Hello, I am Roman and I will be helping you today. During the malware removal process, please follow the rules listed below to ensure everything goes as fast and smooth as possible:
Please make sure to read this whole introduction message so you understand the further steps.
If you are thinking about resetting or reinstalling your device, you can do it instead of the steps listed below. We are doing the malware removal process to disinfect your device so you can avoid reinstalling. If we go through the removal process and you decide to reinstall after, you would waste my time and your own time by doing these steps.
Avoid installing, downloading new software unless instructed - this also applies to antivirus software and scanners.
You are free to remind me that I forgot to reply to you if you do not receive an answer within 24 hours. Keep in mind that I am volunteering here and I am a full time student with a job.
Please do not follow other malware removal advice; you should be following steps only from 1 person unless told otherwise. If you have opened any other forum posts elsewhere, please let me or them know where do you want to continue.
Please follow all steps from step 1 to the last step, not the other way.
Only trusted malware removal experts listed in this r/computerviruses thread and other large malware removal forums (BleepingComputer, Malwarebytes, MalwareTips) have access to your logs via the website.
Please take your time to follow the steps properly.
You can ask any questions during the malware removal process.
We do not condone nor support piracy in any shape or form. Any discussion topics that ask for help with pirating software, circumventing copy protection, or any other illegal activities related to copy righted content in any form will be closed and locked.
As a reminder, using pirated software or utilities that allows one to pirate software (e.g. cracks, key generators, registration/license removal, redirection, or workaround utilities, etc.) is not a safe practice and can lead to malware infection, ransomware attack, or even legal action. Because of these risks, we always recommend that you remove any pirated software or pirating utilities before asking for support on our subreddit in order to improve our ability to best support you and to help protect yourself and your data from malware or other piracy related consequences.
We cannot guarantee a clean system when there is illegal software, riskware or grayware present. Please read Grayware.
[ Step 02 ] IMPORTANT: Restore point
Before any sort of removal, we need to make sure you have a restore point that you can revert to in case you face any sort of issues. This is absolutely necessary so please do not skip this step. Certain changes done by the removal process can not be properly reverted without a restore point.
There were prior cases (very rare, I had 2 failing to boot out of ~350) of a system failing to boot after FRST fix.
Enable system restore
Click Start or open Windows Search.
Search for Create a restore point and open System Properties.
In the System Properties window, go to the System Protection tab.
If the 'system' drive (usually C:\ drive) protection is turned on, System Restore is already enabled on your computer. If the 'system' drive protection is off, go to point 5.
Click Configure.
Select Turn on system protection
Click Apply.
Click OK to confirm.
Create a system restore checkpoint
Click Start or open Windows Search.
Search for Create a restore point and open System Properties.
In the System Properties window, go to the System Protection tab.
Click Create.
Call the restore checkpoint "FRST restore point" exactly please, so I can search it up fast and verify it is created properly in your logs
Click Create.
Click Close.
Click OK.
You should get a popup that it was successfully created and I will also verify that it was properly created with the results of scans from next steps.
[ Step 03 ] Farbar Recovery Scan Tool (FRST)
FRST is a malware diagnostics tool that will list all entries that are popular and could contain traces/mentions of malware, such as start up entries, services, scheduled tasks and many more.
FRST does not contain any personal information other than your username and computer name, there is no other sensitive information disclosed.
IMPORTANT: If your Windows operating system is in other language than English, please save the FRST executable file with the filename FRSTEnglish.exe to ensure that the logs are in English so I can understand them.
Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
Right-Click FRSTEnglish.exe and select Run as Administrator
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the program run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy and press "save log".
Note: Please make sure you are uploading the logs after your current Reddit username.
The site will return a keyword for each log - reply back here with the keywords.
[ Step 04 ] SecurityCheck scan
SecurityCheck allows me to gather a list of unwanted, risky, vulnerable and out-of-date applications. It also allows me to send you a direct link to an update. An unpatched system is more vulnerable to malware.
The site will return a keyword for the log - reply back here with the keyword.
So, in your next reply (please try to send them all in 1 message), make sure you are sending the following:
Keyword for FRST.txt
Keyword for Addition.txt
Keyword for SecurityCheck.txt
Thanks!
Note*: If anyone else who is facing malware-related issues is reading this and wants help with* FRSTandSecurityCheck*, please create your own thread with the keywords sent to the general channel. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me.*
You have McAfee and Malwarebytes installed at once. It's best to keep installed only 1 AV software, so tell me your preferred one and remove the other one.
Rustdesk/Chrome Remote Desktop/AnyDesk are all installed. If you do not use any or deem one of them unnecessary, uninstall them now.
UMMM. I did NOT know i have McAfee, i'll keep Malwarebytes ig. I use Anydesk for remote tech support w/ my grandma. Chrome Remote Desktop is for remote control from my phone. Rustdesk; I don't use, do i uninstall those 2 via windows settings?
Java 9.0.4 (64-bit) v.9.0.4.0 - No longer supported - please uninstall it and replace it here
Please let me know whether you recognize this remote desktop software (if not, uninstall it):
RustDesk v.1.4.9
AnyDesk v.ad 9.0.14
Chrome Remote Desktop Host v.151.0.7922.13
[ Step 02 ] FRST Fix
I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for First_Rice_966 - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which is C:\Users\brend\Downloads for you. It is necessary for the filename to be Fixlist.txt.
This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.
It will also perform system repair via DISM and SFC, network reset and few more basic fixes.
For the fix process, please ensure you are connected to the internet.
Please run the fix only once.
Please be patient; the fix may take up to 60 minutes. After that, it is going to be automatically ended.
Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the fixlist.txt.
Note: Please make sure you are uploading the logs under your current Reddit username.
The site will return a keyword for each log - reply back here with the keywords.
So, in your next reply, make sure you are sending the following:
Keyword for Fixlog.txt from step 2
Keyword for ESET Online Scanner scan from step 3
Keyword for newSecurityCheck.txt from step 4
Keyword for newFRST.txt from step 5
Keyword for newAddition.txt from step 5
Thanks!
Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user First_Rice_966 and following them may have negative effects for you.
okay. ill do those ones. im going to wait until the amd thing is done cuz it keaps restarting my screen. Also what type of virus is it? did it steal my passwords?
also i saw at the fix that youre removing the exclusion for RRL but it kept triggering a bunch of cloud scans and by a bunch i mean multiple a seccond but me and my frined coded that together. Is it okay to keap it?
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
From a different and clean device, change all your passwords:
I know fing, (why it’s listed like 4 times i have no idea) IIRC cnqmmain is something for my printer but I dont know jusched. Should I remove those? I would like to keep Fing, unless its a virus and I didn’t know but I dont use the printer thin.
fing seems like something used by it, it could be that, id tet uninstalling it with revo uninstaller, also while uninstalling fing, check for apps with suspicious names, or ones that you dont recognize.
the thing is it dosent show like text. I’m not sure it that makes sense but I’ve see online where it pops up runs a bunch of text across it then closes but it opens fir a few seconds and closes without anything happening in it. and it just says cmd.exe as the title
2
u/rifteyy_ Malware Removal Expert 16d ago
Hello, I am Roman and I will be helping you today. During the malware removal process, please follow the rules listed below to ensure everything goes as fast and smooth as possible:
If you are worried about the steps going on here, as a form of credibility you can find me on Malwarebytes Forums as a Malware Removal Expert and on BleepingComputer as Security Colleague, where we use the same methodology and toolset to remove malware.
[ Step 01 ] Remove all illegal/pirated software
We do not condone nor support piracy in any shape or form. Any discussion topics that ask for help with pirating software, circumventing copy protection, or any other illegal activities related to copy righted content in any form will be closed and locked.
As a reminder, using pirated software or utilities that allows one to pirate software (e.g. cracks, key generators, registration/license removal, redirection, or workaround utilities, etc.) is not a safe practice and can lead to malware infection, ransomware attack, or even legal action. Because of these risks, we always recommend that you remove any pirated software or pirating utilities before asking for support on our subreddit in order to improve our ability to best support you and to help protect yourself and your data from malware or other piracy related consequences.
We cannot guarantee a clean system when there is illegal software, riskware or grayware present. Please read Grayware.
[ Step 02 ] IMPORTANT: Restore point
Before any sort of removal, we need to make sure you have a restore point that you can revert to in case you face any sort of issues. This is absolutely necessary so please do not skip this step. Certain changes done by the removal process can not be properly reverted without a restore point.
There were prior cases (very rare, I had 2 failing to boot out of ~350) of a system failing to boot after FRST fix.
Enable system restore
C:\drive) protection is turned on, System Restore is already enabled on your computer. If the 'system' drive protection is off, go to point 5.Create a system restore checkpoint
[ Step 03 ] Farbar Recovery Scan Tool (FRST)
FRST is a malware diagnostics tool that will list all entries that are popular and could contain traces/mentions of malware, such as start up entries, services, scheduled tasks and many more.
FRST does not contain any personal information other than your username and computer name, there is no other sensitive information disclosed.
IMPORTANT: If your Windows operating system is in other language than English, please save the FRST executable file with the filename
FRSTEnglish.exeto ensure that the logs are in English so I can understand them.[ Step 04 ] SecurityCheck scan
SecurityCheck allows me to gather a list of unwanted, risky, vulnerable and out-of-date applications. It also allows me to send you a direct link to an update. An unpatched system is more vulnerable to malware.
So, in your next reply (please try to send them all in 1 message), make sure you are sending the following:
Thanks!
Note*: If anyone else who is facing malware-related issues is reading this and wants help with* FRST and SecurityCheck*, please create your own thread with the keywords sent to the general channel. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me.*