View original (French)

Suspected Virus

alexdarcy Posted messages 318 Registration date   Status Member Last intervention   -  
bazfile Posted messages 58466 Registration date   Status Moderator Last intervention   -

Hello bazfile, how are you?

I'm coming back to see you, I suspect a virus, I don't know which one, but antivirus windows are popping up constantly. I'm attaching three files: FRST, Addition, as well as a screenshot with the windows. Thank you.

https://pjjoint.malekal.com/files.php?id=FRST_20260616_e9g5c11e15o12

https://pjjoint.malekal.com/files.php?id=20260616_g11r12l14m15c5

https://pjjoint.malekal.com/files.php?id=20260616_t7s13x12r8r15


1 answer

Answer 1 / 1
bazfile Posted messages 58466 Registration date   Status Moderator Last intervention   20 257
 

Hello @alexdarcy StatusMember.

Procedure to follow in the given order:

1- Open FRST as an administrator by right-clicking on FRST and selecting run as administrator
2 - Copy the entire script that is in the box below:

Start:: CreateRestorePoint: CloseProcesses: FirewallRules: [TCP Query User{60166B7F-F16C-40E9-B414-6FBE62FE979E}C:\program files (x86)\formatfactory\formatfactory.exe] => (Allow) C:\program files (x86)\formatfactory\formatfactory.exe => No file FirewallRules: [UDP Query User{58B01607-7DBD-4EA7-9CDC-F491F8B2AEEE}C:\program files (x86)\formatfactory\formatfactory.exe] => (Allow) C:\program files (x86)\formatfactory\formatfactory.exe => No file HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable (No file) CHR Notifications: Default -> hxxps://loadedfiles.org End::

3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.


Let the fix process complete, once finished you will be asked to restart your PC, do it as soon as prompted, see below.

Then once your computer has restarted:
4- You will have a Fixlog file on your desktop, then upload this fixlog report to https://pjjoint.malekal.com/ or https://www.catupload.com/.

Then provide the link generated by https://pjjoint.malekal.com/ or https://www.catupload.com/ in your reply.

5- CHECK AND LET ME KNOW IF YOUR ISSUE STILL EXISTS.

bazfile
Moderator/Security Contributor.
A hello, a response, a thank you are always appreciated.
0