Something else windows has done. And it getting very ANNOYING. Image downloads, through NO FAULT of my own, suddenly decided to be put in Music instead of my pics. AND I am still finding errors. And yes, Kaspersky is still scanning after loads of hours. 6.2 million files scanned 21 mins left.
I would disconnect from the internet as soon as. Hopefully you have an image to fall back on. On another computer you can download portable AV's to a USB drive to run while offline, 10 Free and Portable Offline Antivirus Scanners • Raymond.CC , and also ADWCleaner, Downloads - AdwCleaner - ToolsLib , and Rkill which you should run first, Download RKill (bleepingcomputer.com). Hopefully it will get cleaned. If all else fails then I would do a clean install of Windows by deleting all partitions and only then restore to a Macrium image or whichever imaging software you use.
Kaspersky reports no problems at all, clean machine. Everything is settling down now as I am still proceeding with remedial changes. I am about to reboot anyway as Windows has something to install.
I ran rkill:
Rkill 2.9.1 by Lawrence Abrams (Grinler)
BleepingComputer.com - Technology news and support
Copyright 2008-2021 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesn't - A brief introduction to the program - Anti-Virus, Anti-Malware, and Privacy Software
Program started at: 06/11/2021 05:00:50 PM in x64 mode.
Windows Version: Windows 10 Home
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\ProgramData\BOINC\projects\http://www.cosmologyathome.org\camb_...s_intelx86.exe (PID: 5660) [AU-HEUR]
* C:\ProgramData\BOINC\projects\http://www.cosmologyathome.org\camb_...s_intelx86.exe (PID: 5668) [AU-HEUR]
* C:\ProgramData\BOINC\projects\http://www.cosmologyathome.org\camb_...s_intelx86.exe (PID: 5688) [AU-HEUR]
* C:\ProgramData\BOINC\projects\universeathome.pl_universe\BHspin2_19_windows_x86_64.exe (PID: 5716) [AU-HEUR]
* C:\ProgramData\BOINC\projects\universeathome.pl_universe\BHspin2_19_windows_x86_64.exe (PID: 5756) [AU-HEUR]
* C:\ProgramData\BOINC\projects\universeathome.pl_universe\BHspin2_19_windows_x86_64.exe (PID: 5776) [AU-HEUR]
6 proccesses terminated!
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Defender Disabled
[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 06/11/2021 05:01:14 PM
Execution time: 0 hours(s), 0 minute(s), and 23 seconds(s)
Ran adwcleaner:
# -------------------------------# Malwarebytes AdwCleaner 8.2.0.0# -------------------------------# Build: 03-22-2021# Database: 2021-05-17.1 (Cloud)# Support: https://www.malwarebytes.com/support## -------------------------------# Mode: Clean# -------------------------------# Start: 06-11-2021# Duration: 00:00:00# OS: Windows 10 Home# Cleaned: 4# Failed: 0***** [ Services ] *****No malicious services cleaned.***** [ Folders ] *****No malicious folders cleaned.***** [ Files ] *****No malicious files cleaned.***** [ DLL ] *****No malicious DLLs cleaned.***** [ WMI ] *****No malicious WMI cleaned.***** [ Shortcuts ] *****No malicious shortcuts cleaned.***** [ Tasks ] *****No malicious tasks cleaned.***** [ Registry ] *****Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|Codec Settings UAC ManagerDeleted HKLM\Software\Wow6432Node\\Microsoft\Shared Tools\MSConfig\startupreg\Opera Browser AssistantDeleted HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Run|Codec Settings UAC Manager***** [ Chromium (and derivatives) ] *****Deleted bbmegnmpleoagolcnjnejdacakedpcgd***** [ Chromium URLs ] *****No malicious Chromium URLs cleaned.***** [ Firefox (and derivatives) ] *****No malicious Firefox entries cleaned.***** [ Firefox URLs ] *****No malicious Firefox URLs cleaned.***** [ Hosts File Entries ] *****No malicious hosts file entries cleaned.***** [ Preinstalled Software ] *****No Preinstalled Software cleaned.*************************[+] Delete Tracing Keys[+] Reset Winsock*************************AdwCleaner[S00].txt - [5676 octets] - [14/03/2019 01:05:38]AdwCleaner[C00].txt - [4964 octets] - [14/03/2019 01:05:58]AdwCleaner_Debug.log - [52368 octets] - [03/12/2019 14:56:54]AdwCleaner[S01].txt - [4024 octets] - [03/12/2019 14:57:37]AdwCleaner[C01].txt - [3736 octets] - [03/12/2019 14:57:53]AdwCleaner[S02].txt - [1692 octets] - [05/12/2019 21:09:44]AdwCleaner[C02].txt - [1860 octets] - [05/12/2019 21:10:05]AdwCleaner[S03].txt - [1755 octets] - [06/12/2019 05:17:45]AdwCleaner[S04].txt - [2138 octets] - [22/04/2020 16:29:57]AdwCleaner[C04].txt - [2267 octets] - [22/04/2020 16:30:08]AdwCleaner[S05].txt - [2397 octets] - [11/06/2021 17:04:13]########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C05].txt ##########
it found 4 PUP items and deleted them.
tell me about it! I am running the last of the test links, this is Microsoft Safety Scanner, so far its done 4million files and found 12 'objects' - dont know what yet as its got a hell of a long way to go. I had to go out for couple of hours, left it running.
its now been running over 5 hours, found 15 infections and still not even half way. The earlier windows installation seems to have added things, and look like things I don't want. eg: toolbar, inserted a weather panel. That's going. I only have to look out of the window to see what the weathers doing.
scanning all my disks and now stands at 39 'infected' after 9 million+ files coming up on the 10m mark.
6 hours 38 mins + half way through scan. MS Safety Scan reports 143 suspicious objects, most will I presume be harmless.
Edit: 75% and 438 infected. Bear in mind these are 5 drives in which many files are stored. False pos defo a contributing factor, we shall see
Last edited by elbmek; 11 Jun 2021 at 20:00.
and I think I screwed up at 538 objects noted I inadvertently clicked cancel. I feel sick! Maybe later eh?
Now it tells me that my webcam is screwed. Reloaded software and only get a bar code of beautiful colours. I reloaded the Logitech Cam software.
Quote
