Search the Community

Please help me decrypting my files. My external harddrives are also infected. What should I do??! Please help! Thank you so much! Addition.txt FRST.txt scan_190228-235252.txt

Idlebuddy virus and when i tried to uninstall thru EMSIsoft it says theres a high risk of crashing the computer because these viruses are imbedded deeply

I scanned my computer, but can not quarantine or delete idling buddy services, Please help! Thank You Emsisoft Anti-Malware - Version 2019.2n settings: Scan type: Malware Scan Objects: Rootkits, Memory, Traces, Files Detect PUPs: On Scan archives: Off Scan mail archives: Off ADS Scan: On File extension filter: Off Direct disk access: Off Scan start: 3/3/2019 10:48:14 PM C:\Program Files (x86)\IdlingBuddy\IdlingBuddyService.exe Application.CoinMiner (A) [296887] Scanned 80284 Found 1 Scan end: 3/3/2019 10:50:14 PM Scan time: 0:02:00

Win 10 1809. Beta update installed ok. Not keen at all on the collapsible Settings part of the GUI which is like that every time you reboot. Why have you done that??

hi i have contacted in the past as well for this persistent infection in my windows 10 and windows 7 pc i dont remember the last login so created this new one. i have seen that this virus malware etc comes when i connect to internet, even if i have installed alll known antiviruses. only outpost firewall detects it saying unsigned kernel mode driver is about to beinstalled i chose to deny but system still gets infected some how. here is how other antiviruses react to it. kaspersky- protection gets disabled altogether. usb scanner does not detect any thing malwarebytes- protection gets disabled, and even the chamleon is not able to get it working again. norton does not detect anything emsisoft detected download manager trying to download some malware with the original file being downloaded simultaneously. eset secuirty just gets ddisabled . tried all usb scanners as well avast avira kaspersky norton nothing found. tried rootkit scanners as well nothing found. the issue came on win 10 so formatted and installed win 7 but same issue on it as well. system becomes use less either the internet will not connect or if connected system cpu usage will be 100%. so installed ubuntu dual boot with windows and run the windows 7 in vmware in it. even on clean install in vmware it gets infected as the sytem goes online with any of the combinations of antivirus and firewalls (outpost or tinywall or comodo) All windows 7 and 10 systems were fully updated. Some one suggested that it is a network malware. Also some one stole my 50GB data when i was using my previous ISP. they did not do anything asked them to provide details of what was downlaoded they never reverted back so switched ISP. emsisoft is somehow not disabled but it does not detect anything either, i have now spyshelter, osarmor and voodoshield , tinywall no one detects anything or stops kernel mode driver install or from getting infected. when i check my ip in browser it one times said DOD united states. i checked it is department of defense usa?? am i part of some bot network? or has some one hijacked my ip i dont know. now i have to use snapshots in vmware machine as i go online it gets infected and i revert back to snapshot to get it working again. Also the vmware tools show error when it gets infected saying vmware tools are not installed. i ran sigverif in windows+r and it does not detect any unsigned driver. I think i have rootkit which comes from internet every time i connect even on a clean install pc. and then it some how by passes all the firewalls and downloads more malware which are undetected and make system unusable, taskmanager antivrius says you dont have access or file not found etc when run. Also when i log into gmail it says logged in from 1 more location that has same ip and browser as mine. this is my past post i have been using vmware since then and use trial version of every antivirus available. but no one stops or detects anything. pls help,

Gen:Variant.Graftor.Elzob.192 c;\windows\syswow64\msi.dll jak to naprawic

Hello, hoping someone has some knowledge to impart on me. I have an external drive WD mybook, probably 4 or 5 years old. I've had it plugged into my pc the entire time never on any other machine. last night I tried to view some old pictures and videos and I had a prompt tell me I don't have permission to access the files. Also, prompted me to access the account settings to make changes. as far as I can see all the users listed have full access to everything, so there is nothing to adjust. I do see that an odd account is listed - Account Unknown S-1-5-21... I ran bitdefender to scan the hard drive and it does so, however comes back with a long list of password protected files it could not scan. I never used a password to protect any files which makes me believe there may be an infection that caused this. I can manually find some of the password protected files and I can delete them but there are also a few that I can not delete because, again I do not have permission. from the same password protected files that could not be scanned, there are files, such as ($Recycle.bin-S-1-5-21...) that I can not track down at all. I went on the remove the hard drive from my pc and plugged it into a MacBook, to my surprise I was able to view all of the same pictures and videos the PC would not give me access to so I don' think the hard drive itself has any issues. I feel like something has dug into my pc and hidden itself in these password protected files.

MY Windows PC has also get infected as the screen of the system has turned blue and the system is not booting after restarting. It is showing ERROR CODE 0XC0000428 in the interface and I really do not know how would I fix that.

