Install Shield / isuspm.exe

Solved
carminsa Posted messages 3 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

After several formatting attempts, I'm facing the same problem: my internet is very slow on every Google search (on IE / Chrome), while other sites work just fine. Upon checking, every time I start up, 'Install Shield' launches (under the process isuspm.exe) and as soon as I kill it, everything works properly. If I uninstall it, I have to run Malwarebytes Anti-Malware because my proxy stops working. It removes 20 malware items (after a format that was less than 24 hours ago, which is quite surprising), I reboot, and everything works fine again.

But what I don't understand is that it keeps coming back all the time. The only things I install are Steam, Epic Games, and Wargaming launcher, and I think it could come from the latter, Wargaming launcher; I suspect that the automatic update might be the cause, but I'm not sure.

I hope that’s where it’s coming from; otherwise, I really don't know where it might be coming from.

P.S.: I scanned all my drives before formatting, everything is clear, and I have Windows 10 Pro.

2 answers

  1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 711
     
    Good evening,

    Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the website https://pjjoint.malekal.com/ to share them.
    In return, provide the 3 pjjoint links that lead to the reports here in a new response so that we can consult them.

    --
    Please press any key to continue the disinfection...
    0
  2. carminsa Posted messages 3 Status Member
     
    Thank you for your response, but my problem is not to delete it permanently, but to understand why it keeps coming back after every formatting.
    0
    1. carminsa Posted messages 3 Status Member
       
      I found out it actually came from KMS pico.
      0