Emmo Posted April 27 ID:1632872 Share Posted April 27 Hello, I was advised by another company to do a scan and clean my PC with your product, they haven't advised me yet on what to do next to fully clean my PC. I was hoping to get help here to clear out the rest of the malware, there were 50 detections the first time I scanned, the following scans had 0 detections, so am I maybe in the clear? First time doing any of this if this helps, so any help would be appreciated! Link to post Share on other sites More sharing options...
Porthos Posted April 27 ID:1632877 Share Posted April 27 @Emmo Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following. Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Then be patient for the next expert to take your case. Thank you Link to post Share on other sites More sharing options...
Emmo Posted April 27 Author ID:1632888 Share Posted April 27 (edited) Hello again, I understand, I've attached all logs--I hope these help! Edited Monday at 05:13 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Emmo Posted April 29 Author ID:1633220 Share Posted April 29 Just to update, this issue is still ongoing, and I'm unable to quarantine one thing from the AdwCleaner--I thought I'd just leave a screenshot here in case maybe it helped! I've also tried using that NoScript Extension add-on but as soon as I enabled it I'm unable to attach any files here or see any of the icons, is there something I can do to see these options? [Turned it off to send the files.] Hope to still get help, thank you again! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 29 Root Admin ID:1633409 Share Posted April 29 Thank you for the logs @Emmo Let's not worry about AdwCleaner for now. The Farbar FRST log did not complete properly either. Please go ahead and run the following Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop. (Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021) Download: Kaspersky Virus Removal Tool https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe How to run a scan with Kaspersky Virus Removal Tool 2020 https://support.kaspersky.com/15674 How to run Kaspersky Virus Removal Tool 2020 in the advanced mode https://support.kaspersky.com/15680 How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan https://support.kaspersky.com/15681 Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you Link to post Share on other sites More sharing options...
Emmo Posted April 30 Author ID:1633504 Share Posted April 30 Hello again, Just to be sure, is this meant to last over 3 hours? It still seems to be ongoing so I'm not stopping it for now, but how long is it supposed to last? Link to post Share on other sites More sharing options...
Emmo Posted April 30 Author ID:1633508 Share Posted April 30 (edited) Hello again, the report's been made, I wasn't able to attach the .klr versions so I just converted it to .txt, I hope that's alright! Edited Monday at 05:13 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 30 Root Admin ID:1633583 Share Posted April 30 Thank you for the log. It did find and remove some objects. Yes, antivirus scans on some systems can take several hours and is normal. Please go ahead and run the following other AV scan Please run the following ESET Online Scanner and perform a Full Scan Click the following link to save the installer for ESET Online Scanner https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get started. When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue When prompted for scan type, Click on the Full Scan button Enable ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click the Start scan button. Have patience. The entire process may take a few hours or more. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log and give it a name and location you remember. If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files” ( in blue, at the bottom). Press Continue when all done. You should click to turn off the offer for “periodic scanning”. Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program. Note: If you do need to do a File Restore from ESET please follow the directions below [KB2915] Restore files quarantined by the ESET Online Scanner version 3 https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner Please attach the ESET scan log you saved at the end to your next reply Link to post Share on other sites More sharing options...
Emmo Posted May 1 Author ID:1633638 Share Posted May 1 Hello again, Unfortunately the program keeps crashing [or maybe deleting itself?] upon trying to open, install or even scanning my PC, is there an alternative? Before the last close it noted my connection wasn't stable, maybe that's what's causing it? Is there maybe an alternative? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 1 Root Admin ID:1633644 Share Posted May 1 Okay, let's try another scanner. It's past 1 AM for me, so I'll check back on you tomorrow Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process [ 1 ] Please make the following system changes. Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed. Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed. Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions [ 2 ] I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer. The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. The download links & the how-to-run-the tool are at this link at Microsoft https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Look on the Scan Options & select the FULL scan. Then start the scan. Have lots of patience. It may take several hours. Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run. The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands .....just do not use the computer during this scan. This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.) The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log Please attach that log with your next reply. It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection. That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not. Then it writes into the log on your computer what it found. Thank you 1 Link to post Share on other sites More sharing options...
Emmo Posted May 1 Author ID:1633698 Share Posted May 1 (edited) Hello again, That worked! I was unsure if I should still do my projects and work whilst it was scanning, so I just left my PC altogether to let it run, and it seems like it's removed something! I only had one notification of something malicious running in the background, but still left it be altogether, but I only ever had one notification over the whole thing. The file that was mentioned doesn't seem to have anything in it; maybe nothing I understand, but the other file, "mrt.log" had information so I thought I'd just attach it as well, just in case! I hope these help! Edited Monday at 05:14 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 1 Root Admin ID:1633706 Share Posted May 1 Thank you for the log. It was in your temp folder and Registry and removed it so there shouldn't be anything to see. Let me have you get me some new, fresh updated logs and we'll see what else is going on. Scan with SecurityCheck by glax24 https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/ Scan with FSS Farbar Service Scanner https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/ Scan with Farbar Recovery Scan Tool https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/ Link to post Share on other sites More sharing options...
Emmo Posted May 2 Author ID:1633842 Share Posted May 2 (edited) Hello again, Ohh! That's understandable, and I've attached the logs! My sincerest apologies on the jump between responses, I hadn't realized the timezone differences until I saw your location. I was wondering; I saw on other threads that some files were removed--if possible for privacy reasons, can I also have my first set of logs removed? I hope these help regardless, thank you again! Edited Monday at 05:14 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 2 Root Admin ID:1634026 Share Posted May 2 Thank you for the logs. You have a lot of broken services. Let me work on a script to see if we can fix all of them. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 2 Root Admin ID:1634036 Share Posted May 2 Please follow the steps below [ 1 ] Please consider deleting the following detected by Windows Defender Category: Potentially Unwanted Software Path: file:_ G:\My Drive\Personal\Sylfaen_free_font_download.dmg [ 2 ] Please make the following change in Malwarebytes if you're using the Premium or Trial version Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the General tab. Then turn off "Always register Malwarebytes in the Windows Security Center" Restart the computer It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article and setup exclusions between Malwarebytes and Windows Defender Malwarebytes for Windows antivirus exclusions list https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list [ 3 ] Please go to Control Panel, Programs, Programs and Features, Uninstall a program Then right-click and uninstall the following and restart the computer when done Bonjour (this program is rarely needed on Windows but often causes networking issues) Java 8 Update 381 (64-bit) (old outdated version) Java 8 Update 381 (64-bit) (old outdated version) [ 4 ] Please run the following fix NOTE: Please read all of the information below before running this fix. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply Farbar program: FRSTEnglish.exe Save the attached file: FIXLIST.TXT to this folder C:\Users\user\Downloads\ NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work. Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it. Run the Farbar program with Admin rights and press the Fix button just once and wait. The fix may possibly take up to 60 minutes to complete If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply. NOTE: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Discord cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. fixlist.txt [ 5 ] After the above FIX has completed and the computer has restarted, please run the following again and get me new fresh logs. Scan with SecurityCheck by glax24 https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/ Scan with FSS Farbar Service Scanner https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/ Scan with Farbar Recovery Scan Tool https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/ Thank you Link to post Share on other sites More sharing options...
Emmo Posted May 3 Author ID:1634092 Share Posted May 3 (edited) Hello again! I've made new logs; I noticed on the Security Check as well that there were some apps that needed updating, so I went ahead and updated them if I used them, and uninstalled them if I didn't. I hope these help! Edited Monday at 05:14 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 3 Root Admin ID:1634095 Share Posted May 3 Thank you. Do you have the FIXLOG.TXT from the Farbar fix? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 3 Root Admin ID:1634096 Share Posted May 3 The FSS indicates it was either not run or it did not fix the issues with the broken services Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 3 Root Admin ID:1634099 Share Posted May 3 Let me have you run the following and I'll check back tomorrow. If possible please try to come back on earlier. It's now about 2:30 AM for me Dr.Web CureIt! Please download the Dr.Web CureIt! anti-virus utility https://free.drweb.com/ You will need to send them an email to obtain a link to download the scanner, please do so The downloaded file will normally have a unique name such as: q7a9tr4p.exe Close all open applications and locate the downloaded file and double-click to run it The program will take a moment to launch and bring up the License and Update screen Place a check mark to agree to the terms and then click on the Continue button Click the underlined link Select objects for scanning On the top left click the Scanning objects that should automatically check all objects Click the small wrench and make sure there is a check on Automatically apply actions to threats Then click the large button on bottom right Start scanning Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad The log is saved in the folder named Doctor Web in the top of your user profile folders Please attach that log on your next reply Link to post Share on other sites More sharing options...
Emmo Posted May 3 Author ID:1634102 Share Posted May 3 (edited) On 5/3/2024 at 2:23 AM, AdvancedSetup said: Thank you. Do you have the FIXLOG.TXT from the Farbar fix? Yes! My apologies, my connection is struggling at the moment, but it seems to only be this website, so I'm not sure what's going on, I've attached the fixlog and will read your next messages slowly! Edited Monday at 05:15 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Emmo Posted May 3 Author ID:1634112 Share Posted May 3 (edited) Hello again, I've made arrangements to try to come on a little earlier, although I am unsure if it's guaranteed, I will still try my best regardless! Here's the log, I hope this helps. I noticed a bit of my personal information is included, if possible if after all this, can this attachment be deleted? thank you! Edited May 3 by AdvancedSetup Logs removed per request Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 3 Root Admin ID:1634186 Share Posted May 3 The FIX log ran well. It also found and corrected some other issues. Windows Resource Protection found corrupt files and successfully repaired them. Are you still seeing any signs of infection? Please RESTART the computer again and get me a new fresh set of logs. The fix indicates that the services should have been fixed. Scan with SecurityCheck by glax24 https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/ Scan with FSS Farbar Service Scanner https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/ Scan with Farbar Recovery Scan Tool https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/ Link to post Share on other sites More sharing options...
Emmo Posted Saturday at 05:05 AM Author ID:1634325 Share Posted Saturday at 05:05 AM (edited) Hello again, Thank you so much! I'm still having trouble with this one file I can't seem to remove that Window's Security keeps reminding me about, I tried deleting it from the source, even on the drive's history it's been "forever deleted" but it persists to be an issue. I tried uninstalling the file itself, even then it's giving me warnings regarding this item -- is there anything that can be done? I've also attached the logs! Just in case. Edited Monday at 05:15 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted Sunday at 12:20 AM Root Admin ID:1634405 Share Posted Sunday at 12:20 AM Please run the following fix NOTE: Please read all of the information below before running this fix. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply Farbar program: FRSTEnglish.exe Save the attached file: FIXLIST.TXT to this folder C:\Users\user\Downloads\ NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work. Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it. Run the Farbar program with Admin rights and press the Fix button just once and wait. The fix may possibly take up to 60 minutes to complete If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Discord cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. fixlist.txt Thanks Link to post Share on other sites More sharing options...
Emmo Posted Sunday at 01:56 AM Author ID:1634412 Share Posted Sunday at 01:56 AM (edited) Hello again! I've attached the .txt, surprisingly was a quick minute? But I still see the notification of it being around. I hope this helps! Edited Monday at 05:15 PM by AdvancedSetup Removed logs Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now