(Aug 2, 2019 08:11 AM)Yseurk Wrote:  Seems that a program is executed at the boot of you Windows, can you take a look over there ?

> Type Windows + R
> Type taskmgr
> Go to Startup tab

Post a screen of the list of the programs executed at start

(Aug 2, 2019 08:52 AM)c00lkid66 Wrote:  https://i.imgur.com/96tX11R.png

I don't see anything

(Aug 2, 2019 08:58 AM)Yseurk Wrote:  Can you try this ?

https://www.winhelponline.com/blog/cannot-find-script-run-vbs-logon/

(Aug 2, 2019 09:21 AM)c00lkid66 Wrote:  Just tried and my Userinit is fine. I've also searched for both "Agent.vbs" and "exploitpack.vbs" in the registry and recieved no results

(Aug 2, 2019 09:40 AM)Yseurk Wrote:  Have you run some anti-malware or anti-virus ? Maybe they could help and clean your computer ?

A program is probably calling the script, have you anything weird installed on your computer ? Can you see something in the program's list ?

> Push Windows Key + R
> Type "appwiz.cpl"
> Hit the Enter button

(Aug 2, 2019 10:45 AM)Aura Wrote:  According to the script, there's a Run entry there.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

• Download the right version of FRST for your system:
  • FRST 32-bit
    
  
  
  • FRST 64-bit
    Note: Only the right version will run on your system, the other will throw an error message. So if you don't know what your system's version is, simply download both of them, and the one that works is the one you should be using.
    
  
  
  
  


• Move the executable (FRST.exe or FRST64.exe) on your Desktop
  


• Right-click on the executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds
  


• Make sure the Addition.txt box is checked
  


• Click on the Scan button
  
  


• On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files
  


• Copy and paste the content of both FRST.txt and Addition.txt in your next reply
  

(Aug 2, 2019 02:58 PM)Aura Wrote:  Okay cause in your 1st post you said that you removed it from HKCU, not HKLM.

Farbar Recovery Scan Tool (FRST) - Scan mode
Follow the instructions below to download and execute a scan on your system with FRST, and provide the logs in your next reply.

• Download the right version of FRST for your system:
  • FRST 32-bit
    
  
  
  • FRST 64-bit
    Note: Only the right version will run on your system, the other will throw an error message. So if you don't know what your system's version is, simply download both of them, and the one that works is the one you should be using.
    
  
  
  
  


• Move the executable (FRST.exe or FRST64.exe) on your Desktop
  


• Right-click on the executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds
  


• Make sure the Addition.txt box is checked
  


• Click on the Scan button
  
  


• On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files
  


• Copy and paste the content of both FRST.txt and Addition.txt in your next reply
  

(Aug 3, 2019 08:41 AM)Yseurk Wrote:  Seems there is a scheduled task here :

Task: {061C0EDD-9B50-4EEC-B328-1AEDBE829749} - System32\Tasks\Exploit Pack - Agent => C:\Users\noah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exploitpack.vbs (which is trying to execute the vbs, which one you deleted)

By the way there is the following, not sure this tool is legit :

(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\pcdrwi.exe

Can you confirm that master Aura ?  😊

(Aug 3, 2019 03:21 PM)c00lkid66 Wrote:  Thanks, that fixed it :)