Artsymom Posted February 25, 2019 ID:1300488 Share Posted February 25, 2019 I am having trouble removing this issue from my daughter's computer. I am attaching the logs mentioned in the instruction post. Thank you in advance for any help you can give me. FRST.txt Addition.txt malwarebytes report.txt Link to post Share on other sites More sharing options...
nasdaq Posted February 26, 2019 ID:1300811 Share Posted February 26, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === I have identified a bad SmartService infection. You will need access to a spare PC and a USB flash drive that has not been in contact with the sick PC... Let me know if you have access to these devices. I need to know before suggested the fix if you can enable the Recovery Environment. It will be needed to remove this infection. Open FRST on the compromised computer: copy/paste the following inside the text area of FRST. Once done, click on the Fix button. A file called fixlog.txt should appear on your desktop. Attach it in your next reply. Start:: CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes CMD: bcdedit.exe /set {default} recoveryenabled yes End:: http://i121.photobucket.com/albums/o239/kevinf80/Farbar%20Tools/frst%20b.jpg&key=98f8e4fa906452a8ed54423fd0407a3d120fe6064437244ca29c06ed5f968755] On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad Copy and paste its content in your next reply. Wait for further instructions. <<<>>> Link to post Share on other sites More sharing options...
Artsymom Posted February 26, 2019 Author ID:1300828 Share Posted February 26, 2019 Thank you for responding! Yes, I have access to a spare computer and USB flash drive that have not been in contact with the infected computer. Here is the text: Fix result of Farbar Recovery Scan Tool (x64) Version: 25.02.2019 01 Ran by kfant (26-02-2019 13:59:42) Run:1 Running from C:\Users\kfant\OneDrive\Desktop Loaded Profiles: kfant (Available Profiles: kfant & Administrator) Boot Mode: Normal ============================================== fixlist content: ***************** CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes CMD: bcdedit.exe /set {default} recoveryenabled yes ***************** ========= bcdedit.exe /set {bootmgr} displaybootmenu yes ========= The operation completed successfully. ========= End of CMD: ========= ========= bcdedit.exe /set {default} recoveryenabled yes ========= The operation completed successfully. ========= End of CMD: ========= ==== End of Fixlog 13:59:43 ==== Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted February 27, 2019 ID:1300997 Share Posted February 27, 2019 Hi, Lets proceed: Read all the instructions before proceeding. Take your time and all should be well. Preparing the USB Flash Drive Boot up your spare PC: Plug in the flash drive, navigate to that drive, right click on it direct and select format. Quick option is adequate. Next, On that same PC download the right version of Farbar program for your system to Desktop or the Flash drive. 64-bit or 32 bit version. Select the one you need.https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ If the files were saved on the Desktopl Move the executable (FRST.exe or FRST64.exe) to your USB Flash Drive Quote How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system.https://support.microsoft.com/en-us/help/827218/how-to-determine-whether-a-computer-is-running-a-32-bit-version-or-64 Do not plug the Flash Drive into the sick PC until booted to Recovery Environment. Boot the compromised PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 Select in this order"Troubleshoot" > "Advance Options" > "Command Prompt" Once in the command prompt Plug your USB Flash Drive in the infected computer In the command prompt, type notepad and press on Enter Notepad will open. Click on the File menu and select Open Click on Computer/This PC, find the letter for your USB Flash Drive, then close the window and Notepad In the command prompt, type e:\frst.exe (for the x64 version, type e:\frst64.exe and press on EnterNote: Replace the letter e with the drive letter of your USB Flash Drive FRST will open Click on Yes to accept the disclaimer Click on the Scan button and wait for the scan to complete A log called FRST.txt will be saved on your USB Flash Drive. Attach it in your next reply. p.s. If at any time you need additional information please ask before proceeding. Wait for further instructions. Link to post Share on other sites More sharing options...
Artsymom Posted February 27, 2019 Author ID:1301006 Share Posted February 27, 2019 Do I remove the flash drive and post the FRST.txt log from the safe computer or leave the flash drive in the computer, reboot to normal environment, and post it from the infected computer? I just want to make sure I follow everything correctly! Link to post Share on other sites More sharing options...
Artsymom Posted February 27, 2019 Author ID:1301045 Share Posted February 27, 2019 Also, does this mean that flash drives that have come in contact with the infected computer are no longer safe to use? I used a flash drive to install the original copy of the Farber program rather than connecting that computer to the internet to download it directly. I just want to know if I should throw it away. Link to post Share on other sites More sharing options...
nasdaq Posted February 28, 2019 ID:1301151 Share Posted February 28, 2019 If you did the fix in the Recovery environment the flash drive will not be compromised. The fix will create a Fixlog.txt that will not be compromised. Reboot normally and post the Fixlog.txt from the Fla;sh driver to this topic. Let me know how the computer working in normal mode. Link to post Share on other sites More sharing options...
Artsymom Posted February 28, 2019 Author ID:1301210 Share Posted February 28, 2019 I followed the instructions and ran the FRST scan in recovery environment. I am attaching the FRST log. FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted February 28, 2019 ID:1301240 Share Posted February 28, 2019 Hi, Looking better. Some other work needs to be done. Please run the Farbar program in normal mode and post Fresh FRST.TXT and Addition.txt logs for my review. Let me know what problem persists. p.s. You can run Malwarebytes and delete all the items found before running the Farbar program. Link to post Share on other sites More sharing options...