My computer (desktop) has been infected for quite some time. After one of Microsoft Wndows 10 updates that turned off all my protection the machine got infected. That was close to 2 years ago. I have been working on getting rid of the many infections manually and with a few killers. I recently ran across EEK and us4ed it and I used FRST as outlined in hopes this will finally get my desktop back in action. When fully infected I could not run anything. After I did some cleaning I was able to get into safe mode. but the infections would not allow me to change anything, delete or remove any files it presented me with an error box stating that I did not have permission to do that or when I attempted to run various malware and virus killers or start any anti-virus program. It stated it was already running. I am hoping that you can assist me in remedying my situation at hand with my desktop. I have attached the reports from EEK and FRST as outlined. I thank you in advance for your assistance. Addition.txt FRST.txt scan_190130-155741.txt

Windows 8.1, 64 bit The beta correctly identifies that I don't as yet have the browser security extension installed on my default browser (which is Firefox), but I have to go looking in Settings to see that. I still don't get a warning (when I start Firefox) saying that the extension is not installed there - should that still happen? I do (still) get the warning when I start Chrome.

Upon attempting to quarantine 4 suspicious files found during a scan, I got a message stating: "Removing these items bears an unusually high risk of crashing your operating system during automatic cleaning, as these threats are embedded deeply. The malware removal experts at the Emsisoft Support will guide you through a safe removal of these threats." Accordingly, I am attaching the requested log files as per the forum posting instructions, and await your instructions. scan_190124-135355.txt Addition_24-01-2019 14.11.35.txt FRST_24-01-2019 14.11.35.txt

I'm on Windows 10 64-bit, version 1809 (OS Build 17763.292) the latest update January 22, 2019 I've had Emsisoft installed for some time and I haven't had any issues so far with infection. CPU usage is normal, when I do do anyting it's 1 to 4 %, when I start up a browser it goes to 8-11 %. Nothing out of the ordinary. I've started monitoring my network traffic recently and I noticed that Windows Host processes represented by svchost and their assocciated Windows processes conneting to these IP addresses. I didn't monitor my network before. Maybe these connections always were there. I don't know. Is this normal behavior for Windows 10 nowadays? I thought Windows host processes like Cryptographic service or Diagnostic Policy service must connect only to Microsoft IP addressess but why Google MSI Verizon and Cloudflare? I don't get it. They don't run very often, just occaionally pop up for a few second once a day, and quicly stop. Maybe I became a bot or something? I think Emsisoft would pick it up already External IP PID 216.58.209.35:80 Google LLC USA 4276 CryptSvc 93.184.220.29:80 MSI Communications UK 4276 CryptSvc 104.16.95.121:80 Cloudflare Inc USA 4276 CryptSvs 172.217.17.67:80 Google LLC US 4276 CryptSvc 93.184.221.240:80 MSI Communications UK 4276 CryptSvc 216.58.209.131:80 Google LLC US 4140 DPS

Hello, recently i have noticed a slowdown in my machine, could you please take a look. FRST.txt Addition.txt scan_190128-024733.txt

Win 10 1809... EAM build 9188 After you do a malware scan for example, how long on average should it take before EAM Protection Service levels come down to the level they were before the scan? For example this screenshot below is before a scan. During the scan it goes up to around 300MB but takes quite a while to release the memory.

Please see attached screenshot. I don't know how to handle this because I get the same pop up if I click on quarantine.

My HP Pavillion dv7-7135us has been freezing up lately with no warning and no visible symptoms other than I return to it after a few hours and find it frozen. The only remedy is to power down. EEK and FRST files are attached. I tried to scrupulously follow the instructions. EEK did not display the same choices as the instructions, but I tried to get a clean scan, without changing any parameters after the sw updated itself. FRST showed no anomalies on operation. Addition.txt FRST.txt a2scan_190112-100254.txt

I have uninstalled this program several times and it always returns. I understand that it prob is not malware, but I already have Emsisoft so I don't need another trying to get my attention. It was installed without my permission, and I don't see how it could have piggy backed on anything because I have not installed any new programs lately. It does not have an uninstall option on its menu. I have tried remove using the Windows 10 App/uninstall. Can someone help please?

So is this error which shows in Event Viewer after each EAM update Microsoft's fault? https://answers.microsoft.com/en-us/windows/forum/all/event-id-17-security-center-failed-to-validate/1fe0f4d7-8b4e-40a6-b607-e1895bfc7535

I ran a scan and with EK and I see 7 varieties of threats, but I can't remove with either delete or quarantine? Help Here is my log file. scan_190109-092825.txt

Win 10 build 9144. As part of some troubleshooting I uninstalled 9144 and selected for EAM to remove the everything option. It leaves a Program Folder in C drive with quarantine in it. Surely if I select to remove everything (all folders etc) it should do just that?

I'm on the Beta feed. EAM just 'updated' but it's installed 2018.11.0.9073 when before that I was running 2018.12.1.9144. Why? See logs screenshot at: https://www.dropbox.com/s/lo685jpbogs0ce6/20190107 EAM update that isn't.jpg?dl=0

I just can't find/get rid of this software (Go.MennyThanks, or AAMennyThanks)), that was secretly installed on my computer. I'd prefer not having to buy more malware software. Can anyone help me? Thanks. Bob

https://malwaretips.com/threads/emsisoft-browser-security.88869/ Pity it wasn't posted here as well.

I wish you and you beloved ones and family a Merry Christmas, have a peaceful and happy time. Cheers

Win 10 1809. Auto update went through okay. No issues so far. I see on the main page of the GUI it's already 2019 !!