WingQuintuplet Posted August 16, 2021 ID:1475065 Share Posted August 16, 2021 There's this same adware that keeps getting detected and quarantined when I run scans on my computer, malwarebytes lists it as HKLM\SOFTWARE\SPROVIDE. If I run two scans back to back, only the first one will detect it, but if I restart my computer and scan one more time it gets detected again. I tried deleting the registry key from the registry editor, but it still comes back after a restart. Can someone help? Addition.txt FRST.txt log.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 16, 2021 ID:1475110 Share Posted August 16, 2021 Hello WingQuintuplet and welcome to Malwarebytes, Run FRST one more time: Type or copy/paste the following in the edit box after "Search:".SProvide Click Search Registry button and post the log (Search.txt) it makes to your reply. Thank you, Kevin. Link to post Share on other sites More sharing options...
WingQuintuplet Posted August 17, 2021 Author ID:1475219 Share Posted August 17, 2021 Here it is SearchReg.txt Link to post Share on other sites More sharing options...
Solution kevinf80 Posted August 17, 2021 Solution ID:1475221 Share Posted August 17, 2021 Hiya WingQuintuplet, Use the instructions in the following link to reset Chrome, see if that clears the issue... https://forums.malwarebytes.com/topic/258938-resetting-google-chrome-to-clear-unexpected-issues/ Thank you, Kevin... Link to post Share on other sites More sharing options...
WingQuintuplet Posted August 17, 2021 Author ID:1475223 Share Posted August 17, 2021 It's gone, stopped getting detected by scans and the registry key doesn't come back after restarts anymore. Thank you so much! Link to post Share on other sites More sharing options...
kevinf80 Posted August 17, 2021 ID:1475281 Share Posted August 17, 2021 Hiya WingQuintuplet, Thanks for the update, good to hear the issue has cleared. Continue: Thanks for the update, continue: Right click on FRST here: C:\Users\miron\Desktop\frsc\FRST.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Condsider the following: Disable Remote Desktop: https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html Disable Windows Telemetry: https://helpdeskgeek.com/windows-10/how-to-disable-windows-10-telemetry/ Malwarebytes Browser Guard (Free) for Firefox: https://addons.mozilla.org/en-GB/firefox/addon/malwarebytes/ Malwarebytes Browser Guard (Free) for Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Will also work for Opera and Edge.. PatchMyPC, keep all your software upto date - https://patchmypc.com/home-updater#download From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
kevinf80 Posted August 18, 2021 ID:1475592 Share Posted August 18, 2021 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts