/wsr/ - Worksafe Requests » Thread #457693

[48 / 18 / ?]

76KiB, 1280x800, pls help.png

Anonymous Thu 08 Feb 2018 19:54:47 No.457693 View View Reply Original Report

Quoted By: >>457776

anyone know what is this and how to get rid of it ?
i keep deleting it every day but it keeps popping back
when its active it wont let me open web pages

Anonymous

Anonymous Thu 08 Feb 2018 21:41:23 No.457750 Report

Quoted By: >>458005

Malwarebytes maybe. Run a scan.

Anonymous

Anonymous Thu 08 Feb 2018 22:44:52 No.457776 Report

Quoted By: >>457781

>>457693
Maybe it's the Wajam adware?

Anonymous

Anonymous Thu 08 Feb 2018 22:50:34 No.457781 Report

Quoted By:

>>457776
Actually, it could be any kind of browser extension, I guess.

Anonymous

Anonymous Fri 09 Feb 2018 06:27:36 No.457948 Report

Quoted By:

> OP is a time traveler

op Fri 09 Feb 2018 11:32:02 No.458005 Report

Quoted By: >>458169 >>458305

>>457750
im using CCleaner to get rid of it but as soon as i restart pc its there again
it doesnt show up in the startups

Anonymous

Anonymous Fri 09 Feb 2018 18:47:23 No.458146 Report

Quoted By:

Forward this to all of your friends or Bill gates will eat ur motherboard

Anonymous

Anonymous Fri 09 Feb 2018 19:47:49 No.458169 Report

Quoted By:

>>458005
Have you tried disabling browser extensions, at least?

Anonymous

Anonymous Fri 09 Feb 2018 23:54:02 No.458305 Report

Quoted By: >>458335 >>458491 >>458508

>>458005
at this point i would use regedit to check the list of things that get run at startup. i think they're stored under SOFTWARE\Microsoft\Windows\CurrentVersion\Run

can you look at that key and give us a screenshot? we'll all take guesses as to which program is the malware.

> this is better than pokemon go

Anonymous

Anonymous Sat 10 Feb 2018 01:14:04 No.458335 Report

Quoted By: >>458406 >>458491 >>458523 >>458529

>>458305
>list of things that get run at startup
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Anonymous

View Same Google ImgOps iqdb SauceNAO regedit-startup.png, 28KiB, 995x321

Anonymous Sat 10 Feb 2018 03:49:39 No.458406 Report

Quoted By: >>458434 >>458491

>>458335

OTHER other things that get run at startup.

Anonymous

Anonymous Sat 10 Feb 2018 05:10:49 No.458434 Report

Quoted By:

>>458406
Check both.

Anonymous

Anonymous Sat 10 Feb 2018 08:13:54 No.458491 Report

Quoted By: >>458532

>>458305
>>458335
>>458406
There are many different places in the registy that can have startup items, so checking just those places won't show everything that might be hiding. OP should run this batch file https://my.mixtape.moe/qdvwiz.bat and then post the contents of RegistryStartup.txt and StartMenuStartup.txt that will be created on the desktop.
OP should also check Task Scheduler for anything suspicious because that can be used to run programs on startup as well.

View Same Google ImgOps iqdb SauceNAO 1.png, 57KiB, 1280x800

op Sat 10 Feb 2018 08:57:24 No.458506 Report

Quoted By: >>458511

this is what shows up when its active and i try to enter a web site
(also captcha doesnt show for some reason and a lot of cpu consumption)

View Same Google ImgOps iqdb SauceNAO 2.png, 48KiB, 956x560

op Sat 10 Feb 2018 09:03:45 No.458508 Report

Quoted By:

>>458305

Anonymous

Anonymous Sat 10 Feb 2018 09:14:20 No.458511 Report

Quoted By: >>458517 >>458519 >>458526

>>458506
do this:
open cmd with admin right
type "tasklist" and press enter
type "tasklist/svc" and press enter
copypaste the result here

View Same Google ImgOps iqdb SauceNAO tasklist.png, 39KiB, 659x673

op Sat 10 Feb 2018 09:21:54 No.458517 Report

Quoted By: >>458526

>>458511
this is tasklist

op Sat 10 Feb 2018 09:22:56 No.458519 Report

Quoted By: >>458521

>>458511
this is the svc thing

View Same Google ImgOps iqdb SauceNAO tasklist svc.png, 38KiB, 660x740

op Sat 10 Feb 2018 09:23:58 No.458521 Report

Quoted By: >>458526

>>458519
fogot pic

View Same Google ImgOps iqdb SauceNAO startup.png, 63KiB, 1280x800

op Sat 10 Feb 2018 09:25:37 No.458523 Report

Quoted By:

>>458335

View Same Google ImgOps iqdb SauceNAO admin.png, 84KiB, 1268x702

op Sat 10 Feb 2018 09:29:42 No.458526 Report

Quoted By: >>458527 >>458619

>>458521
>>458517
>>458511
sorry forgot to run as admin

View Same Google ImgOps iqdb SauceNAO missing part.png, 3KiB, 326x75

op Sat 10 Feb 2018 09:32:25 No.458527 Report

Quoted By:

>>458526
this is the missing part from the 2nd (svc) one

View Same Google ImgOps iqdb SauceNAO 2nd.png, 74KiB, 1280x800

op Sat 10 Feb 2018 09:35:18 No.458529 Report

Quoted By: >>458530

>>458335

Anonymous

Anonymous Sat 10 Feb 2018 09:45:02 No.458530 Report

Quoted By: >>458531

>>458529
can you post pic of of your program files folder?

View Same Google ImgOps iqdb SauceNAO Untitled.png, 92KiB, 1280x800

op Sat 10 Feb 2018 09:49:24 No.458531 Report

Quoted By:

>>458530
selected one is the little fucker that keeps reappearing

op Sat 10 Feb 2018 09:51:58 No.458532 Report

Quoted By: >>458533 >>458534

>>458491
how can i check if the dl is safe
im not calling you a scammer but clicking on these links got me into this position

Anonymous

Anonymous Sat 10 Feb 2018 09:53:35 No.458533 Report

Quoted By:

>>458532
Not him but you can upload it to virustotal to scan it. Same goes with the suspicious files is the folder you mentioned, do that and post the result.

Anonymous

Anonymous Sat 10 Feb 2018 09:57:03 No.458534 Report

Quoted By:

>>458532
btw the batch file is harmless because it only list, like what he said, the registry and start menu startups.

Anonymous

Anonymous Sat 10 Feb 2018 15:56:41 No.458619 Report

Quoted By: >>458652 >>458654

>>458526
In cmd as admin run:
WMIC path win32_process where "caption='rundll32.exe'" get Caption,Processid,Commandline
Post result

Anonymous

Anonymous Sat 10 Feb 2018 16:47:58 No.458632 Report

Quoted By: >>458650

You ran CCleaner, but have you run a rescue CD? Several virus scanning companies (Avira, Kaspersky, etc.) offer one.

bitdefender.com/consumer/support/answer/3380/

op Sat 10 Feb 2018 17:23:12 No.458650 Report

Quoted By: >>458656

>>458632
no i havent i have no idea what is that

View Same Google ImgOps iqdb SauceNAO fdafdsaf.png, 11KiB, 663x322

op Sat 10 Feb 2018 17:25:21 No.458652 Report

Quoted By: >>458654

>>458619
what am i doing wrong

Anonymous

Anonymous Sat 10 Feb 2018 17:29:05 No.458654 Report

Quoted By: >>458655

>>458652
You put
where"caption='rundll32.exe'
when it should be
where "caption='rundll32.exe'"

Just copy my line >>458619 and right click the cmd window and click paste

View Same Google ImgOps iqdb SauceNAO here.png, 11KiB, 664x325

op Sat 10 Feb 2018 17:37:09 No.458655 Report

Quoted By: >>458657

>>458654

Anonymous

Anonymous Sat 10 Feb 2018 17:38:33 No.458656 Report

Quoted By:

>>458650
You burn an ISO to a CD (easiest) or a USB drive, and when your computer starts up you boot from the media instead of your hard drive. Then the malware/virus scanner on the rescue media can root out your problem.

Anonymous

Anonymous Sat 10 Feb 2018 17:39:25 No.458657 Report

Quoted By: >>458686

>>458655
You have to run cmd as administrator or else it won't show up correctly.

View Same Google ImgOps iqdb SauceNAO admin confirm.png, 12KiB, 663x318

op Sat 10 Feb 2018 18:36:50 No.458686 Report

Quoted By: >>458690

>>458657
i thought i did

ive noticed that it appears after screensaver too

Anonymous

Anonymous Sat 10 Feb 2018 18:51:59 No.458690 Report

Quoted By: >>458691

>>458686
OK that dll file in the C:\Windows directory is probably the root of the problem and is being executed at startup. Run the following commands in an admin cmd:
taskkill /F /PID 1740
del /f /q C:\Windows\6e224e1ecd43e1e3ea06af7ffa5bfde3.dll
rmdir /s /q "C:\Program Files\ce29260631546bd4965fdf08b52fa199"

Post the result, this should fix it. If it gives an error when deleting, I might've misspelled it or you might not have permissions set.

Anonymous

View Same Google ImgOps iqdb SauceNAO could this be it.png, 14KiB, 664x321

Anonymous Sat 10 Feb 2018 18:56:21 No.458691 Report

Quoted By: >>458692

>>458690
did i do good ?
is this the end of my problem ?

Anonymous

Anonymous Sat 10 Feb 2018 18:57:49 No.458692 Report

Quoted By: >>458694

>>458691
It says could not find, so I must've misspelled it. Go to C:\Windows and manually delete the 6e224e1ecd43e1e3ea06af7ffa5bfde3.dll file and then delete ce29260631546bd4965fdf08b52fa199 in Program Files

Anonymous

View Same Google ImgOps iqdb SauceNAO so close.png, 20KiB, 480x266

Anonymous Sat 10 Feb 2018 19:01:50 No.458694 Report

Quoted By: >>458696

>>458692
what to do
i dont see it in task manager (all users)

Anonymous

Anonymous Sat 10 Feb 2018 19:06:01 No.458696 Report

Quoted By: >>458711

>>458694
Looks like it's relaunching itself, download this batch file https://my.mixtape.moe/xzguct.bat (it's safe, you can right click it and click edit to see the code) and run it as administrator.

op Sat 10 Feb 2018 19:29:10 No.458711 Report

Quoted By:

>>458696
I dont know how to feel about this
The virus I wanted gone has been terminated successfully with the help of 11 of you and thank you everyone so much for helpimg me out.
Im writing this on my phone because PC is practically unable to post at all (up to 100% cpu usage and constant 30% phys memory also captcha disappeared)
Has the final boss been slain ?
Will another restart fix this ?

View Same Google ImgOps iqdb SauceNAO 2908fd7da41e3775056bb2d13599a1ba (...).jpg, 25KiB, 320x400

op Sat 10 Feb 2018 19:41:30 No.458717 Report

Quoted By: >>458723 >>458810 >>458842 >>459062

I just restarted again and everything is as it should be !

I JUST WANT TO THANK EVERYONE FOR HELPING ME THANK YOU SO MUCH VIRUS IS KILL I REPEAT VIRUS IS KILL

Anonymous

Anonymous Sat 10 Feb 2018 19:54:25 No.458723 Report

Quoted By:

>>458717
Just read this and first time I post in this thread, but...

Congrats, OP

Anonymous

Anonymous Sat 10 Feb 2018 22:31:07 No.458810 Report

Quoted By:

>>458717
Congrats, man.

Anonymous

View Same Google ImgOps iqdb SauceNAO christina_hendricks_approves.jpg, 15KiB, 300x300

Anonymous Sat 10 Feb 2018 23:41:56 No.458842 Report

Quoted By:

>>458717

Anonymous

Anonymous Sun 11 Feb 2018 08:51:12 No.459062 Report

Quoted By:

>>458717
what was the purpose of the virus

Capcode	All Only User Posts Only Verified Posts Only Moderator Posts Only Manager Posts Only Admin Posts Only Developer Posts Only Founder Posts
Show Posts	All Only With Images Only Without Images Only Spoiler Images Only Non-Spoiler Images
Deleted Posts	All Only Deleted Posts Only Non-Deleted Posts
Ghost Posts	All Only Ghost Posts Only Non-Ghost Posts
Post Type	All Only Sticky Threads Only Opening Posts Only Reply Posts
Results	All Grouped By Threads
Order	Latest Posts First Oldest Posts First

On these archives

Your latest searches