napss Posted May 3, 2019 ID:1311048 Share Posted May 3, 2019 I had recently noticed a program in my task manager that I've never seen before, I also have gotten worse performance on my PC and my anti virus keeps picking up an outgoing request to a website, The virus is called Windows Process Manager (32 Bit) Link to post Share on other sites More sharing options...
nasdaq Posted May 4, 2019 ID:1311128 Share Posted May 4, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === This is probably a bad infection. If so we have a solution for your. Before we suggest it we need more information. Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions Link to post Share on other sites More sharing options...
napss Posted May 4, 2019 Author ID:1311168 Share Posted May 4, 2019 Addition.txt FRST.txt threatscan.txt Link to post Share on other sites More sharing options...
nasdaq Posted May 5, 2019 ID:1311246 Share Posted May 5, 2019 Hi, Yes I have identified a bad SmartService infection. You will need access to a spare PC and a USB flash drive that has not been in contact with the sick PC... Let me know if you have access to these devices. I need to know before suggested the fix if you can enable the Recovery Environment. It will be needed to remove this infection. Open FRST on the compromised computer: copy/paste the following inside the text area of FRST. Once done, click on the Fix button. A file called fixlog.txt should appear on your desktop. Attach it in your next reply. Start:: CMD: bcdedit.exe /set {bootmgr} displaybootmenu yes CMD: bcdedit.exe /set {default} recoveryenabled yes End:: http://i121.photobucket.com/albums/o239/kevinf80/Farbar%20Tools/frst%20b.jpg&key=98f8e4fa906452a8ed54423fd0407a3d120fe6064437244ca29c06ed5f968755] On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad Copy and paste its content in your next reply. Wait for further instructions. <<<>>> Link to post Share on other sites More sharing options...
nasdaq Posted May 10, 2019 ID:1312133 Share Posted May 10, 2019 Are you still with me? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 20, 2019 Root Admin ID:1313617 Share Posted May 20, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Staff tetonbob Posted June 1, 2019 Staff ID:1315252 Share Posted June 1, 2019 Topic has been reopened per request. Thanks Link to post Share on other sites More sharing options...
napss Posted June 2, 2019 Author ID:1315412 Share Posted June 2, 2019 thank you Link to post Share on other sites More sharing options...
napss Posted June 2, 2019 Author ID:1315414 Share Posted June 2, 2019 Fixlog.txt here is the FRST log, i copy and pasted the cmd code you sent me. Link to post Share on other sites More sharing options...
nasdaq Posted June 3, 2019 ID:1315472 Share Posted June 3, 2019 Any remaining issues? Link to post Share on other sites More sharing options...
napss Posted June 3, 2019 Author ID:1315591 Share Posted June 3, 2019 yes, the issues are exactly the same Link to post Share on other sites More sharing options...
napss Posted June 4, 2019 Author ID:1315611 Share Posted June 4, 2019 3 hours ago, napss said: yes, the issues are exactly the same i added the file u requested per last post Link to post Share on other sites More sharing options...
nasdaq Posted June 5, 2019 ID:1315836 Share Posted June 5, 2019 Hi, As I previously requested. You will need access to a spare PC and a USB flash drive that has not been in contact with the sick PC... Let me know if you have access to these devices. If you do NOT then proceed only when available. Read all the instructions before proceeding. Take your time and all should be well. Preparing the USB Flash Drive Boot up your spare PC: Plug in the flash drive, navigate to that drive, right click on it direct and select format. Quick option is adequate. Next, On that same PC download the right version of Farbar program for your system to Desktop or the Flash drive. Download the Farbar Recovery Scan Tool (FRST).Choose the 32 or 64 bit version for your system. If the file was saved on the Desktop Move the executable (FRST.exe or FRST64.exe) to your USB Flash Drive How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system.https://support.microsoft.com/en-us/help/827218/how-to-determine-whether-a-computer-is-running-a-32-bit-version-or-64 Do not plug the Flash Drive into the sick PC until booted to Recovery Environment. Boot the compromised PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 Select in this order"Troubleshoot" > "Advance Options" > "Command Prompt" Once in the command prompt Plug your USB Flash Drive in the infected computer In the command prompt, type notepad and press on Enter Notepad will open. Click on the File menu and select Open Click on Computer/This PC, find the letter for your USB Flash Drive, then close the window and Notepad In the command prompt, type e:\frst.exe (for the x64 version, type e:\frst64.exe and press on EnterNote: Replace the letter e with the drive letter of your USB Flash Drive FRST will open Click on Yes to accept the disclaimer Click on the Scan button and wait for the scan to complete A log called FRST.txt will be saved on your USB Flash Drive. Attach it in your next reply. p.s. If at any time you need additional information please ask before proceeding. Wait for further instructions. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 10, 2019 Root Admin ID:1316439 Share Posted June 10, 2019 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts