[EbonCipher]

DELTE THREAD. issue fixed

[Sigma]

Farbar Recovery Scan Tool (FRST) - Fix

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Open Notepad and copy/paste the following into notepad:
  
  
  Code

  createrestorepoint:
closeprocesses:
(RA4W VPN) C:\Users\aligs\Desktop\Orcus1.9.1\RA4WVPN Client\RA4W VPN.exe
HKLM-x32\...\Run: [] => [X]
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = hxxps://dk.search.yahoo.com/yhs/search?hspart=lvs&hsimp=yhs-awc&type=lvs__webcompa__1_0__ya__ch_WCYID10454__180106__yaie&p={searchTerms}
S2 0026081515279570mcinstcleanup; C:\Users\aligs\AppData\Local\Temp\002608~1.EXE -cleanup -nolog [X] <==== ATTENTION
S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\\McCSPServiceHost.exe" [X]
S3 cpuz143; \??\C:\Users\aligs\AppData\Local\Temp\cpuz143\cpuz143_x64.sys [X] <==== ATTENTION
S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]
2018-02-09 22:18 - 2018-02-09 22:18 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2018-02-11 01:51 - 2017-09-30 15:28 - 000827278 _____ C:\WINDOWS\system32\perfh006.dat
2018-02-11 01:51 - 2017-09-30 15:28 - 000187268 _____ C:\WINDOWS\system32\perfc006.dat
emptytemp:
  
  
  


• Save the file as fixlist.txt, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
  


• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Click on the Fix button
  
  
  
  


• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
  


• Copy and paste its content into your next reply
  

[EbonCipher]

Farbar Recovery Scan Tool (FRST) - Fix

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Open Notepad and copy/paste the following into notepad:
  
  createrestorepoint:closeprocesses:(RA4W VPN) C:\Users\aligs\Desktop\Orcus1.9.1\RA4WVPN Client\RA4W VPN.exeHKLM-x32\...\Run: [] => [X]HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTIONHKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTIONSearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1081267992-3702148984-3113272369-1001 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = hxxps://dk.search.yahoo.com/yhs/search?hspart=lvs&hsimp=yhs-awc&type=lvs__webcompa__1_0__ya__ch_WCYID10454__180106__yaie&p={searchTerms}S2 0026081515279570mcinstcleanup; C:\Users\aligs\AppData\Local\Temp\002608~1.EXE -cleanup -nolog [X] <==== ATTENTIONS2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\2.5.312.0\\McCSPServiceHost.exe" [X]S3 cpuz143; \??\C:\Users\aligs\AppData\Local\Temp\cpuz143\cpuz143_x64.sys [X] <==== ATTENTIONS3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]2018-02-09 22:18 - 2018-02-09 22:18 - 000000000___H C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf2018-02-11 01:51 - 2017-09-30 15:28 - 000827278 ____ C:\WINDOWS\system32\perfh006.dat2018-02-11 01:51 - 2017-09-30 15:28 - 000187268___ C:\WINDOWS\system32\perfc006.datemptytemp:


• Save the file as fixlist.txt, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
  


• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Click on the Fix button
  
  
  
  


• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
  


• Copy and paste its content into your next reply
  

appreciate it sigma, but the pop up is still there.

here's the fixlog: https://hastebin.com/ovivumucay.tex

---

---

Now i tried to open the file, and it makes no sense. The file is called "1.4.0.1" with no extension. This is weird as fuck.

[Sigma]

Malwarebytes - Clean Mode

• Download and install the free version of Malwarebytes
  Note: If you have Malwarebytes already installed, you don't need to install it again. Simply start from the next bullet point
  


• Once Malwarebytes is installed, launch it and let it update his database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so
  


• Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan
  


• Let the scan run, the time required to complete the scan depends of your system and computer specs
  


• Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button
  • If it asks you to restart your computer to complete the removal, do so
    
  
  
  
  


• Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard. Paste the content in your next reply
  

Download the right version of RogueKiller

• 
  for your Windows version (32 or 64-bit)
  


• Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  


• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  


• Wait for the scan to complete
  


• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  


• This will open the report in Notepad. Copy/paste its content in your next reply
  

[EbonCipher]

fixed the issue! thank you sigma

[Sigma]

fixed the issue! thank you sigma

No problem, I am glad to help.