 2018 Hey I'll try this. I'll get back to you. Sorry for the late reply Link to post Share on other sites More sharing options...
INEEDHEELP Posted October 31, 2018 Author ID:1278597 Share Posted October 31, 2018 And hey, I've already run "Microsoft malware removal tool" to no avail. So yeah, I'm just performing the Zemana Anti-Malware Scan. Thank you, Kevin Link to post Share on other sites More sharing options...
kevinf80 Posted October 31, 2018 ID:1278699 Share Posted October 31, 2018 (edited) Post logs whenever you`re ready..... Edited October 31, 2018 by kevinf80 typing error Link to post Share on other sites More sharing options...
INEEDHEELP Posted November 1, 2018 Author ID:1278758 Share Posted November 1, 2018 Hey Kevin, once again sorry for the late reply. I ran the scan from Zenama but it detects some of my legitimate really-necessary software and some of my games as malware and I cannot possibly afford to uninstall it (the software). I didn't mention this earlier but this started when I installed this game I got from one of my mates. I got it removed by using a powerful uninstaller, but the Issue persists. I'm out of town for a couple of days, but still I'll be checking the post, so yeah you can get back to me any day you want. Once again thank you for your help. Link to post Share on other sites More sharing options...
kevinf80 Posted November 1, 2018 ID:1278772 Share Posted November 1, 2018 (edited) Did you also run the FRST fix given in reply #8, if so can I see that log. All logs are saved here: C:\FRST\Logs Edited November 1, 2018 by kevinf80 typing error Link to post Share on other sites More sharing options...
INEEDHEELP Posted November 4, 2018 Author ID:1279199 Share Posted November 4, 2018 Hey sorry for the late reply again. I was out of town, so yeah. I've attached FRST.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2018 ID:1279213 Share Posted November 4, 2018 No that is the result of a scan, I want to see the result of the fix given in reply #8. The log is named "fixlog.txt" Link to post Share on other sites More sharing options...
INEEDHEELP Posted November 4, 2018 Author ID:1279219 Share Posted November 4, 2018 Oh sorry, I have attached the filesFRST_30-10-2018 17.16.19.txtAddition_30-10-2018 17.16.19.txt Link to post Share on other sites More sharing options...
kevinf80 Posted November 4, 2018 ID:1279222 Share Posted November 4, 2018 Those are scan result logs from the original run of FRST... Quote Ran by Admin (administrator) on LAPTOP (30-10-2018 17:15:12) Link to post Share on other sites More sharing options...
INEEDHEELP Posted November 8, 2018 Author ID:1279939 Share Posted November 8, 2018 Hey i can't find the fixlog.txt can you tell me where it is Link to post Share on other sites More sharing options...
kevinf80 Posted November 8, 2018 ID:1279947 Share Posted November 8, 2018 Is attached to reply #10 Link to post Share on other sites More sharing options...
INEEDHEELP Posted November 9, 2018 Author ID:1280165 Share Posted November 9, 2018 Hey Kevin, can I call you Kev, anyways I couldn't find the fixlog.txt in the given location. AND I'M TERRIBLY SORRY FOR THE LATE REPLIES, I really appreciate the help and time you put in Link to post Share on other sites More sharing options...
kevinf80 Posted November 9, 2018 ID:1280189 Share Posted November 9, 2018 (edited) There are two replies from unauthorized posters, they may not show in the thread to you. If i`m correct then the file "fixlist.txt" will show in reply #8 to you and reply #10 to me... Yes Kev or Kevin, any one is good.. Edited November 9, 2018 by kevinf80 Link to post Share on other sites More sharing options...
kevinf80 Posted November 19, 2018 ID:1282037 Share Posted November 19, 2018 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts