Xvenz Posted March 14, 2019 ID:1303578 Share Posted March 14, 2019 This showed up and is using all my RAM, pls help me fix it, it doesent show up or delete on a malwarebytes scan please help me Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 14, 2019 Root Admin ID:1303603 Share Posted March 14, 2019 Hello @Xvenz and Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 14, 2019 Author ID:1303642 Share Posted March 14, 2019 proxycheck still in my task manager.. and used 50% of my Memory Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 14, 2019 Root Admin ID:1303734 Share Posted March 14, 2019 Don't worry, we'll get you fixed up soon. Due to one of the infection found on your system, it looks like it had a rootkit at one point in time. Let me have you run the following scanner. Please download the following scanner from Kaspersky and save it to your computer: TDSSkiller Then watch the following video on how to use the tool and make sure to temporarily disable your security applications before running TDSSkiller. PC Winvids - How to run Kaspersky TDSSKiller If any infection is found please make sure to choose SKIP and post back the log in case of a False Positive detection. Once the tool has completed scanning make sure to re-enable your other security applications. Thank you Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 17, 2019 Author ID:1304171 Share Posted March 17, 2019 this is the result TDSSKiller.3.1.0.26_17.03.2019_08.41.53_log.txt TDSSKiller.3.1.0.26_17.03.2019_08.49.23_log.txt TDSSKiller.3.1.0.26_17.03.2019_08.53.58_log.txt TDSSKiller.3.1.0.26_17.03.2019_08.44.37_log.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 17, 2019 Root Admin ID:1304176 Share Posted March 17, 2019 Is the proxycheck still in your list? If so please take a screenshot and show me. The main issue of the rootkit has been removed from our clean up already. TDSSKiller was unable to find any more parts of it. Thanks Link to post Share on other sites More sharing options...
Xvenz Posted March 17, 2019 Author ID:1304177 Share Posted March 17, 2019 Its Normal? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 17, 2019 Root Admin ID:1304196 Share Posted March 17, 2019 Please download Autoruns from Microsoft: https://download.sysinternals.com/files/Autoruns.zip Extract/Copy all files from archive to a new folder. Locate "Autoruns64.exe" in the new folder. Right-click and select "Run as administrator" Once it starts, please press the Esc key on your keyboard. Click on Options. Uncheck "Hide empty locations", Uncheck "Hide Windows Entries" Then click on Options, Scan Options and ensure "Verify code signatures" is checked Once that's done press the F5 key on your keyboard, this will start the scan again, Or click File, Refresh, this time let it finish. It will say "Ready" on the bottom left in the status bar once completed. When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns. Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder Attach the Autoruns.zip folder you just created to your next reply Thanks Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 18, 2019 Author ID:1304303 Share Posted March 18, 2019 this one. autoruns (2).zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 18, 2019 Root Admin ID:1304338 Share Posted March 18, 2019 Okay, I found it there, but let's have FRST give us that list too so that we can compare and act on those items. Please run FRST again and this time uncheck the items listed as shown in the image below. Match the check marks in the lower section too. Then click the SCAN button. It will take much longer to run and create a much larger file this time. Please upload that log on your next reply as an attachment. I'll check back on you sometime tomorrow. Thank you Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 18, 2019 Author ID:1304343 Share Posted March 18, 2019 Sorry to make you bussy...🙏👆👆 Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 18, 2019 Root Admin ID:1304431 Share Posted March 18, 2019 Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 19, 2019 Author ID:1304575 Share Posted March 19, 2019 this one Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 19, 2019 Root Admin ID:1304616 Share Posted March 19, 2019 Is the process gone now? Link to post Share on other sites More sharing options...
Xvenz Posted March 20, 2019 Author ID:1304662 Share Posted March 20, 2019 thanks a lot.. i think they are gone.. Link to post Share on other sites More sharing options...
Xvenz Posted March 20, 2019 Author ID:1304663 Share Posted March 20, 2019 and what must i do if the threat come again?? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 20, 2019 Root Admin ID:1304707 Share Posted March 20, 2019 I don't think they will come back but if they do, let us know. Help Secure your browsers Please install uBlock Origin for your browsers to better protect your system FireFox, Chrome, Opera , Safari, Microsoft EdgeAdBlock for Internet Explorer Follow-up Reading Everything you need to know about cybercrime 10 easy ways to prevent malware infection Keep your data backed up Thank you for choosing Malwarebytes Ron Link to post Share on other sites More sharing options...
Xvenz Posted March 21, 2019 Author ID:1304787 Share Posted March 21, 2019 thanks admin.... your advice very help my problem.... and what the different of ublock and adblock?? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 22, 2019 Root Admin ID:1304874 Share Posted March 22, 2019 uBlock doesn't Internet Explorer so there is Ad Block. However, if at all possible you should not be using Internet Explorer. I would highly recommend using Firefox or Chrome Link to post Share on other sites More sharing options...
Xvenz Posted March 22, 2019 Author ID:1304940 Share Posted March 22, 2019 yes i am.. thanks .. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 23, 2019 Root Admin ID:1305008 Share Posted March 23, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts