My laptop has a viral behavior.

Hello

We will start with a diagnosis of the PC:

Be sure to read the entire procedure before posting the reports
Do not post them directly in messages as they are unreadable and incomplete

The reports FRST.txt and Addition.txt are expected

All reports must be hosted on https://textup.fr/ or on Cjoint and you must include the obtained links in your response

---------------------------------------------------------------------------------------------

--> The SmartScreen filter may trigger an alert. Click on Actions or More information and then on Run anyway

---------------------------------------------------------------------------------------------

--> Download the FRST version of Farbar, compatible with your system and save the file to your Desktop

--> For a 32-bit system
--> For a 64-bit system

How to know which version 32-bit or 64-bit is running on my system?

--> Wait for your browser to offer the download to save, without clicking anywhere, especially not on the sponsors of the page.
--> Close all applications, including your browser
--> Double-click on FRST.exe and click Yes to accept the Disclaimer
--> Under Vista, Windows 7 / 8 and 10, you need to launch the file by right-clicking -> Run as administrator
--> Wait for it to indicate The tool is ready to run
--> On the main menu, click on Scan and wait for the analysis to complete
--> At the end of the scan, the reports FRST.txt and Addition.txt are created. Post these reports in your next response.
--> The reports are saved in the same location as the tool and under C:\FRST\Logs

RE_

What antivirus do you have? Windows Defender and FortiClient are disabled.

Windows Defender is sufficient, no need to add another one.

*****

Uninstall Adobe Flash Player 32 PPAPI (obsolete) and WebAdvisor by McAfee

*****

The PC is infected, I will provide a fix for the antivirus after your response.

Good evening MisteryBean,

Here are the requested links after the FRST analysis

https://www.cjoint.com/c/NDCtTdCW4Ol

https://www.cjoint.com/c/NDCtWHFWoKl

And thank you again for your response.

RE_

--> Download the FIXLIST file to the same location as the FRST64 program

--> Open FRST (or FRST64) as an administrator and click on Fix
If FRST seems to freeze or is unresponsive, let it run

--> The PC will ask to restart, accept

--> A fixlog file is created in the same location as FRST, post it like the other reports

--> The fix will clean the firewall, the programs you launch afterward will request access on the first launch

--> Let me know if you still have the problem.

RE_

OK. Given how infected the PC was, restart a FRST scan and post the new reports.

PS: Click on "Reply" instead of "Comment".

Alright, I'll do it right away.

Here are the links to the new FRST analysis reports

https://www.cjoint.com/c/NDDoh5Ljkaf

https://www.cjoint.com/c/NDDokhQmFTf

RE_

--> Download the file FIXLIST in the same location as the FRST64 program

--> Open FRST (or FRST64) as an administrator and click on Fix
If FRST seems to be freezing or not responding, let it run

--> The PC will ask to restart, accept

--> A fixlog file is created in the same location as FRST, post it like the other reports

--> The fix will clean the firewall, the programs you run afterwards will request access on the first launch

--> Let me know if you still have the problem.

******************

Malwarebytes :

Run a Malwarebytes scan:

=> Download Malwarebytes Anti-Malware
=> Install the application --> Double-click on the downloaded file to launch the tool
=> /!\ On Vista, Windows 7 and 8, you need to run the file by right-clicking ==>> Run as administrator
=> update the software before the scan.
=> Start the detection by Scan Now
=> At the end of the scan, if any infections were found, click on Quarantine selected
=> The PC will restart
=> After restarting, open MBAM again.
=> Click on the Report tab
=> Select the corresponding file --> Click on show report
=> Click on export --> Text File (TXT)
=> The Save File dialog will open
=> Give it a name and save it on the Desktop
=> Host the report and provide the link in your next response.

Hello MisteryBean

New link to the fixlog file https://www.cjoint.com/c/NDEgJEGvlKf

The path to the Malwarebytes Anti Malware report file is:

C:\users\hp\desktop\mbam analysis result

Here is the link to the Malwarebytes report https://www.cjoint.com/c/NDElV4AaANf

RE_

The correction wasn't done properly.

Redo the procedure => HERE <= (only the fixlist), I modified it, and post the fixlog report.

Link to fixlog report https://www.cjoint.com/c/NEbjiJky3tf

RE_

Okay for the fixlog.

Run a Malwarebytes scan again and post the new report.

***

Do this for Malwarebytes:

Open Malwarebytes -> Settings -> Security -> Windows Security Center -> uncheck "Always add Malwarebytes to the Windows Security Center" -> Restart the computer

********

=> Download Farbar Service Scanner (if the download does not start automatically, click on "click here")

=> Run it by right-clicking run as administrator

=> Make sure the options below are checked

=> Click on "Scan"

=> A scan report (FSS.txt) will be created in the folder where FSS.exe is located.

=> Host the report and provide the link in your response.

Hello MisteryBean

Attached is the link to the results of the new malwarebytes analysis

https://www.cjoint.com/c/NEcgSe5mRNf

and the link to the Farbar Services Scanner report

https://www.cjoint.com/c/NEchlfVFtPf

RE_

Sorry for the scattered replies, but I had changes in my work schedule.

According to FSS, Windows Update is broken.

There are also executables being created in the local folder that Malwarebytes detects as trojans, but a scan on VirusTotal returns clean files.

*******

You need to do the following, then rerun a FRST scan and post the new reports:

=> open Task Manager (right click on the taskbar)
=> Startup tab, disable everything except for the antivirus

THEN:

=> Windows + R, type MSconfig
=> In the window, click on the Services tab
=> Check Hide all Microsoft services

=> Take screenshots to restore the services if needed
=> Click on Disable all
=> Restart the PC

=> After rebooting, run the FRST scan

Hello MisteryBean,

Here are the links to the FRST scan for the files:

FRST : https://www.cjoint.com/c/NEdhOzivtWf

ADDITION : https://www.cjoint.com/c/NEdhQu51wNf

RE_

Uninstall:

=> Avast Update Helper

=> Opera Stable 109.0.5097.68 (It might be the one creating multiple exe files)

******************

--> Download the FIXLIST file in the same location as the FRST64 program

--> Open FRST (or FRST64) as an administrator and click on Fix
If FRST seems to freeze or is not responding, let it run

--> The PC will ask to restart, accept

--> A fixlog file will be created in the same location as FRST, post it like the other reports

--> Go to Windows Update and see if it works by clicking on check for updates

--> Run another FRST scan and post the new reports

Hello MisteryBean,

Sorry for the delay in my response, I was too overwhelmed this weekend, which meant I didn't have time to open my laptop,

nevertheless here is the link to today's fixlog https://www.cjoint.com/c/NEgjDLmR5Kf

RE_

OK, redo a FRST scan to see if the files are still being created