sammycorp Posted February 28, 2019 ID:1301124 Share Posted February 28, 2019 Hi, I think my PC are infected with virus. Chorme, Firefox or other browser will crashed if I open a website that has content like "Virus removal", "Malware", "rest" and other content. Also Malwarebytes won't run but I able to update the version yesterday. It's running and I able to do a scan. Some malware and adware were identified and quarantined but after that Malwarebytes become Not Responding or crashed and I can't even "End Task" the process, I get "Access Denied" message. Below are FRST.txt and Additional.txt from FRST app. Please help. Thanks Addition.txt FRST.txt Link to post Share on other sites More sharing options...
sammycorp Posted February 28, 2019 Author ID:1301125 Share Posted February 28, 2019 Just now, sammycorp said: Hi, I think my PC are infected with virus. Chorme, Firefox or other browser will crashed if I open a website that has content like "Virus removal", "Malware", "rest" and other content. Also Malwarebytes won't run but I able to update the version yesterday. It's running and I able to do a scan. Some malware and adware were identified and quarantined but after that Malwarebytes become Not Responding or crashed and I can't even "End Task" the process, I get "Access Denied" message. Below are FRST.txt and Additional.txt from FRST app. Please help. Thanks Addition.txt FRST.txt This was the FRST.txt and Addition.txt in Safe Mode at least. Let me see if I can run the FRST in normal mode. Link to post Share on other sites More sharing options...
sammycorp Posted February 28, 2019 Author ID:1301127 Share Posted February 28, 2019 Can't run FRST in Normal mode. The process is suspended and can't even open Malwarebytes forum using chrome. It's crashed Link to post Share on other sites More sharing options...
nasdaq Posted February 28, 2019 ID:1301193 Share Posted February 28, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Remove this program in bold via the Control Panel > Programs > Programs and Features.KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - ) === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Reset Chrome... Open Google Chrome, click on menu icon or the 3 vertical dots located right side top of the google chrome. Click "Settings" then "Show advanced settings" at the bottom of the screen. Click "Reset and clean up" > "Restore settings to their original defaults" Restart Chrome. <<<>>> Please post the Fixlog.txt and let me know what problem persists. fixlist.txt Link to post Share on other sites More sharing options...
sammycorp Posted March 1, 2019 Author ID:1301296 Share Posted March 1, 2019 Kmspico clearly wasn't the problem. I am not sure what for but it's installed long before this pc get infected Link to post Share on other sites More sharing options...
nasdaq Posted March 1, 2019 ID:1301377 Share Posted March 1, 2019 Hi, The program is not to be trusted.. If you want to keep do it at your own risk. Do not remove it from the Add/Remove program. Delete these 2 lines from the Fixlist.txt file and save the file. Task: {C996041A-E99E-47AF-8199-DD768A3443C1} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe C:\Program Files\KMSpico Run the fix as suggested. Link to post Share on other sites More sharing options...
nasdaq Posted March 6, 2019 ID:1302369 Share Posted March 6, 2019 Are you still with us? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 11, 2019 Root Admin ID:1303267 Share Posted March 11, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts