I believe I've been infected by a Trojan that's been causing havoc on my PC for a while now. Every time I try to remove it, the next time I scan, it's returned with even more malware. It's now reached a point where it's fully corrupted google Chrome, but I can still use another browser such as Firefox. Chrome constantly flashes to a black screen and back, saying it's running out of memory to run any page I try to load.
On top of this, Anti-malware Service Executable, and Task Manager while I have it open, are both taking up a large portion of my CPU usage, slowing down my computer significantly. I have to force shut down my laptop occasionally if the CPU reaches a threshold where all programs freeze and nothing can be run. This doesn't happen for a while after I remove the malware, but it returns eventually after some time.
A slow PC is annoying, but I'm also concerned about my browsing data being potentially monitored (passwords, credit cards, etc.).
I've attached a scan on two separate days, 30th and the 31st, of Malwarebytes detecting malware and removing/quarantining it, in addition to scans of the other programs I've been instructed to run.
**Update**
Added a 3rd scan that I did today, still comes back after each restart.
Something else that is happening, which I do not know whether or not it's caused by all of this, is that I cannot wake my computer from sleep. If my computer ever falls asleep, the only way to wake it back up is a forced shutdown with the power button.
I think it best we reset google, you wont lose anything.
Instructions on how to backup your Favourites/Bookmarks and other data can be found below. [external image: U5NwUGc.png]Backup Chrome Bookmarks
Proceed with the reset once done. [external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below: To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. save it to the Desktop as fixlist.txt NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
Open FRST/FRST64 and press the > Fix < button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~``
[external image: BY4dvz9.png]AdwCleaner
Please download AdwCleaner and save the file to your Desktop. In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
Follow the prompts.
Click [external image: A49sxPr.png]Scan.
Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click [external image: MqHawIb.png]Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.
Please download Junkware Removal Tool or from here http://downloads.malwarebytes.org/file/jrt to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
~~~ please post Fixlog.txt AdwCleaner[C1].txt JRT.txt
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs, followed by the first Scan Log.
Click Export,followed by Copy to Clipboard. Paste the log in your next reply.
~~~~~~
Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).
After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.
When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
Please download DelFix or from Here and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
– This will remove the specialized tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can bedeleted manually (right-click the file + delete).
*************************
Answers to common security questions - Best Practices by quietman7, MVP
How Malware Spreads - How did I get infected?by quietman7, MVP
Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
How to Prevent Malware by miekiemoes, MVP
How to backup and restore your data using Cobian Backup by YourHighness
Slow Computer/browser? It May Not Be Malwareby quietman7, MVP
AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
[external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
[external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
[external image: 6YRrgUC.png]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
[external image: jv4nhMJ.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
[external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
[external image: DgW1XL2.png]Secunia PSI will scan your computer for vulnerable softwarethat is outdated, and automatically find the latest update for you.
[external image: j1OLIec.png]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
[external image: sHjS79L.png]Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.
[external image: JEP5iWI.png]Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.
Want to help others? Join the ClassRoomand learn how.
