My pc was infected and I can't get rid of it.

Detected: Virtool:win32/DefenderTamperingRestore

Affected:
regkeyvalue: hklm\software\microsoft\windowsdefender\\DisableAntiSpyware

I've tried running msert 3 times restarted and ran it again then tried windows defender and still didn't work. After getting this my steam acc was temp taken but i got that bavk and my amazon account was almost used to buy something for the hacker. Please help me.

Greetings and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

Please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

• Download Farbar Recover Scan Tool for 64 bit systems and note where the file is saved (Desktop, Downloads, etc.) <<< Important
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of each report in separate reply windows

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• FRST.txt
• Addition.txt

Also thank you very much for volunteering your time Gary you're very much appreciated.

Edited by Jarbon, 26 February 2024 - 12:10 PM.

Greetings.

My pleasure to work together on this.

Let's start with this.

===================================================

Uninstalling Programs Using Revo Uninstaller Free Portable

--------------------

• Download Revo Uninstaller Free Portable and save it to your Desktop
• Right click on the folder and select Extract All..., then click Extract
• Double click on the RevoUninstaller-Portable folder
• Right click on RevoUPort and select Run as administrator
• Click OK on the License Agreement
• From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)

WeatherZero
WebAdvisor by McAfee

• If the program's uninstaller appears work through the steps to remove the program(s)
• Be sure the Advanced option is selected then click Scan
• For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
• Once done click Finish
• Reboot your computer

===================================================

Modifying Chrome Notification Settings

--------------------

• Launch Chrome. If you can't, skip this step.
• Copy and paste the below in the address bar then hit Enter

chrome://settings/content/notifications?search=notification

• Under Allow examine each entry and for any entry not recognized or not wanted click on the 2 horizontal dots to the right and select Block
• Confirm the entry was moved under the Block section
• Close Chrome

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
Folder: C:\Users\Owner\AppData\Roaming\CloudPatchv2
Folder: C:\Users\Owner\AppData\Roaming\shpafact
Folder: C:\Users\Owner\AppData\Local\d90-updater
Folder: C:\Program Files (x86)\CompanyCusucy
C:\Program Files (x86)\Google\GoogleUpdater
C:\WINDOWS\system32\Tasks\GoogleSystem
C:\Users\Owner\AppData\Roaming\CloudPatchv2
C:\Users\Owner\AppData\Roaming\shpafact
C:\Users\Owner\AppData\Local\d90-updater
C:\Program Files (x86)\CompanyCusucy
S3 rsDwf; \SystemRoot\system32\DRIVERS\rsDwf.sys [X] 
Task: {101C1F7B-4B5F-4986-B674-0D894D46A833} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\Users\Owner\Desktop\MSERT.exe /EHB /HeartbeatFailure "SubmitHeartbeatReportData" /HeartbeatError "0x80072ee7" (No File) 
CustomCLSID: HKU\S-1-5-21-235486974-3183418840-3710584001-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File 
CustomCLSID: HKU\S-1-5-21-235486974-3183418840-3710584001-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File 
CustomCLSID: HKU\S-1-5-21-235486974-3183418840-3710584001-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File 
CustomCLSID: HKU\S-1-5-21-235486974-3183418840-3710584001-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\amd64\FileSyncShell64.dll => No File 
CustomCLSID: HKU\S-1-5-21-235486974-3183418840-3710584001-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\Owner\AppData\Local\Microsoft\OneDrive\19.103.0527.0003\FileCoAuth.exe => No File 
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File 
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File 
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File 
ContextMenuHandlers1-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll -> No File 
ContextMenuHandlers4-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll -> No File 
ContextMenuHandlers6-x32: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files (x86)\7-Zip\7-zip.dll -> No File 
Task: {16B04F6E-7304-4D08-8B8E-9548E23DC188} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem124.0.6315.0{848D39A6-1088-4E0C-A920-88F1138400DB} => C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
S2 GoogleUpdaterInternalService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
S2 GoogleUpdaterService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [2594] 
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [2594] 
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [2594] 
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk:F20EF51E1F [2594] 
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk:FBFC89DD04 [2594] 
cmd: netsh winsock reset catalog
cmd: netsh int ip reset resetlog.txt
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Emptytemp:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
• Note: The Emptytemp: command will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Programs uninstalled?
• Chrome Notifications reviewed?
• Fixlog

I successfully uninstalled zeroweather and webadvisor

 

I now have no apps allowed to send notifications on chrome

 

here is my fixlog

 

Thank you, that looks good.