Artsymom Posted February 28, 2019 Author ID:1301259 Share Posted February 28, 2019 I ran Malwarebytes and it was able to quarantine all but 2 of the items (I deleted all in quarantine). I am attaching that log too. I am a little confused because your instructions told me to run a scan in the recovery environment, not a fix. Here are the FRST and addition logs produced from the scan in normal mode. malwarebytes 2-28.txt FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 6, 2019 ID:1302368 Share Posted March 6, 2019 Sorry for this long delay. Do you still need help? Link to post Share on other sites More sharing options...
Artsymom Posted March 7, 2019 Author ID:1302586 Share Posted March 7, 2019 Yes, I could still use some help with the continuing problem. Thanks! Link to post Share on other sites More sharing options...
nasdaq Posted March 7, 2019 ID:1302591 Share Posted March 7, 2019 Hi, You may have been infected by a new version of the SmartService A new version of the Farbar program is now available and should remove it. Delete the Farbar version now on your Flash Drive. Using a clean computer download to the Flash Drive the new version. Then Start Recovery Environment on the compromised computer. Only when ou are in the Recovery Environment can the mount the Flash drive. Follow the instructions listed in Post no. 4. Read the instructions again and follow them carefully. Post the FRST.TXT log that will be created. Link to post Share on other sites More sharing options...
Artsymom Posted March 11, 2019 Author ID:1303244 Share Posted March 11, 2019 I followed the instructions in post no. 4 carefully after downloading the new copy of Farber onto the flash drive (from an uncompromised computer). I am attaching the FRST.TXT log that was created after I ran the scan in the recovery environment. FRST.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 12, 2019 ID:1303382 Share Posted March 12, 2019 Hi, Good work, lets clean the rest. Remove these programs in bold via the Control Panel > Programs > Programs and Features.NativeDesktopMediaService (HKLM-x32\...\{FC44DE72-60F9-4BC1-B098-D2F6B5A06187}) (Version: 3.5.0 - Jetmedia) <==== ATTENTIONWinVPN (HKLM\...\{EF9BEECA-275E-46B8-AF4F-FD5F398722E6}) (Version: 1.0.1 - WinSoft) Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Scan the compute with Malwarebytes and delete all items that will be reported. === Please post the Fixlog.txt and let me know what problem persists. fixlist.txt Link to post Share on other sites More sharing options...
Artsymom Posted March 12, 2019 Author ID:1303406 Share Posted March 12, 2019 Ok, I uninstalled the two items you listed in your previous post, ran FRST fix with the fixlist, then ran Malwarebytes again. I am attaching the fixlog and the Malwarebytes log. There was one item from the Malwarebytes scan that was not able to be quarantined or deleted. 3-12-19 malwarebytes.txt Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 12, 2019 ID:1303431 Share Posted March 12, 2019 Hi, Is the folder in bold still in your computer? C:\USERS\KFANT\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\ Is there any files in the folder? === It may be a Syncing issues with Edge an other devices you may be using. Check it out. https://www.tenforums.com/tutorials/36286-turn-off-sync-favorites-reading-list-microsoft-edge.html === Link to post Share on other sites More sharing options...
Artsymom Posted March 12, 2019 Author ID:1303435 Share Posted March 12, 2019 Yes, I did find the folder you listed on the computer. It says that it has 1,961 files, 854 folders in it. I followed the instructions on the page you linked to turn off syncing. Syncing was on even though there weren’t any devices configured to sync with the computer. Link to post Share on other sites More sharing options...
Artsymom Posted March 12, 2019 Author ID:1303437 Share Posted March 12, 2019 I ran another Malwarebytes scan after I turned off syncing. It was only able to quarantine 2 out of the 3 threats it found. I am attaching the log. 3-12-19 (2) malwarebytes.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 13, 2019 ID:1303516 Share Posted March 13, 2019 Hi, Let me check what is in that folder. Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please post the Fixlog.txt and let me know what problem persists. fixlist.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 19, 2019 ID:1304558 Share Posted March 19, 2019 Are you still with me? Link to post Share on other sites More sharing options...
Artsymom Posted March 19, 2019 Author ID:1304559 Share Posted March 19, 2019 Yes, sorry, it has been crazy here. I will get to the last instructions this evening or tomorrow morning! Thanks for checking. Link to post Share on other sites More sharing options...
Artsymom Posted March 22, 2019 Author ID:1304914 Share Posted March 22, 2019 Here is the fixlog from the last Farbar fix. Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 22, 2019 ID:1304921 Share Posted March 22, 2019 Hi, There is nothing suspicious in the C:\USERS\KFANT\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences\ folder. To remove it Remove Chrome from your Computer and reinstall a fresh copy later. If you remove the syncing of your account you must remove it before you save your bookmarks etc... Delete Your Google Chrome Browser Sync Data if you sync with other devices. <- Important ...https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ Before you remove Chrome Export your Bookmarks Chrome will export your bookmarks as a HTML file, which you can then import into another browser. How To: http://ccm.net/faq/31791-how-to-backup-your-google-chrome-bookmarks Before you remove Chrome Export your Passwords How to export your saved passwords from Chromehttps://betanews.com/2018/03/09/export-chrome-passwords/ Clear your Chrome cache and cookieshttps://support.google.com/chromebook/answer/183083?hl=en Remove Chrome using the the instructions on this page.https://support.google.com/chrome/answer/95319?hl=en Re-install Chrome and the Bookmarks. <<<>>> Keep me posted. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 2, 2019 Root Admin ID:1306272 Share Posted April 2, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts