Having continuous pop-up on Malwarebytes- Scan shows nothing.

[baconjr612]

I am having a continous popup about this file being Malware. Has anyone found a solution? From what I understand this has something to do with Windows Framework. No issues scan on Windows Defender and Malwarebytes so what am I to do. There is also no windows update , I am still on 10.

[Porthos]

@baconjr612

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove pesky malware.

Please respond to all future instructions from your helper in a timely manner.

Please do the following so that we may take a closer look at your system for any possible infections.

Do these 2 steps FIRST so that files and folders are set to SHOW, plus also, Turn OFF Windows Fast Start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• 
• 
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
  Then be patient for the next expert to take your case.

Thank you

[AdvancedSetup]

Good day, @baconjr612

Please post back the requested log and we'll be happy to assist you.

Thanks

 

[baconjr612]

19 hours ago, AdvancedSetup said:

Good day, @baconjr612

Please post back the requested log and we'll be happy to assist you.

Thanks

 

Hello so , it seems like for whatever reason yesterday i was trying to reply with that log and it kept giving me a ‘this message may create spam’ now it seems like im giving a SpamFireWall is activated . so it blacklisted me??

 

the only reason i am able to reply here is i disconnected from my home wifi on my phone 

[AdvancedSetup]

Thank you for the follow up @baconjr612

I have removed the block from our Clean Talk spam protection. You should be able to post your logs now.

Cheers

 

[baconjr612]

8 hours ago, AdvancedSetup said:

Thank you for the follow up @baconjr612

I have removed the block from our Clean Talk spam protection. You should be able to post your logs now.

Cheers

 

Aweosome though i still seem to have an issue accessing the website on my laptop. it’s still giving me that firewall alert . Is there an

[AdvancedSetup]

Please try resetting your firewall

https://pureinfotech.com/reset-firewall-settings-windows-10/

[AdvancedSetup]

Hello @baconjr612

How are things going now?

 

[baconjr612]

2 minutes ago, AdvancedSetup said:

Hello @baconjr612

How are things going now?

 

I am still not able to access from the laptop 

[AdvancedSetup]

Please get us some logs from the laptop. You can use a USB thumb drive to save and copy the logs to post back from another computer if needed.

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

[baconjr612]

22 hours ago, AdvancedSetup said:

Please get us some logs from the mbst-grab-results.ziplaptop. You can use a USB thumb drive to save and copy the logs to post back from another computer if needed.

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

Here you go , got everything to work. 

[AdvancedSetup]

Hello @baconjr612

Is all okay now?

I don't see any requested logs attached.

 

[baconjr612]

7 hours ago, AdvancedSetup said:

Hello @baconjr612

Is all okay now?

I don't see any requested logs attached.

 

I will try again to attach.. mbst-grab-results.zip

[AdvancedSetup]

Thank you for the mbst-grab-results.zip file but I'd like to have you run the following exactly as shown and post those logs back, please.

 

Scan with FSS Farbar Service Scanner

 

Scan with Farbar Recovery Scan Tool

 

 

Thank you

 

 

[baconjr612]

7 minutes ago, AdvancedSetup said:

Thank you for the mbst-grab-results.zip file but I'd like to have you run the following exactly as shown and post those logs back, please.

 

Scan with FSS Farbar Service Scanner

 

Scan with Farbar Recovery Scan Tool

 

 

Thank you

 

 

FSS.txtFRST.txtAddition.txt

here you go 

[AdvancedSetup]

Thank you for the logs, but you need to run them with Admin rights.

Ran by Oscar (Welltree) (ATTENTION: The user is not administrator

Please run them again but this time use an account that has Administrator rights

 

[baconjr612]

Addition.txtFRST.txt

8 minutes ago, AdvancedSetup said:

Thank you for the logs, but you need to run them with Admin rights.

Ran by Oscar (Welltree) (ATTENTION: The user is not administrator

Please run them again but this time use an account that has Administrator rights

 

FRST.txtFSS.txtAddition.txt

[AdvancedSetup]

Windows Autoupdate Disabled Policy:
============================
ATTENTION!=====> policy restriction on WindowsUpdate: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

 

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION

 

Please remove the restriction from the Registry and restart the computer.

Then check for Windows Updates

 

[baconjr612]

1 hour ago, AdvancedSetup said:

Windows Autoupdate Disabled Policy:
============================
ATTENTION!=====> policy restriction on WindowsUpdate: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

 

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION

 

Please remove the restriction from the Registry and restart the computer.

Then check for Windows Updates

 

How do i do that? this is the only thing that I see under that folder

[AdvancedSetup]

The Farbar (FRST) program is located here in your downloads folder:  C:\Users\bacon\Downloads\FRSTEnglish.exe

Please follow the process below to perform a fix in Safe Mode

 

Start in Safe mode:

• Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
• Choose Update and Security.
• From the menu at the left, choose Recovery.
• Under the title Advanced startup at the right, choose Restart now.
• From the window that will appear choose Troubleshoot and then Advanced options.
• Choose Startup Settings and then Restart.
• Press number 5, for choosing Safe mode with networking.
• You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.

After that:

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

 

Start::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction
GroupPolicy: Restriction
End::

 

• Right-click on FRSTEnglish in your Downloads folder, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in your Downloads folder or where you have the Farbar program located.
• Attach that log in your next reply.

 

Thank you

 

 

[baconjr612]

8 hours ago, AdvancedSetup said:

The Farbar (FRST) program is located here in your downloads folder:  C:\Users\bacon\Downloads\FRSTEnglish.exe

Please follow the process below to perform a fix in Safe Mode

 

Start in Safe mode:

• Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
• Choose Update and Security.
• From the menu at the left, choose Recovery.
• Under the title Advanced startup at the right, choose Restart now.
• From the window that will appear choose Troubleshoot and then Advanced options.
• Choose Startup Settings and then Restart.
• Press number 5, for choosing Safe mode with networking.
• You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.

After that:

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

 

Start::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction
GroupPolicy: Restriction
End::

 

• Right-click on FRSTEnglish in your Downloads folder, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in your Downloads folder or where you have the Farbar program located.
• Attach that log in your next reply.

 

Thank you

 

 

So when I restarted in safe mode with option 5 , network connectivity was still disabled 

mbst-grab-results.zip

[AdvancedSetup]

I need the FIXLOG.TXT file please.

Then run Farbar scanner again with Admin rights and get me 2 new fresh logs from a new scan.

 

FRST.TXT
ADDITION.TXT

Thanks @baconjr612

[baconjr612]

On 2/16/2024 at 11:33 AM, AdvancedSetup said:

I need the FIXLOG.TXT file please.

Then run Farbar scanner again with Admin rights and get me 2 new fresh logs from a new scan.

 

FRST.TXT
ADDITION.TXT

Thanks @baconjr612

I think that is where the confusion is coming. I do not have a fixlog.txt file.. 

[AdvancedSetup]

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\bacon\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[baconjr612]

36 minutes ago, AdvancedSetup said:

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\bacon\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt 55.63 kB · 1 download

Thanks

 

Fixlog.txt here you go