Please run a Windows Defender scan rather than MSERT and let me know the results.

After running the full scan it seems to still be active and severe but now there are 2 more notifications of the same threat. Windows defender says it skipped them usually and it also left 2 more notices of remediation incomplete for the same threat.

Please run this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
Powershell: Get-MpThreatDetection
Folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlist

Thank you.

Please do this.

===================================================

Farbar Recovery Scan Tool Fix - Safe Mode Command Prompt with Attached File

--------------------

• If necessary, download Farbar Recover Scan Tool for 64 bit systems and save it to a USB device
• Download  Fixlist.txt   3.18KB   5 downloads and save it in the same USB device
• Insert the USB device into your compromised computer
• Holding down the Shift Key click Start, click the power icon, then select Reboot
• Click Troubleshoot
• Click Advanced options
• Click Startup Settings
• Click Restart
• Select 6) Enable Safe Mode with Command Prompt
• In the command window type in Notepad and press Enter.
• Under File menu select Open
• Select This PC and double click on your USB drive letter
• Next to Files of type: select All Files
• Right click on the FRST icon and select Run as administrator
• Click Yes to disclaimer that may appear
• Press Fix button
• Reboot your computer into Normal Boot
• A fixlog.txt file will be saved on the USB drive. Please copy and paste it to your reply. If the report is too large attach it
• Following reboot run a Windows Defender scan and check for detections

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Windows Defender?

After running windows defender following the reboot It now only detects 2 instances of the same virus and nothing else.

Fix result of Farbar Recovery Scan Tool (x64) Version: 26.02.2024 01
Ran by Owner (27-02-2024 13:00:16) Run:3
Running from F:\FRST64bit
Loaded Profiles: Owner
Boot Mode: Safe Mode (minimal)
==============================================

fixlist content:
*****************
StartRegedit:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000000

EndRegedit:

ExportKey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

C:\Program Files (x86)\CompanyCusucy

Powershell: Set-MpPreference -EnableControlledFolderAccess Disabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $true
cmd: del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log"
cmd: del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log"
cmd: del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log"
cmd: del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db"
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\16F8DA0B-BCA5-4ACF-86F3-84AAE74A2749
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\C03A7E9B-EFDA-4D88-938F-08175D04B91D
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\082E99B9-F5CF-462C-8ED9-8E405AA5AC0B
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\16BAE96F-43CB-4D0D-BDCC-DEF9F6D54429
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\3A684C3E-69E9-4BED-A603-F21A43D08555
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\B1C186A1-F172-46F2-A1F8-BED7358AD7BA
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\0AF75C1A-DB75-43BE-BC78-69391B669E75
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\4A5C7DB5-9E50-4162-9462-DFDB97797F6F
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\D8AC1739-2063-43AB-912F-27DDEEC993EE
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\A29AF616-2CA6-4E32-B64E-66D9A0F8F89E
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\1B56A45C-AA4A-400E-AD8E-FAF675CC7DF2
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\5D4205A1-3D20-474F-B005-E1D6A1B5F108
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\93B3D837-7C76-4195-8F3A-5195045ADB7A
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\FA9BAB0A-BECF-4153-BBF5-9ABC1EBB50AC
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\618002BF-0CE8-4234-B82B-B16391D7AD78
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\590B8A6D-4214-479A-B9E7-C4372EA106D6
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\06E24A63-F254-47A9-97DF-D53F59D832A4
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\26982392-8E9F-4E81-98A2-05D5BC895F90
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\AAA7F2C6-3B07-46FB-B719-1886D67418FD
Powershell: Set-MpPreference -EnableControlledFolderAccess Enabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $false
Powershell: Get-MpThreatDetection
Reboot:
*****************

Registry ====> The operation completed successfully.
================== ExportKey: ===================

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"="0"
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager]

=== End of ExportKey ===
"C:\Program Files (x86)\CompanyCusucy" => not found

========= Set-MpPreference -EnableControlledFolderAccess Disabled =========


========= End of Powershell: =========


========= Set-MpPreference -DisableRealtimeMonitoring $true =========


========= End of Powershell: =========


========= del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log" =========

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log


========= End of CMD: =========


========= del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log" =========

Deleted file - C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log


========= End of CMD: =========


========= del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log" =========

Deleted file - C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log


========= End of CMD: =========


========= del /f /s /q "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" =========

C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db


========= End of CMD: =========

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\16F8DA0B-BCA5-4ACF-86F3-84AAE74A2749 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\00\C03A7E9B-EFDA-4D88-938F-08175D04B91D => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\082E99B9-F5CF-462C-8ED9-8E405AA5AC0B => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\16BAE96F-43CB-4D0D-BDCC-DEF9F6D54429 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\05\3A684C3E-69E9-4BED-A603-F21A43D08555 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\08\B1C186A1-F172-46F2-A1F8-BED7358AD7BA => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\0AF75C1A-DB75-43BE-BC78-69391B669E75 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\10\4A5C7DB5-9E50-4162-9462-DFDB97797F6F => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\11\D8AC1739-2063-43AB-912F-27DDEEC993EE => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\12\A29AF616-2CA6-4E32-B64E-66D9A0F8F89E => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\1B56A45C-AA4A-400E-AD8E-FAF675CC7DF2 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\5D4205A1-3D20-474F-B005-E1D6A1B5F108 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\14\93B3D837-7C76-4195-8F3A-5195045ADB7A => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\15\FA9BAB0A-BECF-4153-BBF5-9ABC1EBB50AC => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\16\618002BF-0CE8-4234-B82B-B16391D7AD78 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\17\590B8A6D-4214-479A-B9E7-C4372EA106D6 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\18\06E24A63-F254-47A9-97DF-D53F59D832A4 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\26982392-8E9F-4E81-98A2-05D5BC895F90 => moved successfully
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory\22\AAA7F2C6-3B07-46FB-B719-1886D67418FD => moved successfully

========= Set-MpPreference -EnableControlledFolderAccess Enabled =========


========= End of Powershell: =========


========= Set-MpPreference -DisableRealtimeMonitoring $false =========


========= End of Powershell: =========


========= Get-MpThreatDetection =========



ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.23110.3
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {D9B18A59-E606-4EAB-BFAA-B991C3920CB3}
DetectionSourceTypeID : 2
DomainUser :
InitialDetectionTime : 2/26/2024 5:53:33 AM
LastThreatStatusChangeTime : 2/26/2024 5:53:33 AM
ProcessName : Unknown
RemediationTime :
Resources : {regkeyvalue:_hklm\software\microsoft\windows defender\\DisableAntiSpyware}
ThreatID : 2147741622
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :




========= End of Powershell: =========



The system needed a reboot.

==== End of Fixlog 13:00:24 ====

Edited by Oh My!, 27 February 2024 - 10:23 PM.

Also, if it matters, I installed frst64bit onto the USB using the infected pc. I can ask my roommate to use their pc to try again if that is a no no.

The Fixlist worked so no need to run it again.

Please do this.

===================================================

Farbar Recovery Scan Tool Fix - Safe Mode Command Prompt with Attached File

--------------------

• If necessary, download Farbar Recover Scan Tool for 64 bit systems and save it to a USB device
• Download  Fixlist.txt   436bytes   4 downloads and save it in the same USB device
• Insert the USB device into your compromised computer
• Holding down the Shift Key click Start, click the power icon, then select Reboot
• Click Troubleshoot
• Click Advanced options
• Click Startup Settings
• Click Restart
• Select 6) Enable Safe Mode with Command Prompt
• In the command window type in Notepad and press Enter.
• Under File menu select Open
• Select This PC and double click on your USB drive letter
• Next to Files of type: select All Files
• Right click on the FRST icon and select Run as administrator
• Click Yes to disclaimer that may appear
• Press Fix button
• Reboot your computer into Normal Boot
• A fixlog.txt file will be saved on the USB drive. Please copy and paste it to your reply. If the report is too large attach it
• Following reboot run a Windows Defender scan and check for detections

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Windows Defender?

Windows Defender shows 2 instances of remediation incomplete and 4 more instances of the virus.