Results 1 to 10 of 48

Thread: i don't know what to do, this pc seems to be badly infected...

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    From what the scans are showing, Sync Data Google devices needs to be changed.


    The Google SYNC being on will hamper the cleanups. You need to set it to Off so the cleanups can proceed.

    Turn it Off please.

    Using Chrome browser go to https://www.google.com/settings/chrome/sync and sign into your account.
    Scroll down until you see the "reset sync" button and click on the button
    At the prompt click on "Ok".


    Reset Chrome.

    Open Google Chrome, click on menu icon [img=http://www.techsguide.com/wp-content/uploads/2013/12/google-chrome-setting-icon.png] or the 3 vertical dots located right side top of the google chrome.

    Click "Settings" then "Show advanced settings" at the bottom of the screen.

    Click "Reset and clean up" > "Restore settings to their original defaults"

    Restart Chrome.
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Rkill , not sure where that came from I had asked you download and run RogueKiller?

    I don't want to ask you to run Malwarebytes again since it took so long, but can you recall quarantine/deleting what it found?

    Follow the above, reboot if necessary, then tell me what the computer is doing now.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  2. #2
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    381

    Default

    ok juliet i did as you said in chrome. as for the rkill, i did d'load and run roguekiller from your link but i think i had pc brain after the long scan and simply misnamed it. this is two of the malwarebytes scan reports do they not show what you're looking for? i can run again if needed. the pc is running far better as for clicking a link or favorite or a bookmark, it's not taking near as long. when i click it opens.

    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 5/20/20
    Scan Time: 9:11 AM
    Log File: c652b840-9aa3-11ea-8a00-8c1645ebd964.json

    -Software Information-
    Version: 4.1.0.56
    Components Version: 1.0.896
    Update Package Version: 1.0.24144
    License: Premium

    -System Information-
    OS: Windows 10 (Build 18362.836)
    CPU: x64
    File System: NTFS
    User: DESKTOP-5LGTG7U\ronny

    -Scan Summary-
    Scan Type: Custom Scan
    Scan Initiated By: Manual
    Result: Completed
    Objects Scanned: 574871
    Threats Detected: 1
    Threats Quarantined: 0
    Time Elapsed: 15 hr, 29 min, 15 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Enabled
    Heuristics: Enabled
    PUP: Detect
    PUM: Detect

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 0
    (No malicious items detected)

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 0
    (No malicious items detected)

    File: 1
    Malware.Heuristic.7, C:\USERS\RONNY\DOWNLOADS\DELFIX_1.010.EXE, No Action By User, 7, 0, 1.0.24144, 7, dds, 00728172

    Physical Sector: 0
    (No malicious items detected)

    WMI: 0
    (No malicious items detected)


    (end)


    Malwarebytes
    www.malwarebytes.com

    -Log Details-
    Scan Date: 5/20/20
    Scan Time: 8:46 AM
    Log File: 5e0e8046-9aa0-11ea-8eb4-8c1645ebd964.json

    -Software Information-
    Version: 4.1.0.56
    Components Version: 1.0.896
    Update Package Version: 1.0.24126
    License: Premium

    -System Information-
    OS: Windows 10 (Build 18362.836)
    CPU: x64
    File System: NTFS
    User: System

    -Scan Summary-
    Scan Type: Threat Scan
    Scan Initiated By: Scheduler
    Result: Completed
    Objects Scanned: 274891
    Threats Detected: 14
    Threats Quarantined: 0
    Time Elapsed: 5 min, 1 sec

    -Scan Options-
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Detect
    PUM: Detect

    -Scan Details-
    Process: 0
    (No malicious items detected)

    Module: 0
    (No malicious items detected)

    Registry Key: 0
    (No malicious items detected)

    Registry Value: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Data Stream: 0
    (No malicious items detected)

    Folder: 3
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 194, 454832, , , ,

    File: 11
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000103.log, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000105.ldb, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\Users\ronny\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 194, 454832, , , ,
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, 194, 454832, 1.0.24126, , ame,
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 194, 454832, 1.0.24126, , ame,
    PUP.Optional.Conduit, C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 194, 454832, 1.0.24126, , ame,

    Physical Sector: 0
    (No malicious items detected)

    WMI: 0
    (No malicious items detected)


    (end)

  3. #3
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Good deal, glad its running better.

    Here's where I'm confused, at the end of the line MalwareBytes reports, No Action By User
    If you clicked all the boxes next to the items found then it was cleaned and quarantined if not, might need to run it again to ensure those items get removed.

    Since it's all better now, time to remove tools?
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  4. #4
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    381

    Default

    ok i guess so you've done it again. you have gone and ruined a perfectly fouled up mess and made it resemble a pc! i'll rerun that and do it right thanks juliet, i was beginning to think i'd throw this one in the trash!

  5. #5
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    i was beginning to think i'd throw this one in the trash!
    I think you and the computer have been through a lot.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  6. #6
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    381

    Default

    ok juliet, sorry...the report gives the file location, i can't figure out how in mmalwarebytes to quarentine them now but can i just go to the filr, the last in each string and delete them?

    C:\USERS\RONNY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\ ---->LevelDB <-----

    also this pc is running far better but in both edge and firefox i still have way more than normal "not responding" prompts. also in task mgr, even it freezes up.

  7. #7
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    I researched , Malwarebytes Premium and Malwarebytes Trial this setting is On by default unless you unchecked the box OFF.

    i still have way more than normal "not responding" prompts. also in task mgr, even it freezes up.
    I can direct you to:
    Use the System File Checker tool to repair missing or corrupted system files
    https://support.microsoft.com/en-us/...rrupted-system
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  8. #8
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Also, check to see if you have the windows update mentioned in this article.
    KB4556799

    https://www.forbes.com/sites/gordonk...ws-10-upgrade/
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  9. #9
    Senior Member
    Join Date
    Feb 2008
    Location
    L.A. (Lower Arkansas)
    Posts
    381

    Default

    sorry, been dealing with a hot water heater here also. and guess what? that update installed may 13. i did as follows in the uninstall. wow, that's just great isn't it? microsoft the culprit. think they're there to help but my gosh. ok so let me see how this runs now and i'll be back. thanks!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •