Please run the scans suggested below in the order that they are requested and post the logs in the same order. Unless otherwise instructed post the logs in your topic, do not use a host website to post these logs. Please do not wrap your logs in quotes or code brackets or use use spoilers.
Please download and run RKill This must be run first and left running until all the scans have been run.
RKill attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. RKill will not remove any of the processes it stops, you will need to run security scans to remove any malware found.
These settings will remain until the computer is rebooted, for this reason you must run your security applications before the computer is restarted.
Please download
RKill and install it.
When
RKill is run it will display a console screen similar to the one below:
After this has run you will see another image explaining that RKill has finished running and you should be able to run the scan. You need to click/tap on
OK.
When
RKill has finished running a log will be displayed showing all of the processes that were terminated by RKill.
Attention:
At this time you need to run your security applications listed below. When the scan has finished running a lot will be posted in Notepad. Copy and paste this log in your topic.
Importanat: There is a possibility that malware may recognize RKill and keep it from running, if this is the case do the following.
If while
RKill is running you may see a message from the malware stating that the program could not be run because it is a virus or is infected. This is the malware trying to protect itself. Two methods that you can try to get past this and allow RKill to run are:
1) Rename Rkill so that it has a .com extension.
2) Download a version that is already renamed as files that are commonly white-listed by malware. The main
Rkill download page contains individual links to renamed versions.
After the application has run successfully and you have run the requested scans you should reboot the computer to restore the processes and Windows Registry entries.
Please run TDSSKiller.
Please download
TDSSKiller from here and save it to your Desktop.
The log for the TDSSKiller can be very long. If you go to the bottom of the log to where you find
Scan finished you will see the results of the scan. If it shows
Detected object count: 0 and
Actual detected object count: 0, this means that nothing malicious was found and you will not need to post the log.
1. Doubleclick on
TDSSKiller.exe to run the application, then click on
Change parameters.
2. Check
Loaded Modules, Verify Driver Digital Signature, and
Detect TDLFS file system.
If you are asked to reboot because an "Extended Monitoring Driver is required" please click
Reboot now.
3. Click
Start Scan and allow the scan process to run.
4. If threats are detected select
Cure (if available) for all of them unless otherwise instructed. If threats are not found you will see a screen like the one below.
***Do NOT select Delete!Click on
Continue.
5. Click on
Reboot computer.
Please copy the
TDSSKiller.[Version]_[Date]_[Time]_log.txt file found in your root directory (in most cases this is c: Drive) and paste it into your next reply.
Note: The log may be very long. You may need to break it into parts to post the whole log in your topic.
Please run Malwarebytes AntiMalwarePlease download
Malwarebytes Anti-Malware 2.2.
1) Double-click on
mbam-setup.exe, then click on
Run to install the application, follow the prompts through the installation.
2) Malwarebytes will automatically open. You will see an image like the one below, click on
Update Now.
3) Click on
Settings, you will see a image like the one below.
When Settings opens click on
Detection and Protection, then under
Non-Malware Protection, click on the down arrow for
PUP (Potentially Unwanted Programs) detections and select
Treat detections as malware. Under
Detection Options place a check in the box for
Scan for rootkits4) Click on
Scan (next to Settings), then click on
Scan Now. The scan will automatically run now.
5) When the scan is complete the results will be displayed. Click on
Delete All.
6) Please post the Malwarebytes log.
To find the Malwarebytes log do the following. Copy and paste the log in your topic.
*Open Malwarebytes Anti-Malware.
*Click the
Scan Tab at the top.
*Click the
View detailed log link on the right.
*Click
Copy to Clipboard at the bottom...come back to this thread, click Add Reply, then right-click and choose
Paste.
*Alternatively, you can click
Export and save the log as a .txt file on yout Desktop or another location.
*Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
Please download
AdwCleaner and install it.
When AdwCleaner opens click on
Scan to start the scan.
Once the search is complete a list of the pending items will be displayed. If you see any which you do not want removed, remove the check mark next to it.
If there are no malicious programs are found you will receive a message informing you of this.
Click on
Clean to remove the selected items. If you have any questions about any items in the list please copy and paste the list in your topic so we can review it.
You will receive a message telling you that all programs will be closed so that the infections can be removed. Click on
OK. The computer will be restarted to complete the cleaning process.
When the cleaning process is complete a log of what was removed will be presented. Please copy and the paste this log in your topic.
Please run the ESET OnlineScanThis scan takes quite a long time to run, so be prepared to allow this to run
till it is completed.
***Please note. If you run this scan using Internet Explorer you won't need
to download the Eset Smartinstaller.***
ESET Online Scanner- Click here to download the installer for ESET Online Scanner and save it to your Desktop.
- Disable all your antivirus and antimalware software - see how to do that
here. - Right click on esetsmartinstaller_enu.exe and select Run as Administrator.
- Place a checkmark in YES, I accept the Terms of Use, then click Start. Wait for ESET Online Scanner to load its components.
- Select Enable detection of potentially unwanted applications.
- Click Advanced Settings, then place a checkmark in the following:
- Remove found threats
- Scan archives
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
- Click Start to begin scanning.
- ESET Online Scanner will start downloading signatures and scan. Please be patient, as this scan can take quite some time.
- If threats are found click on Save to text file in Documents.
- Open Documents, find the report, copy and paste it in your topic.
Edited by dc3, 07 June 2018 - 02:31 PM.