Computer Hope
Software => Computer viruses and spyware => Topic started by: AmIcrazy? on April 12, 2020, 05:55:10 PM
-
Is this a virus or is this normal. updates being randomly skipped, computer wont let me access anything anymore like admin, or do simple changes, As the computer started acting up and getting very hot for no reason. nothing running.
i use a 64bit, 16gb, amd2600 6core processor. with windows 10 home.
and this makes me very nervous.
i will sit here seaching until resolved.
i copied and pasted into notepad because i cant control anything else. i cant boot in safe mode or reset computer. new admin pop up daily. very confused.
thank you in advance for some of your time.
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
Let's try running a few scans and see what shows up.
*************************************************************************
Please download AdwareCleaner onto your Desktop. AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/)
Before starting AdwCleaner, close all open programs and internet browsers, then double-click on the AdwCleaner icon.
(http://i424.photobucket.com/albums/pp322/digistar/AdwCleaner-icon.jpg)
If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.
When the AdwCleaner program will open, click on the Scan button as shown below.
(http://i424.photobucket.com/albums/pp322/digistar/untitled.png)
AdwCleaner will now start to search for malicious files that may be installed on your computer.
To remove the files that were detected in the previous step, please click on the Clean button.
(http://i424.photobucket.com/albums/pp322/digistar/3.png)
AdwCleaner will now prompt you to save any open files or data as the program will need to reboot the computer. Please do so and then click on the OK button. AdwCleaner will now delete all detected adware from your computer. When it is done it will display an alert that explains what PUPs (Potentially Unwanted Programs) and Adware are. Please read through this information and then press the OK button. You will now be presented with an alert that states AdwCleaner needs to reboot your computer.
Please click on the OK button to allow AdwCleaner reboot your computer.A log will be produced. Please copy and paste this log in your next reply.
*********************************************
(http://i424.photobucket.com/albums/pp322/digistar/mbamicontw5.gif) Download and install: Please download Malwarebytes' scanner (http://downloads.malwarebytes.org/file/mbam) to your desktop.
Double Click mbam-setup.exe to install the application.
- It should update automatically if the computer is connected to the internet.
- Click on Threat Scan and click on Scan Now.
- The scan may take some time to finish,so please be patient.
- When the scan is complete make sure all the infections have "quarantine" selected in the Action box.
- Click on "Apply actions" You may be asked to Restart your computer to completely remove the infections.
- When disinfection is completed you can click on "Copy to Clipboard".
- Paste the log in you next reply (CTRL+ V)
*************************************************
Download Security Check by screen317 from the following link and save it to your desktop.
Security Check (http://www.bleepingcomputer.com/download/securitycheck/)
* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.
Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
-
i have lost the ability to download anything, stays at 0%
i have already tried a few ways with cox and microsoft, both failed.
i tried booting safe mode but it looks like their might be code involved, and fact. reset both unable to achieve
just my theory, not sure.
i installed malwarebytes that day. only reason im still here fighting.
THANK YOU SO MUCH
these are my earlier saved results
-
making me post for more pictures.
-
Please do not attach your logs unless absolutely necessary. Copy and paste them in your reply(ies)
How long has the computer been doing this? Did you install anything new prior to this happening?
Can you download the other two scans on another computer?
-
want me to copy paste the ones i linked? or next time
i am totally unable to download anything, it sends me to something like %miramar%
but i have an idea, i can use discord to stream my PC and you can tell me what to do for you? for the time being if you'd like. https://discord.gg/wTRetF
computer only been down 4 days, but it started getting bad over a week ago, didnt think it would be like this. now i know
-
ok im at 90% noob now
i dont know how to change format to paste or attach
https://discord.gg/NWgb2e and you can tell me what to do next??
-
ok im at 90% noob now
i dont know how to change format to paste or attach
https://discord.gg/NWgb2e and you can tell me what to do next??
SUPERDAVE!!!!!!!!!!!!! TELL ME WHAT TO DO NEXT! cops or just uninstall and wipe *sorry got excited... but i found the files...IM SToked, and really hope i did.
-
ok then sweet, i love knots in my stomach
-
1. This isn't a chat room. It's a forum. Expect a turnaround time of a day or perhaps two. as described here (https://www.computerhope.com/forum/index.php/topic,46313.0.html):
We also request patience. The Experts here are Volunteers and are not here 24/7. This is not a live session either. If it takes a few hours or overnight for them to get back to you, trust me it is worth the wait. See here why not to bump your thread. And once you have been given the all-clear, be sure to stick around until your Helper clearly concludes the issue, as they may have some additional steps and advice for you to follow. Just because you have been cleaned of an infection, that doesn't always mean the work is over.
2. Nobody is going to join your "Discord stream". It certainly makes zero sense to PM arbitrary other members multiple times trying to get them to join.
3. When Superdave said to paste the logs into your replies, he meant precisely that- there is no need to convert formats. the log files are text documents, so you can copy paste their content to the Post box.
-
im fighting something in my system and you want me to answer a question a day
im trying here, and meant no disrespect. i wanted to give a feedback with all my info ive already gathered. hopefully to save time. didnt work MY BAD
can you help me?
**i have some alarming files on hand but cant post it in this forum, i cant download, im very limited just being a novice now i have no apps to work with. clinging on to this thread because its my last hope
-
=== Verbose logging started: 4/10/2020 14:09:01 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\WINDOWS\Explorer.EXE ===
MSI (c) (10:C4) [14:09:01:709]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg
MSI (c) (10:C4) [14:09:01:709]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg
MSI (c) (10:EC) [14:09:01:723]: Resetting cached policy values
MSI (c) (10:EC) [14:09:01:723]: Machine policy value 'Debug' is 0
MSI (c) (10:EC) [14:09:01:723]: ******* RunEngine:
******* Product: {CD95F661-A5C4-44F5-A6AA-ECDD91C2411B}
******* Action:
******* CommandLine: **********
MSI (c) (10:EC) [14:09:01:724]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (10:EC) [14:09:01:724]: Grabbed execution mutex.
MSI (c) (10:EC) [14:09:01:766]: Cloaking enabled.
MSI (c) (10:EC) [14:09:01:766]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (10:EC) [14:09:01:768]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (C0:6C) [14:09:01:776]: Running installation inside multi-package transaction {CD95F661-A5C4-44F5-A6AA-ECDD91C2411B}
i have over a million files from them..but just sitting here begging for help, not attention.
i really hope its okay i post a few more. to hopefully catch your attention or laugh at me. either way i get an answer
-
MSI (s) (C0:6C) [14:09:01:776]: Grabbed execution mutex.
MSI (s) (C0:88) [14:09:01:779]: Resetting cached policy values
MSI (s) (C0:88) [14:09:01:779]: Machine policy value 'Debug' is 0
MSI (s) (C0:88) [14:09:01:779]: ******* RunEngine:
******* Product: {CD95F661-A5C4-44F5-A6AA-ECDD91C2411B}
******* Action:
******* CommandLine: **********
MSI (s) (C0:88) [14:09:01:779]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (C0:88) [14:09:01:781]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (C0:88) [14:09:01:785]: Machine policy value 'LimitSystemRestoreCheckpointing' is 0
MSI (s) (C0:88) [14:09:01:785]: Note: 1: 1717 2: WinZip 22.5
MSI (s) (C0:88) [14:09:01:786]: Calling SRSetRestorePoint API. dwRestorePtType: 1, dwEventType: 102, llSequenceNumber: 0, szDescription: "Removed WinZip 22.5.".
MSI (s) (C0:88) [14:09:03:012]: The call to SRSetRestorePoint API succeeded. Returned status: 0, llSequenceNumber: 12.
MSI (s) (C0:88) [14:09:03:014]: MSCOREE not loaded loading copy from system32
MSI (s) (C0:88) [14:09:03:021]: End dialog not enabled
MSI (s) (C0:88) [14:09:03:022]: Original package ==> C:\Windows\Installer\35a3002f.msi
MSI (s) (C0:88) [14:09:03:022]: Package we're running from ==> C:\Windows\Installer\35a3002f.msi
MSI (s) (C0:88) [14:09:03:024]: APPCOMPAT: Uninstall Flags override found.
MSI (s) (C0:88) [14:09:03:025]: APPCOMPAT: Uninstall VersionNT override found.
MSI (s) (C0:88) [14:09:03:025]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (s) (C0:88) [14:09:03:025]: APPCOMPAT: looking for appcompat database entry with ProductCode '{CD95F661-A5C4-44F5-A6AA-ECDD91C2411B}'.
MSI (s) (C0:88) [14:09:03:026]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (C0:88) [14:09:03:042]: Machine policy value 'DisablePatch' is 0
MSI (s) (C0:88) [14:09:03:042]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (C0:88) [14:09:03:042]: Machine policy value 'DisableMsi' is 0
MSI (s) (C0:88) [14:09:03:042]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (C0:88) [14:09:03:042]: User policy value 'AlwaysInstallElevated' is 0
-
WindowsUnlock W i n d o w s U s e r A c c o u n t C o n t r o l @ m m r e s . d l l , - 5 8 5 9 vk W i n d o w s L o g o n vk " 8 DispFileName @ m m r e s . d l l , - 5 8 5 3 vk ExcludeFromCPL vk W i n d o w s L o g o f f vk " DispFileName @ m m r e s . d l l , - 5 8 5 2 vk ExcludeFromCPL vk X Q u e s t i o n vk " DispFileName @ m m r e s . d l l , - 5 8 4 9 @ p vk ( S y s t e m N o t i f i c a t i o n vk " @ DispFileName @ m m r e s . d l l , - 5 8 4 8 vk C r i t i c a l S t o p vk " DispFileName @ m m r e s . d l l , - 5 8 4 7 x vk (! E x i t W i n d o w s vk " p! DispFileName @ m m r e s . d l l , - 5 8 4 6 ! H! ! vk ExcludeFromCPL vk ! E x c l a m a t i o n vk " 0" DispFileName @ m m r e s . d l l , - 5 8 4 5 ! " vk " A s t e r i s k vk " " DispFileName @ m m r e s . d l l , - 5 8 4 3 h" " vk $ # S h o w T o o l b a r B a n d vk ( `# DispFileName @ i e f r a m e . d l l , - 1 0 3 2 4 " 8# vk # I n f o r m a t i o n B a r vk ( $ DispFileName @ i e f r a m e . d l l , - 1 0 3 2 6 # # vk `$ R e s t o r e U p vk " $ DispFileName @ m m r e s . d l l , - 5 8 4 2 H$ $ vk $ R e s t o r e D o w n vk " @% DispFileName @ m m r e s . d l l , - 5 8 4 1 $ % vk % N F P C o n n e c t i o n vk " % DispFileName @ m m r e s . d l l , - 5 8 6 7 x% % vk 0& P r i n t C o m p l e t e vk " & DispFileName @ m m r e s . d l l , - 5 8 4 0 & X& vk * & D i s a m b i g u a t i o n P a n e l vk h (' DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 5 & ' vk ' O p e n P r o g r a m vk " ( DispFileName @ m m r e s . d l l , - 5 8 3 9 ' ' vk < X( N e w T e x t M e s s a g e N o t i f i c a t i o n vk " ( DispFileName @ m m r e s . d l l , - 5 8 6 2 @( ( vk $ ) C a l e n d a r R e m i n d e r vk " `) DispFileName @ m m r e s . d l l , - 5 8 6 4 ( 8) vk ) N F P C o m p l e t i o n vk " * DispFileName @ m m r e s . d l l , - 5 8 6 8 ) ) vk , P* N e w M a i l N o t i f i c a t i o n vk " * DispFileName @ m m r e s . d l l , - 5 8 6 1 8* * vk : * I n c o m i n g C a l l N o t i f i c a t i o n 9 vk " `+ DispFileName @ m m r e s . d l l , - 5 8 8 0 * 8+ + vk ExcludeFromCPL vk : + I n c o m i n g C a l l N o t i f i c a t i o n 8 vk " @, DispFileName @ m m r e s . d l l , - 5 8 7 9 + , x, vk ExcludeFromCPL vk : , I n c o m i n g C a l l N o t i f i c a t i o n 7 vk " - DispFileName @ m m r e s . d l l , - 5 8 7 8 , , X- vk ExcludeFromCPL vk : - I n c o m i n g C a l l N o t i f i c a t i o n 6 vk " . DispFileName @ m m r e s . d l l , - 5 8 7 7 - - 8. vk ExcludeFromCPL vk : x. I n c o m i n g C a l l N o t i f i c a t i o n 5 vk " . DispFileName @ m m r e s . d l l , - 5 8 7 6 `. . / vk ExcludeFromCPL vk : X/ I n c o m i n g C a l l N o t i f i c a t i o n 4 vk " / DispFileName @ m m r e s . d l l , - 5 8 7 5 @/ / 0 hbin 0 vk ExcludeFromCPL vk : `0 I n c o m i n g C a l l N o t i f i c a t i o n 3 vk " 0 DispFileName @ m m r e s . d l l , - 5 8 7 4 H0 0 1 vk ExcludeFromCPL vk : @1 I n c o m i n g C a l l N o t i f i c a t i o n 2 vk " 1 DispFileName @ m m r e s . d l l , - 5 8 7 3 (1 1 1 vk ExcludeFromCPL vk < 2 I n c o m i n g C a l l N o t i f i c a t i o n 1 0 vk " 2 DispFileName @ m m r e s . d l l , - 5 8 8 1 2 `2 2 vk ExcludeFromCPL vk : 3 I n c o m i n g C a l l N o t i f i c a t i o n 1 vk " h3 DispFileName @ m m r e s . d l l , - 5 8 7 2 2 @3 3 vk ExcludeFromCPL vk 3 A l a r m 9 vk " 4 DispFileName @ m m r e s . d l l , - 5 8 9 6 3 3 X4 vk ExcludeFromCPL vk 4 A l a r m 8 vk " 4 DispFileName @ m m r e s . d l l , - 5 8 9 5 4 4 5 vk ExcludeFromCPL vk P5 A l a r m 7 vk " 5 DispFileName @ m m r e s . d l l , - 5 8 9 4 85 h5 5 vk ExcludeFromCPL vk 6 A l a r m 6 vk " H6 DispFileName @ m m r e s . d l l , - 5 8 9 3 5 6 6 vk ExcludeFromCPL vk 6 A l a r m 5 vk " 7 DispFileName @ m m r e s . d l l , - 5 8 9 2 6 6 87 vk ExcludeFromCPL vk x7 A l a r m 4 vk " 7 DispFileName @ m m r e s . d l l , - 5 8 9 1 `7 7 7 vk ExcludeFromCPL vk 08 A l a r m 3 vk " p8 DispFileName @ m m r e s . d l l , - 5 8 9 0 8 H8 8 vk ExcludeFromCPL vk 8 A l a r m 2 vk " (9 DispFileName @ m m r e s . d l l , - 5 8 8 9 8 9 `9 vk ExcludeFromCPL vk 9 A l a r m 1 0 vk " 9 DispFileName @ m m r e s . d l l , - 5 8 9 7 9 9 : vk ExcludeFromCPL vk X: A l a r m 1 vk " : DispFileName @ m m r e s . d l l , - 5 8 8 8 @: p: : vk ExcludeFromCPL vk : ; I n s t a n t M e s s a g e N o t i f i c a t i o n vk " x; DispFileName @ m m r e s . d l l , - 5 8 6 3 : P; vk ; N o t i f i c a t i o n vk " < DispFileName @ m m r e s . d l l , - 5 8 6 5 ; ; vk " `< S t a r t