My Pc compromised

[Sarfraz]

my pc have a virus which hijacking my chrome crypto wallets (Metamask) but i have already installed Malwarebytes and i tried to scan my pc many time and still that person/hacker getting my info. please help me to resolve this issue. 

[Maurice Naggar]

Hello @Sarfraz     

In order to begin to help you properly, I will need a diagnostic report in order to review & diagnose.
Specifically the FRST Farbar diagnostic report.  It is safe to get & use.
https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Attach FRST.txt + Addition.txt with your reply.  You may if you wish, ZIP the 2 into a zip file & then attach.
{ just please do not copy, paste their contents in main body of reply box here.)
 

[Sarfraz]

here is my scan files .. please let me know if u need more info

Addition.txt FRST.txt

[Maurice Naggar]

I do not see malware on the FRST reports. If later on there is a issue with Chrome, then please use the EDGE browser.

What follows is like some housekeeping & then a housekeeping custom script.

[   1    ]

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[    2    ]

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

[   3    ]

Next, a custom script to do some checks & some attempted cleanups.

We will use FRST64.exe  on the Downloads\Programs folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Sarfraz  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .    It will rebuild the Winsock.  

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   user Downloads\Programs  folder

Fixlist.txt

 

Then, Start the Windows Explorer and then, go  to the Downloads\Programs  folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[Sarfraz]

here is log file

Fixlog.txt

[Maurice Naggar]

Hello.  Thank you for the log report.  At this time, lets be sure to double check on some updates. Starting with checking on Google Chrome browser.

Follow the suggestions for Chrome updating   https://www.google.com/chrome/update/

NEXT

I would recommend getting a readout report as to update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

 

• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[Sarfraz]

i have updated chrome and done security check

SecurityCheck.txt

[Maurice Naggar]

Thank you. Please take some time to follow-up, take appropriate action on the following

--------------------------- [ OtherUtilities ] ----------------------------
TeamViewer v.15.19.3   Warning! Download Update

------------------------------ [ ArchAndFM ] ------------------------------
WinRAR 6.01 (64-bit) v.6.01.0   Warning! Download Update

-------------------------------- [ Media ] --------------------------------
HandBrake 1.4.1 v.1.4.1   Warning! Download Update
K-Lite Codec Pack 16.1.2 Full v.16.1.2   Warning! Download Update

 

Edited January 7, 2022 by AdvancedSetup
Corrected font issue

[Maurice Naggar]

Good morning. I hope you are doing well. Are you needing any other help?

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks