I have some malicious activity going on. Please help!

[Daddy420]

Hey guys!

I just downloaded MB and am running a scan. It found over 400 threats and ive been getting alot of malware on my pc like chromium and those "AntiVirus" programs with false positives. Im really spooked and almost just said screw it and reinstall windows but i was patiant and am working it out. Now the scan is ALMOST complete but the heuristics analysis is having trouble finishing up it seems. Its been running the entire scane for about 2 hours now. What should i do and if the scan finishes completely is that all i should worry about? Can i go back to gaming? Any tips or tricks would be greatly appreciated. Go easy on me , im new here. 😁😁

Thanks again everyone!!!

[Maurice Naggar]

Hi,  @Daddy420   

My name is Maurice. I will be helping and guiding you, going forward on this case.

Do please have patience as we go along.  Do not give up.  No need for panic or anything of the sort.  Lets take things slow, careful.  One at a time.

We need to get information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.623.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

 

Edited August 2, 2019 by Maurice Naggar

[Daddy420]

Sorry it took so long to reply maurice!!!

mbst-grab-results.zip

[Daddy420]

Btw i turned windows defender back on. I forgot i turned it off before. Probably why i have a sick pc. :/

[Maurice Naggar]

Hi.  Thanks for the support tool report.  By the way, the report shows that McAfee Virusscan is installed and is the resident antivirus.

It appears that Malwarebytes for Windows was installed on July 31.  But I do not see any scan run logs.

Let's go ahead and do two procedures to scan the PC.

[ 1 ]

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan.

Version 7.4 of Adwcleaner  detects factory Preinstalled applications too!

I  encourage you to take a look at the announcement blogpost to learn more this new detection category: https://blog.malwarebytes.com/malwarebytes-news/2019/07/your-device,-your-choice:-adwcleaner-now-detects-preinstalled-software/.

 

Please download  Malwarebytes AdwCleaner  https://downloads.malwarebytes.com/file/adwcleaner
 

Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

 

Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.   Let it remove what it finds.

NOTE:  When it comes to the section "

Pre-installed applications

 

You can skip that.

Please find and send the Adwcleaner "C" clean report.

In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".

Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply, at your next opportunity.

 

Proceed forward and do step # 2

[ 2 ]

Let’s start by doing a new thorough scan with Malwarebytes for Windows.   The goal is to see whether there is an infection or P U P.

 

Let's do one new run with Malwarebytes for Windows.

Start Malwarebytes.

Click Settings. Click Protection tab & scroll down to Scan options.

On the section "Potential Threat Protection"
look down at the one "Potentially Unwanted Programs (PUPs)" look and make sure it is set to
"Always detect PUPS ".

and

look down at the one "Potential Unwanted Modifications (PUM)" look and make sure it is set to
"Always detect PUM ".

and
scroll all the way down to the section Automatic Quarantine
On the line "Automatically quarantine detected malware" be sure it is ON



Then once all set there, click on SCAN button
Then insure Threat scan has a check mark. Then click Start scan.
Review the results list.
Then I would suggest you make sure all lines have a check mark

To that end, if you click the very top left checkbox you can force all detected lines ( if any are detected)  to be selected for removal. Be sure each line is checked.

 

Then you can proceed to click on the blue button Quarantine selected.

In Malwarebytes.
Click the Reports button ( on the left )
Look for the "Scan Report" that has the most recent Date and time.

When located, click the check box for it and click on View Report.
Then click the Export button at the bottom left.
Then select Text File (*.txt)

Put in a name for that file and remember where the file is created.

Then attach that file with your next reply 

 

[Daddy420]

AdwCleaner[S00].txt

[Daddy420]

Its been 12 minutes and it says 7 items quarentined but hasnt moved in awhile. Its alittle under a 3rd of the way done. Should i just be patiant with it?

[Maurice Naggar]

yes please be patient.   Lets give it some 30 minutes more.  Be aware that the display may not be a true reflection.

 

The Adwcleaner did a good cleanup.  The main thing it found was PUP.Optional.Segurazo
PUP.Optional.Segurazo is Malwarebytes’ detection name for a system optimizer and fake antivirus called Segurazo Antivirus. The software is marketed by Digital Communications Inc. and targeted at Windows systems.
see https://blog.malwarebytes.com/detections/pup-optional-segurazo/

Did you in the recent past consent to install "Segurazo Realtime Protection Lite" ? ?

[Daddy420]

I didnt ever consent to any of that crap. UGH! Lol

 

[Daddy420]

Segurazo is the reason my computer is all bogged down and slow and has been giving me problems isn't it? Maybe it isn't a virus but just a bunch of shitty adware?

 

[Maurice Naggar]

Lets take our time when replying and not rush.  Multiple sequential replies can be confusing  and may tend to distract.

Segurazo is a definite program that no one needs.   Look on the Windows installed list of programs and see if Segurazo is still showing there  ! !

1. Type the Windows key+R to open the Run command.

2. Type 

Quote

appwiz.cpl 

and hit Enter.
The Programs and Features window will appear.

 

3. Locate  Segurazo    ( if found ) and click once to select it, then click the Uninstall button.   Let it do what it needs done.

 

We will do more after this.

 

[Daddy420]

Okay im sorry. But i finished the cleanup and i think im rid of Segurazo. Thank god!

AdwCleaner[C01].txt

[Maurice Naggar]

Thanks for that Adwcleaner run log.  Indeed, that is very good report.

Let's do one other scan just in case, for a fresh new opinion.   It should only take a few minutes.  Be sure to Close all web browsers before pressing "scan button".

Run a scan with Malwarebytes for Windows.
Start Malwarebytes from the Start menu.

Click Settings. Then click the Protection tab.
Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON
Click it to get it ON

Click the SCAN button.
Select a Threat Scan ( which should be the default).

When the scan phase is done , IF any items are tagged, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

When that is completed, kindly send the report.
In Malwarebytes.
Click the Reports button ( on the left )
Look for the "Scan Report" that has the most recent Date and time.

When located, click the check box for it and click on View Report.
Then click the Export button at the bottom left.
Then select Text File (*.txt)

Put in a name for that file and remember where the file is created.

Then attach that file with your reply. Thank you.

[Daddy420]

Sweet! whats next?

 

213.txt

[Maurice Naggar]

That is a fine result.  NO malware !!  no P U P either.   Your pc should be good to go.

If you wish, you may run this special scan at Microsoft.

You can check this system using another free tool at Microsoft.  For another opinion.

The Microsoft Safety Scanner is a free stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

take a minute to locate & then send the log that it made, named msert.log

It should be at C:\Windows\debug\msert.log

 

Let me know how all that goes.  I will have some closing tips, as well as encouraging you to have Malwarebytes for Windows Premium on your devices.

Premium would have caught the original issue.

[Daddy420]

It did not detect a thing. thank you very much for all of your help!!!

[Maurice Naggar]

Thanks for the good news.  You are welcome.

You may delete the files I had you download.  Adwcleaner you can certainly keep;  and use on a as needed basis.

 

Safer practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".
Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.


Check in at http://windowsupdate.microsoft.com 
Windows Update and install any Important Updates offered.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.

Sincerely.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks