Many files detected don't know what to do

[darklion2603]

So made a scan and don't know what to do next. It detected many Trojan.Agent and other simillar files as well as many PUP.Optional.OnlineIO files and simillar to them. Can someone please help me to get rid of all of this?

[darklion2603]

Will it be enough to just click the delete button with all of this quarantined files checked or would I need to do something else?

[Porthos]

15 minutes ago, darklion2603 said:

Will it be enough to just click the delete button with all of this quarantined files checked or would I need to do something else?

Do not delete the quarantine yet.

Please do the following so that we may take a closer look at your system for any possible infections.

Do these 2 steps FIRST so that files and folders are set to SHOW, plus also, Turn OFF Windows Fast Start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
  Then be patient for the next expert to take your case.

Thank you

[darklion2603]

Before I send the file, if it's not a problem, can you explain me what does this file conatin? I want to know what I will be sending

[AdvancedSetup]

The files are in text format. You can look at them with Notepad

They contain all the logs and information of what software is running on the computer and various other details so that we can try to locate the issue.

Without detailed logs we have no way to know what is wrong with your system

 

[darklion2603]

Here is the file   

Edited January 20 by darklion2603
Files

[AdvancedSetup]

Yes, it has a Trojan infection. I'm heading to lunch but I'll write you a fix script to run when I get back from lunch.

In the mean time please don't go surfing the web or do any type of financial, medical transactions.

 

[darklion2603]

Can I know how much time it will take you to get back from lunch?

[AdvancedSetup]

Please follow the steps below

[ 1 ]

Please go to Control Panel, Programs, Programs and Features, Uninstall a program

Then right-click and uninstall the following

• Java 8 Update 261 (64-bit) (considered old and possibly compromised version of Java)
• Java SE Development Kit 8 Update 261 (64-bit) (considered old and possibly compromised version of Java)

 

[ 2 ]

Your current DNS Servers:   192.168.0.1   

Please consider changing your default DNS server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

Pick just one of these 4 providers. And be aware that you need to modify 1 time for IPv4 & a 2nd pass for IPv6

• Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
• Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
• OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
• DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

[ 3 ]

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\modcom_3\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[darklion2603]

Is there a one best option from DNS providers?

[AdvancedSetup]

No, not really. Google and Cloudflare are the big ones in the game

[darklion2603]

And can you explain why do I need to do this?

[David H. Lipman]

Because

Quote

Your current DNS Servers:   192.168.0.1   

Which is your Router.  That means a DNS Request goes from your PC to the Router and that's a hop and it then acts as a DNS Proxy and this slows the process down and the DNS proxy action can cause some problems. 
By hard coding fast DNS Servers directly into the PC's IP Stack you will get quicker and more reliable DNS Query Responses.

Edited January 10 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[darklion2603]

And how can I check what do this directories contain, I mean Windows Temp, Users Temp,.... I want to check if i won't be losing anything valuable

[darklion2603]

And can I also know what does the fixlist.txt contains before I download it?

[AdvancedSetup]

It's all in text. You can look at it in notepad

 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

[darklion2603]

can I be sure it won't cause any damage to my computer, im worried a little about this part

Quote

• Running this on another machine may cause damage to your operating system that cannot be undone.

Will something bad happen if i don't disable those kind of programs 

Quote

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it

 

[AdvancedSetup]

The base script has been run on hundreds of computers with no issues or damage.

Your script includes the path to your temp files as well as a few lines of items unwanted

It is extremely unlikely to do damage to the actual installation of Widows

I've helped thousands of people over the last 15 years and only a few users that simply had hardware issues or their system was too damaged to fix but none that have been damaged. I give the warning though just so users know there is always risk when doing malware removal.

 

[darklion2603]

and what about my second question about the security software, I mean if i won't disable it, will it just stop the fix or cause the fix for example to damage something. I mean I want to be sure what will happen if I for example accidentally miss one program and don't disable it.

[AdvancedSetup]

Windows Defender and Malwarebytes won't stop or step on it in most cases. Other AV products often will try to stop it.

 

[darklion2603]

So in case something would be missed by me and left running during the procedure nothing serious will happen? It will just stop the procedure, right?

[AdvancedSetup]

Correct.

I cannot make you run it, but you came here looking for assistance. We have no intention of purposefully harming anyone's computer as people wouldn't come here looking for help much if we did that.

Make a full backup to an external drive if you're that afraid

 

[darklion2603]

It is not that I am afraid that you will mess something up, but that I will mess something up. I will now proced with the 3 point of your instruction since i have already done points 1 and 2

[darklion2603]

Here is the fix log: 

Edited January 20 by darklion2603
Files

[AdvancedSetup]

See, you're still here with us. That wasn't too scary

The fix looks to have run well and found and fixed some other Windows issues

Windows Resource Protection found corrupt files and successfully repaired them.

The Windows Update service was broken and the fix says it was able to fix it

 

Please run the following

 

 

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.