solidstate Posted August 31 ID:1658236 Share Posted August 31 Hi, I need I help. It always writes to me that the website was pool.hashvault.pro and www.foodcarve.com blocked, 5 unwanted programs were found during the check, when I re-scan they are displayed again even though I send them to quarantine and delete them Addition.txtFRST.txt Link to post Share on other sites More sharing options...
MKDB Posted August 31 ID:1658248 Share Posted August 31 Hello @solidstate and My name is MKDB and I will assist you. Let's keep these principles as we proceed. Make sure to read the entire post below first. Please follow the steps in the given order and post back the log files. Please attach all log files into your post. Before we start, please make sure that you have an external backup, not connected to this system, of all private data. Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you. As English is not my native language, please do not use slang or idioms. It may be hard for me to understand. If you do not respond within 4 days, your topic will be closed. Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure. Please give me some time to review what you have posted! Thank you! Link to post Share on other sites More sharing options...
MKDB Posted August 31 ID:1658250 Share Posted August 31 @solidstate Due to the use of illegal pirated software, the system is heavily infected with malware. Moreover, it has damaged windows operation system. Please read the following link: Windows Defender warned you: Quote Name: Trojan:Win32/Bearfoos.B!ml Severity: Severe Category: Trojan Path: file:_C:\Users\joshu\Downloads\Arturia Matrix-12 V v271 WiN-OSX.exe Uninstall Arturia Matrix and every other pirated software immedialtely, reboot your system and run a fresh scan with FRST. Depending on the new logfiles, maybe I will be able to help you. 1 Link to post Share on other sites More sharing options...
solidstate Posted August 31 Author ID:1658253 Share Posted August 31 I've fully uninstalled but it still shows in Addition.txt FRST.txtAddition.txt Link to post Share on other sites More sharing options...
MKDB Posted August 31 ID:1658291 Share Posted August 31 @solidstate Thank you for the logfiles. The desinfection is not easy. More steps will follow. First, we will use FRST to run a fix. This will take some minutes to complete. Please be very patient and do not interfere. Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\joshu\Downloads\ ). Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work. Close all open programs and save your work. Run FRST again. Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about. Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code. Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request. If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart. FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply. fixlist.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 3 Root Admin ID:1658929 Share Posted September 3 Hello @solidstate Are you still with us? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 8 Root Admin ID:1659700 Share Posted September 8 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Tips to help protect from infection Thanks Link to post Share on other sites More sharing options...
Recommended Posts