This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

'Harmless' email received, computer messed up but cleared.

87 min read

This thread's last reply is from February 27, 2020, 1:45 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

A. No problems, save the ESET scanner not wanting to start. Third time was the charm, it finally got itself going; results below.
C. No readily-apparent changes to computer behavior, but not sure what ESET quarantine/removal did and how it will affect things. I'll keep an eye out.
B. Scan results:

2/26/2020 12:14:10 PM
Files scanned: 298274
Detected files: 4
Cleaned files: 4
Total scan time 01:29:31
Scan status: Finished
C:\Users\Lab\Documents\Downloaded Program Files\dntp-ie-54.exe a variant of Win32/Toolbar.Besttoolbars.J potentially unwanted application cleaned by deleting

C:\Users\Lab\Documents\Spyware Fixes\SDFix.exe Win32/PrcView potentially unsafe application deleted

C:\Users\Lab\Downloads\setupSkypeLiteClient.exe Win32/DownWare.W potentially unwanted application cleaned by deleting

Autostart locations a variant of Win32/Toolbar.Besttoolbars.J potentially unwanted application,Win32/PrcView potentially unsafe application deleted
Hi Electrojim,

KpRm Cleanup
  1. Please download KpRm by kernel-panik and save it to your Desktop
  2. Right-click kprm_(version).exe and select Run as Administrator
  3. When the tool opens, ensure all boxes are checked, and select Run
  4. Once complete, click OK.
  5. A log will open in Notepad titled kprm-(date).txt.
  6. Please copy and paste its contents into your next reply


Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....

Please include in your next reply:
  1. Do you have any problems executing the instructions?
  2. Contents of the kprm-(date).txt log file
  3. Do you see any changes in computer behavior?


Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed
Done. Completed quickly, no immediate changes in behavior noticed. Here's the Log File:

# Run at 2/26/2020 3:10:27 PM
# KpRm (Kernel-panik) version 2.7
# Website https://kernel-panik.me/tool/kprm/
# Run by [removed]
# Computer Name: WINDOWS-9C6P0DA
# OS: Windows 10 X64 (18363)
# Number of passes: 1

- Checked options -

~ Registry Backup
~ Delete Tools
~ Restore System Settings
~ UAC Restore
~ Delete Restore Points
~ Create Restore Point
~ Delete Quarantines

- Create Registry Backup -

~ [OK] Hive C:\WINDOWS\System32\config\SOFTWARE backed up
~ [OK] Hive C:\Users\Lab\NTUSER.dat backed up

[OK] Registry Backup: C:\KPRM\backup\2020-02-26-15-10-26

- Delete Tools -


## AdwCleaner
[OK] C:\Users\Lab\Desktop\Malware Check\AdwCleaner.exe deleted
[OK] C:\AdwCleaner deleted

## CKScanner
[OK] C:\Users\Lab\Desktop\Malware Check\ckfiles.txt deleted
[OK] C:\Users\Lab\Desktop\Malware Check\CKScanner.exe deleted

## ESET Online Scanner
[OK] Process esetonlinescanner_enu.exe killed
[OK] C:\Users\Lab\Desktop\ESET Online Scanner.lnk deleted
[OK] C:\Users\Lab\Desktop\Malware Check\esetonlinescanner_enu.exe deleted
[OK] C:\Users\Lab\AppData\Local\ESET\ESETOnlineScanner deleted

## FRST
[OK] C:\Users\Lab\Desktop\NASA Temp\Addition.txt deleted
[OK] C:\Users\Lab\Desktop\NASA Temp\FRST.txt deleted
[OK] C:\Users\Lab\Desktop\Malware Check\Addition.txt deleted
[OK] C:\Users\Lab\Desktop\Malware Check\Fixlog.txt deleted
[OK] C:\Users\Lab\Desktop\Malware Check\FRST-OlderVersion deleted
[OK] C:\Users\Lab\Desktop\Malware Check\FRST.txt deleted
[OK] C:\Users\Lab\Desktop\Malware Check\FRST64.exe deleted
[OK] C:\FRST deleted

- Restore System Settings -

[OK] Reset WinSock
[OK] FLUSHDNS
[OK] Hide Hidden file.
[OK] Show Extensions for known file types
[OK] Hide protected operating system files

- Restore UAC -

[OK] Set EnableLUA with default (1) value
[OK] Set ConsentPromptBehaviorAdmin with default (5) value
[OK] Set ConsentPromptBehaviorUser with default (3) value
[OK] Set EnableInstallerDetection with default (0) value
[OK] Set EnableSecureUIAPaths with default (1) value
[OK] Set EnableUIADesktopToggle with default (0) value
[OK] Set EnableVirtualization with default (1) value
[OK] Set FilterAdministratorToken with default (0) value
[OK] Set PromptOnSecureDesktop with default (1) value
[OK] Set ValidateAdminCodeSignatures with default (0) value

- Clear Restore Points -

~ [OK] RP named Windows Update created at 11/15/2019 01:20:14 deleted
~ [OK] RP named Removed Macrium Reflect Free Edition created at 11/18/2019 18:03:49 deleted
~ [OK] RP named Scheduled Checkpoint created at 12/01/2019 20:48:25 deleted
~ [OK] RP named Windows Modules Installer created at 02/13/2020 21:28:30 deleted
[OK] All system restore points have been successfully deleted

- Create Restore Point -

[OK] System Restore Point created

- Display System Restore Point -

~ [I] RP named KpRm created at 02/26/2020 23:11:18

-- KPRM finished in 84.33s --
Hi Electrojim,

Your latest set of logs appear to be clean! :cheers:
This is my general post for when your logs show no more signs of malware.

  • Please don't forget to enable and update all your defense software!


Finally:
Please click HERE
to find a short guide to staying safer online.


Please don't hesitate to ask any additional questions.

Stay Safe! ;)
pgmigg
Many thanks, pgmigg, it's good to know the drill on this; I appreciate your walking me through it all and I feel confident now.
You are very welcome, Electrojim! :D

As the problems seem to be resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see
Feedback for Our Helpers - Say "Thanks" Here.