|
Post by TechArtyst on Jul 18, 2017 9:36:11 GMT -8
Hi there, I'm concerned I may have a virus. In Task Manager under Startup, there is an item called "FU" with no publisher (see attachment) and the options for "Open File Location" and "Properties" are grayed out. Have run full system scan with Avast and quick scans with Malwarebytes, Avast did find 2 things but they were unrelated, other than that found nothing. Addition txt file: wikisend.com/download/300718/Addition.txtAny help appreciated, thanks!! Attachments:
FRST.txt (51.19 KB)
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Jul 20, 2017 6:48:47 GMT -8
Scanned your log files and don't see anything malicious in them. Let's see if Autoruns can shed some light on the matter: Please download AutoRuns.exe from technet.microsoft.com/en-ca/sysinternals/bb963902.aspx. Save this to your desktop and double click to run the file. Extract all the files to the default setting (a folder on the desktop). In that folder, double click on autoruns.exe and allow the program to run / scan your system. When the scanning is done, click on File > Save and save the .arn file to your desktop. Please attach this file to a reply post here.
|
|
|
Post by TechArtyst on Jul 20, 2017 19:59:23 GMT -8
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Jul 21, 2017 10:28:05 GMT -8
Thanks for the Autoruns file; it confirmed what the error is. This should clean your system of the 'weird' startup item along with cleaning a few loose ends.... FIRST >>>>Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed): EPSON Artisan 50 Series Printer Uninstall QuickTime 7To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window. Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software. SECOND >>>>Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txtNOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemStart FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply. How is your system running now? Does the item show on startup again?
|
|
|
Post by TechArtyst on Jul 21, 2017 12:35:06 GMT -8
Awesome, it works and FU is no more! Thanks a bunch!!! Attached Fixlog. A few questions for the sake of my own IT learning: 1) How did you know to remove the EPSON Artisan 50 Series Printer Uninstall, as opposed to the EPSON Artisan 50 Series driver? In the Autoruns log, it appeared to just be "EPSON Artisan 50 Series". 2) How did you know to remove QuickTime 7? I used the Find feature in Autoruns for "FU" and it didn't seem to point to anything QuickTime-related. 3) What did that script you gave me do, and why did my system need that as opposed to just running the uninstaller? Attachments:Fixlog.txt (12.35 KB)
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Jul 22, 2017 9:07:05 GMT -8
I will try to answer these as best I can: 1) The Uninstall was listed as a program in your "Add / Remove Programs" list reported by FRST (see the Addition.txt log). 2) QuickTime7 is no longer supported by Apple; no security updates or fixes are going to be supplied to this software. 3) The script removed possible 'bad' files and settings; just an uninstall sometimes leaves files and settings behind even though the uninstall routine says it has removed them.
Your system looks pretty clean (with the exception of a large amount of Temp files); how is it running for you?
|
|
|
Post by TechArtyst on Jul 23, 2017 21:35:38 GMT -8
Gotcha - that helps for my understanding. It's been running great! I normally use Revo Uninstaller to clean up any leftover files when I remove stuff, would you say that is normally sufficient?
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Jul 25, 2017 21:23:52 GMT -8
Revo is usually fine and does a good job. Malware is a special case as sometimes it hides where the files / settings are placed but that is why removalists are trained to find and assist in cleaning malware.
We need to remove the tools we've used during the cleaning of your machine. [/a] Ensure the following is ticked: - Remove disinfection tools
- Create registry backup
- Purge system restore
[/ul] Then click Run. The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply. Once you have the log file saved, please reboot your system to complete the clean up process. Your system looks clean and your logs are fine. Unless you want something else done, you are done and free to go.Final words from me: Surf safely, and watch when installing or letting anything add itself to your system. Remember, the best security is not on your system but in the chair in front of it. Take care and thanks for sticking with us in this rushed time. === options ====Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing. By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed. CryptoPrevent is a free program that prevents CryptoLocker / ransomware from infecting your PC by locking down the OS so the malware can not get a grip on your system. You can read the details about this program here. Also, consider adding MalwareBytes Antimalware to your arsenal of safe keeping programs. Use the free version (not the paid or trial version) and you won't have a problem with your antivirus scanner program. Keep it updated and run a scan with it once a week. Lastly, if you use Firefox as your main web browser, consider adding the NoScript and uBlock Origin add-ons to the browser to block scripting hijacks and remove unwanted ads from the pages you view. You may also find some information and tips at this thread: How did I get infected in the first place?and COMPUTER SECURITY - a short quide to staying safer online
I'll leave this topic open for a few days so that if you have any questions you can come back here. Surf safe, my friend!!
|
|
|
Post by TechArtyst on Jul 26, 2017 9:47:14 GMT -8
Delfix ran with no issue! Log attached. Curious why is it beneficial to remove all the Restore Points? Also noticed your recommendation for Malware Anti-Bytes, and that with the free version you won't have an issue with your antivirus scanner. Does that mean you can run Anti-Bytes alongside say Avast without issue?
Log:
# DelFix v1.010 - Logfile created 26/07/2017 at 13:34:22 # Updated 26/04/2015 by Xplode # Username : Schven - ANDROMACHE # Operating System : Windows 8.1 (64 bits)
~ Removing disinfection tools ...
Deleted : C:\FRST Deleted : C:\Users\Schven\Desktop\FRST-OlderVersion Deleted : C:\Users\Schven\Desktop\Addition.txt Deleted : C:\Users\Schven\Desktop\Fixlog.txt Deleted : C:\Users\Schven\Desktop\FRST.txt Deleted : C:\Users\Schven\Desktop\FRST64.exe
~ Creating registry backup ... OK
~ Cleaning system restore ...
Deleted : RP #145 [Scheduled Checkpoint | 07/02/2017 17:03:18] Deleted : RP #146 [Scheduled Checkpoint | 07/11/2017 18:26:27] Deleted : RP #147 [Installed APC PowerChute Personal Edition 3.0 | 07/12/2017 16:27:14] Deleted : RP #148 [Installed APC PowerChute Personal Edition 3.0 | 07/12/2017 18:13:40] Deleted : RP #149 [Installed PowerChute Personal Edition 3.0.2 | 07/12/2017 18:16:44] Deleted : RP #150 [Scheduled Checkpoint | 07/21/2017 13:49:05] Deleted : RP #151 [Removed QuickTime 7 | 07/21/2017 20:05:12] Deleted : RP #153 [Restore Point Created by FRST | 07/21/2017 20:13:53]
New restore point created !
########## - EOF - ##########
|
|
dbrisen
Malware Removalists
Posts: 3,688
|
Post by dbrisen on Jul 28, 2017 21:45:22 GMT -8
DelFix removes all the old restore points as they could have copies of malware in them; they are removed for that reason and a fresh, clean restore point is made for you to move forward with.
The non-realtime version (free) of Malwarebytes will coexist with any AV.
Any other questions or concerns?
|
|