N a v i g a t i o n vk ( < DispFileName @ i e f r a m e . d l l , - 1 0 3 2 0 H< < vk = M o v e M e n u I t e m vk ( X= DispFileName @ i e f r a m e . d l l , - 1 0 3 2 2 < 0= vk = M i s r e c o g n i t i o n vk h > DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 1 = = vk > M i n i m i z e vk " > DispFileName @ m m r e s . d l l , - 5 8 3 6 > > vk (? M e s s a g e N u d g e vk " p? DispFileName @ m m r e s . d l l , - 5 8 6 6 ? H? vk ? M e n u P o p - u p ? @ p@ @ hbin @ vk " H@ DispFileName @ m m r e s . d l l , - 5 8 3 5 vk @ M e n u C o m m a n d vk " @ DispFileName @ m m r e s . d l l , - 5 8 3 4 vk A M a x i m i z e vk " PA DispFileName @ m m r e s . d l l , - 5 8 3 3 @ (A vk 4 A D e s k t o p M a i l N o t i f i c a t i o n vk " B DispFileName @ m m r e s . d l l , - 5 8 3 7 A A vk $ PB L o w B a t t e r y A l a r m vk " B DispFileName @ m m r e s . d l l , - 5 8 3 2 8B xB vk B S l e e p vk h (C DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 4 B C vk C O n vk h C DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 2 C C vk D O f f vk h D DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 3 xD D vk `E F e e d D i s c o v e r e d vk ( E DispFileName @ i e f r a m e . d l l , - 1 7 3 1 5 HE E vk * F N e w F a x N o t i f i c a t i o n vk " `F DispFileName @ m m r e s . d l l , - 5 8 5 8 E 8F vk $ F E m p t y R e c y c l e B i n vk " G DispFileName @ m m r e s . d l l , - 5 8 3 1 F F vk . PG D i s a m b i g u a t i o n N u m b e r s vk h G DispFileName @ C : \ W i n d o w s \ S y s t e m 3 2 \ s p e e c h \ s p e e c h u x \ s a p i . c p l , - 5 5 6 6 8G G vk 2 HH D e v i c e F a i l e d t o C o n n e c t vk " H DispFileName @ m m r e s . d l l , - 5 8 3 0 0H H vk $ H D e v i c e D i s c o n n e c t vk " HI DispFileName @ m m r e s . d l l , - 5 8 2 9 H I vk I D e v i c e C o n n e c t vk " I DispFileName @ m m r e s . d l l , - 5 8 2 8 I I vk . 8J C r i t i c a l B a t t e r y A l a r m vk " J DispFileName @ m m r e s . d l l , - 5 8 2 7 J pJ vk J C l o s e P r o g r a m vk " 0K DispFileName @ m m r e s . d l l , - 5 8 2 6 J K vk K C h a n g e T h e m e vk " K DispFileName @ m m r e s . d l l , - 5 8 6 0 hK K vk L S e l e c t vk ( XL DispFileName @ i e f r a m e . d l l , - 1 0 3 2 3 L 0L vk , L B l o c k e d P o p - u p W i n d o w vk ( M DispFileName @ i e f r a m e . d l l , - 1 0 3 2 5 L L vk `M P r o g r a m E r r o r vk " M DispFileName @ m m r e s . d l l , - 5 8 2 5 HM M vk ( M C o m p l e t e N a v i g a t i o n vk ( PN DispFileName @ i e f r a m e . d l l , - 1 0 3 2 1 M (N vk N D e f a u l t B e e p vk " N DispFileName @ m m r e s . d l l , - 5 8 2 4 N N nk
h ` ) Y 4 &
International e n - U S 3 ; 0 O vk O s1159 A M vk hQ s2359 hbin P Xsk
-
all right, ive been too much. ill leave.
but im taking my basketball with me :P