InstallShield Virus keeps on coming back

[LDTate]

Get some sleep.

Tomorrow will be fine

[MatthewCostanilla]

I have installed malwarebytes into my C drive now

[LDTate]

Can you try running a scan with Malwarebytes (MBAM) now?

[MatthewCostanilla]

Do you want me to just do a threat scan?

[LDTate]

Yes.

Need to see if it will work now from the C drive.

[MatthewCostanilla]

Okay I just scanned and the scan worked, but it still has uncovered no threats. I am also running in safe mode again because I cannot run it in normal mode as I said. I really dont know why it cannot identify it as a threat even though malwarebytes blocks the pop ups from opening and proceeds to tell me what program opened the pop up:( I am starting to lose hope...

[LDTate]

Is this the block you're seeing?

C:\\Windows\\SysWOW64\\InstallShield\\x32\\setup.exe",
               "url" : "pool.monero.hashvault.pro"

 

Open Malwarebytes > History > Application Logs
Double Click the **Protection log** to open it
On the lower left select **Export** > Export to Text

Save as mbamscan and Save it to your desktop
Attach the mbamscan text file in your next reply.

[MatthewCostanilla]

There were a few domains so I exported them too. 

pool.monero.hashvault.pro.txt

pool.minexmr.com.txt

pool.supportxmr.com.txt

[LDTate]

I'm having those checked for a possible False Positive and will let you know.

[MatthewCostanilla]

Okay thank you

Also I have deleted the installshield folder while I am in Safe Mode and they dont seem to have come back yet, but I feel like it will most likely come back when I boot back into normal mode. But also thank you for the help so far. Even though I still have a virus, i'm glad you're spending a ton of your time helping me 

[LDTate]

That's what we're here for.

I'll let you know of the finds on those.

[LDTate]

While we're waiting, can you run a new FRST scan and attach the logs?

[LDTate]

If it gets late for you, don't lose any sleep over this. Tomorrow is another day.

[MatthewCostanilla]

Okay here are some new files

Addition.txt

FRST.txt

[LDTate]

I have attached A file I need you to download and save it to the same place that you saved the FRST program

This fix will include removing temp files and emptying the Recycle Bin.

Download attached **fixlist.txt** and save it to same location where the FRST tool is located.

NOTE: Both FRST.exe and the fixlist.txt must be in the same location or the fix will not work.
Close all browsers before running.

Double click FRST to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
 •Click the **Fix Button**.
 
•If you receive a message that a reboot is required, please make sure you allow it to restart normally.

•The tool will complete its run after restart.

When finished, the tool will make a log (Fixlog.txt) in the same location from where it was run. Please attach the Fixlog.txt in your reply.

Restart the pc and let me know how it's running now.

fixlist.txt

[MatthewCostanilla]

I think you may have done it.... The setup.exe is no longer running in Task Manager and the installshield folder isnt there anymore... I am so so so so grateful... I cant put into words how much you have saved me....

One final thing though. Is Malwarebytes supposed to use a lot of CPU? My CPU percentage seems to be higher since I installed it. Also is it okay to delete FRST etc now?

 

 

[LDTate]

Not so fast.

Can you attach the fixlog.txt fill that was created with the last fix you ran?

As for MBAM, it will use a lot of CPU when it's scanning and / or updating.

[MatthewCostanilla]

Okay, here it is

Fixlog.txt

[LDTate]

GREAT JOB

Yes you can now delete all the FRST items.

I'm happy to have helped and glad this is resolved. As there are no other issues which need addressing we can now close this ticket.
 

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, and Safari 
Opera
Microsoft Edge

AdBlock for Internet Explorer

Follow-up Reading

Cryptolocker Ransomware: What You Need To Know
Scams: Tech Support Scams 
PC Safety: Seven tips to keep your PC safe

 

Thank you for choosing Malwarebytes
Peace Be With You

[LDTate]

One last thing.

Make sure MBAM will run in normal mode

[MatthewCostanilla]

How is it that I do that?

[LDTate]

Malwarebytes?

Just open the program and select Scan Now.

[MatthewCostanilla]

Alright. Thank you so much again! Have a great rest of your day

[LDTate]

You're more than welcome.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks