Sons PC infected

Hi mAL,

PC appears to be running OK. Malware Bytes Scan found 12 issues. There was no 'remove' action, just 'quarantine'.
Thanks

Correction - after putting them in Quarantine, I now have the option to delete them. I haven't done that yet.

Hi mAL

PC is running well. Malware Bytes found 12 issues. I put them in quarantine. Attached is the log.
Thanks
BarkFast

Sorry for the duplicate posts, I wasn't sure the first had worked.

Hi Bill,

Sorry for the duplicate posts, I wasn't sure the first had worked.

Absolutely no problem.

Please run the following fix. If all goes well, I can give you the all clean, and if needed instructions on how to properly remove McAfee.

• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
• Press Ctrl+y (Ctrl and y keys at the same time)
• A blank notepad file randomly named will open.
• Copy and paste the following into it ....

CreateRestorePoint:



R2 NameGarobe; C:\Program Files (x86)\NameGarobe\NameGarobe.exe [5330416 2018-04-05] ( (Apps Delivered Ltd -> Name Garobe) [File not signed])  [File is in use ]

2020-05-08 22:57 - 2020-05-08 22:57 - 000000000 ____D C:\Program Files (x86)\NameGarobe

2020-05-08 22:57 - 2020-05-08 22:57 - 000000000 ____D C:\Program Files (x86)\KagemniWebtqbInstaller

2020-05-08 22:57 - 2020-05-08 22:57 - 000000000 ____D C:\Program Files (x86)\GemingaRoundedFleck

2020-05-08 22:56 - 2020-05-08 22:56 - 001794048 _____ C:\Users\adamv\Downloads\Setup (2).msi

2020-05-08 22:56 - 2020-05-08 22:56 - 001794048 _____ C:\Users\adamv\Downloads\Setup (1).msi

2020-05-08 22:55 - 2020-05-08 22:55 - 001794048 _____ C:\Users\adamv\Downloads\Setup.msi

• Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST
• Please post me the log

-----------------------------------------
In your next reply, I would like to see..

• fixlist.txt
• How is the computer behaving?

hi mAL

PC is running well. When I ran FRST a popup came up saying "2". Other than that is seemed to work and after the reboot I posted the file here it is.

BarkFast

Hi Bill,

"BarkFast" wrote:Correction - after putting them in Quarantine, I now have the option to delete them. I haven't done that yet.

I forgot to address this. You can safely delete the entries that were quarantined by MBAM.

"BarkFast" wrote:PC is running well. When I ran FRST a popup came up saying "2". Other than that is seemed to work and after the reboot I posted the file here it is.

Thank you for informing me about the popup. I don't see any reason to worry about it since it came from FRST, which had a bit of difficulty removing one of the entries I included in the fix. However, if you still see the popup, please let me know.

Have you removed McAfee? I can post instructions on how to safely remove the program in my "All clear" post.

Hi mAL

Thanks - MBAM deleted everything fine.

I already removed McAfee and it seems to be gone already.

Thanks again mAL. I'll wait to hear from you on the All Clear.

Bill

Hi Bill,

"BarkFast" wrote:Thanks - MBAM deleted everything fine. I already removed McAfee and it seems to be gone already.

Perfect. I have good news..there are no more signs of malware on your computer Please follow the steps below in the order they are presented and then you'll be all set to go.


Let's remove the tools we have been using so far..

To remove Emisoft...

• Please open the Start menu.
• Click on Settings and then System.
• Select Apps & Features.
• Locate and click on the following programs:
  

  
  

  • Emsisoft Anti-Malware

  
  

• Select uninstall.
• Answer any questions attentively.
• When the process is finished, please restart your computer.
  Note: you can only remove one program at a time.

Next...

• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
• Press Ctrl+y (Ctrl and y keys at the same time)
• A blank notepad file randomly named will open.
• Copy and paste the following into it ....

2020-05-13 21:30 - 2020-05-13 21:30 - 008196784 _____ (Malwarebytes) C:\Users\adamv\Downloads\AdwCleaner - Copy.exe

2020-05-13 21:29 - 2020-05-13 21:30 - 008196784 _____ (Malwarebytes) C:\Users\adamv\Desktop\AdwCleaner.exe

2020-05-13 21:18 - 2020-05-13 21:18 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\adamv\Downloads\iExplore.exe

2020-05-13 21:18 - 2020-05-13 21:18 - 000988112 _____ (Bleeping Computer, LLC) C:\Users\adamv\Downloads\iExplore64.exe

2020-05-13 21:17 - 2020-05-13 21:17 - 001802704 _____ (Bleeping Computer, LLC) C:\Users\adamv\Downloads\rkill.exe

2020-05-13 21:17 - 2020-05-13 21:17 - 000988112 _____ (Bleeping Computer, LLC) C:\Users\adamv\Downloads\rkill64.exe

2020-05-13 21:36 - 2020-05-13 21:40 - 000000000 ____D C:\AdwCleaner



EmptyTemp:

CreateRestorePoint:

• Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST. There is no need to post the log.

Finally...

• Rename Frst.exe or Frst64.exe to Uninstall.exe
• With the computer booted into Normal Mode run the renamed Frst.
• The computer will reboot, and on boot up will delete all files related to FRST.

Concerning MBAM, it would be a good idea to keep in installed and run a scan with it every once in a while. That being said, if you wish to remove it, please follow the same steps that you did to remove Emisoft.

You should also read and get acquainted with the following topic: COMPUTER SECURITY - a short guide to staying safer online , which goes into depth on how to keep your computer secure. I bookmarked it for easy reference and so should you.


Let me know once you've removed all the tools. If you have any questions, feel free to ask.

mAL

Thanks so much. All looks good on the PC.

Is there a way I can pay, donate, contribute to you or the teams work ?

I'm extremely thankful for your work and assistance.

Bill

Hi Bill,

"BarkFast" wrote:
Thanks so much. All looks good on the PC.

I'm extremely thankful for your work and assistance.

I'm really happy we've got everything sorted out, and it's my pleasure.

"BarkFast" wrote:Is there a way I can pay, donate, contribute to you or the teams work ?

Thank you so much for offering to financially contribute to the website, but we don't accept donations. The service we provide is completely free. We really appreciate it, however.

Since you don't have any questions I will go ahead and close this post. Take care and stay safe!


As your problems appear to have been resolved, this topic is now closed.
We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received,
please see Feedback for Our Helpers - Say "Thanks" Here


Ever thought of helping people yourself ?

If you found the process of removing Malware from your own machine interesting, and it has made you want to learn more, and maybe to help others with their Malware problems, then this forum runs a training course to help you do just that.

Apply to the Malware Removal University and see if you have what it takes to become a helper on the forums.