Install Shield / isuspm.exe

Solved
carminsa Posted messages 3 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

After several formatting attempts, I'm facing the same problem: my internet is very slow on every Google search (on IE / Chrome), while other sites work just fine. Upon checking, every time I start up, 'Install Shield' launches (under the process isuspm.exe) and as soon as I kill it, everything works properly. If I uninstall it, I have to run Malwarebytes Anti-Malware because my proxy stops working. It removes 20 malware items (after a format that was less than 24 hours ago, which is quite surprising), I reboot, and everything works fine again.

But what I don't understand is that it keeps coming back all the time. The only things I install are Steam, Epic Games, and Wargaming launcher, and I think it could come from the latter, Wargaming launcher; I suspect that the automatic update might be the cause, but I'm not sure.

I hope that’s where it’s coming from; otherwise, I really don't know where it might be coming from.

P.S.: I scanned all my drives before formatting, everything is clear, and I have Windows 10 Pro.

2 answers

Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 711
 
Good evening,

Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

Download and run the FRST scan,
Wait for the scan to finish, a message will indicate that the analysis is complete.

Three FRST reports will be generated:
  • FRST.txt
  • Shortcut.txt
  • Additionnal.txt


Send these 3 reports to the website https://pjjoint.malekal.com/ to share them.
In return, provide the 3 pjjoint links that lead to the reports here in a new response so that we can consult them.

--
Please press any key to continue the disinfection...
0
carminsa Posted messages 3 Status Member
 
Thank you for your response, but my problem is not to delete it permanently, but to understand why it keeps coming back after every formatting.
0
carminsa Posted messages 3 Status Member
 
I found out it actually came from KMS pico.
0
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 711 > carminsa Posted messages 3 Status Member
 
yes, and you are far from being the only one: https://forum.malekal.com/search.php?keywords=proxy&fid=0
0