HeroCrafter1987 Posted February 4, 2019 ID:1296554 Share Posted February 4, 2019 I have a virus on my windows 10 laptop. The virus is Windows Process Manager and is being used by rahkite.exe. rahkite.exe is in a protected folder called ushmrog. I can't delete or access the folder at all. I also have access to only one PC. Is there a way I can remove it? Link to post Share on other sites More sharing options...
nasdaq Posted February 4, 2019 ID:1296604 Share Posted February 4, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Download the version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. === You probably been infeted by a bad SmartService infection. You will need access to a spare PC and a USB flash drive that has not been in contact with the sick PC... Let me know if you have these access to these devices. I need to know first if you can enable the Recovery Environment. It will be needed to remove this infection. Open FRST on the compromised computer: copy/paste the following inside the text area of FRST. Once done, click on the Fix button. A file called fixlog.txt should appear on your desktop. Attach it in your next reply. Start:: CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes CMD: bcdedit.exe /set {default} recoveryenabled yes End:: http://i121.photobucket.com/albums/o239/kevinf80/Farbar%20Tools/frst%20b.jpg&key=98f8e4fa906452a8ed54423fd0407a3d120fe6064437244ca29c06ed5f968755] On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad Copy and paste its content in your next reply. Wait for further instructions Link to post Share on other sites More sharing options...
HeroCrafter1987 Posted February 4, 2019 Author ID:1296666 Share Posted February 4, 2019 I don't have access to a spare PC but I do have a non-infected flash drive. Here are the log files Addition.txt FRST.txt Link to post Share on other sites More sharing options...
HeroCrafter1987 Posted February 4, 2019 Author ID:1296667 Share Posted February 4, 2019 The Recovery Environment is enabled. Link to post Share on other sites More sharing options...
nasdaq Posted February 4, 2019 ID:1296679 Share Posted February 4, 2019 (edited) Hi, I don't have access to a spare PC but I do have a non-infected flash drive. You must have access to a spare PC to download a fresh Copy of the Farbar program. If you use you compromised computer the Farbar program will be also be compromised. Can you find a friend or relative and use their computer to download the program to the Flash Drive? === DO NOT EXECUTE THIS FIX if you DO NOT have the downloaded program from a fresh computer. Read all the instructions before proceeding. Take your time and all should be well. Preparing the USB Flash Drive Boot up your spare PC: Plug in the flash drive, navigate to that drive, right click on it direct and select format. Quick option is adequate. Next, On that same PC download the right version of Farbar program for your system to Desktop or the Flash drive. 64-bit or 32 bit version. Select the one you need.https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ If the files were saved on the Desktopl Move the executable (FRST.exe or FRST64.exe) to your USB Flash Drive Quote How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system.https://support.microsoft.com/en-us/help/827218/how-to-determine-whether-a-computer-is-running-a-32-bit-version-or-64 Do not plug the Flash Drive into the sick PC until booted to Recovery Environment. Boot the compromised PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 Select in this order"Troubleshoot" > "Advance Options" > "Command Prompt" Once in the command prompt Plug your USB Flash Drive in the infected computer In the command prompt, type notepad and press on Enter Notepad will open. Click on the File menu and select Open Click on Computer/This PC, find the letter for your USB Flash Drive, then close the window and Notepad In the command prompt, type e:\frst.exe (for the x64 version, type e:\frst64.exe and press on EnterNote: Replace the letter e with the drive letter of your USB Flash Drive FRST will open Click on Yes to accept the disclaimer Click on the Scan button and wait for the scan to complete A log called FRST.txt will be saved on your USB Flash Drive. Attach it in your next reply. p.s. If at any time you need additional information please ask before proceeding. Wait for further instructions. Edited February 4, 2019 by nasdaq Link to post Share on other sites More sharing options...
HeroCrafter1987 Posted February 4, 2019 Author ID:1296684 Share Posted February 4, 2019 Ok. I have nullifed the virus for now. It's still there but I have managed to make it cause errors within it's own system. It's trying to do something but when it gets to a certain point, the virus application shuts itself down and restarts its whole process from the beginning. Link to post Share on other sites More sharing options...
nasdaq Posted February 5, 2019 ID:1296865 Share Posted February 5, 2019 Hi, Unless you use my suggested fix you will not be able to remove it. Our experts worked many hours to find a solution to that infection. This is the only way we know how. Link to post Share on other sites More sharing options...
nasdaq Posted February 9, 2019 ID:1297649 Share Posted February 9, 2019 Do you still need help? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 27, 2019 Root Admin ID:1300919 Share Posted February 27, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts