"Recommended Update" Virus: I CAN"T KILL IT

[iamdarkyoshi]

~~~~~~INSTALLING A FRESH WINDOWS COPY ISN'T AN OPTION RIGHT NOW~~~~~~~~~~~~

 

 

This little cUUUUUUUUUUUUUUUnt

 

 

What I've done: Update to the latest windows version (Didn't do anything)

 

Run windows defender (Didn't find anything, massive surprise there)

 

Install Malwarebytes (Came back after a month)

 

Install ADWCleaner (Came back after a month)

 

Browse to the EXE responsible for it in task manager (seems to be a windows system program)

 

I literally haven't installed any software on this laptop other than steam, VLC, chrome, etc. Its been about 4 months since I installed software, but like 2 months since I've been having this fucking popup

 

 

 

There is nothing odd in the program list.

 

 

 

 

I just had it come back in a game of rocket league, and it keeps minimizing the game to open itself. How the hell do I blast its ass off my laptop? I don't visit sketchy sites, I don't spam 'next' when installing programs, and this is the first issue I've had since I built my first PC 5 years ago.

[LienusLateTips]

Try Avira. 

[Guest]

Hey! I actually had the exact (almost) same popup on my laptop. The way to kill it is through task manager. But then it reappears everytime I boot it up.

It's gone now and the answer to the problem is something you wouldn't like but expect: reset Windows

 

btw reinstall and reset isn't the same thing

[The Sloth]

boot into safe mode, see if you can remove it from there. 

[ACEHACK]

kill it in task manager find it in (Run:msconfig) and disable it then (Run: regedit) find the registry files under user about the app and delete it and install Sophos home scan your computer and it should detect its residue 

[Thatruriddler]

8 minutes ago, iamdarkyoshi said:

~~~~~~INSTALLING A FRESH WINDOWS COPY ISN'T AN OPTION RIGHT NOW~~~~~~~~~~~~

 

 

This little cUUUUUUUUUUUUUUUnt

 

 

What I've done: Update to the latest windows version (Didn't do anything)

 

Run windows defender (Didn't find anything, massive surprise there)

 

Install Malwarebytes (Came back after a month)

 

Install ADWCleaner (Came back after a month)

 

Browse to the EXE responsible for it in task manager (seems to be a windows system program)

 

I literally haven't installed any software on this laptop other than steam, VLC, chrome, etc. Its been about 4 months since I installed software, but like 2 months since I've been having this fucking popup

 

 

 

There is nothing odd in the program list.

 

 

 

 

I just had it come back in a game of rocket league, and it keeps minimizing the game to open itself. How the hell do I blast its ass off my laptop? I don't visit sketchy sites, I don't spam 'next' when installing programs, and this is the first issue I've had since I built my first PC 5 years ago.

This may sound stupid, but if you have any extensions on your Chrome, linked to your account, and you've been logging in with the same account each time, there may be something attached to the account itself. Check your extensions, and make sure there isn't anything there. I had a similar problem myself once before, and by deleting the extension, it all went away. I also fixed a friend's computer which had the same issue, so it isn't totally unheard of.

[JohnnyCorporalTech]

where is the mshta.exe file located

 

if it is not located within the system32 folder it is likely malicious

http://www.file.net/process/mshta.exe.html 

[anonvx]

21 minutes ago, iamdarkyoshi said:

~~~~~~INSTALLING A FRESH WINDOWS COPY ISN'T AN OPTION RIGHT NOW~~~~~~~~~~~~

 

 

This little cUUUUUUUUUUUUUUUnt

 

 

What I've done: Update to the latest windows version (Didn't do anything)

 

Run windows defender (Didn't find anything, massive surprise there)

 

Install Malwarebytes (Came back after a month)

 

Install ADWCleaner (Came back after a month)

 

Browse to the EXE responsible for it in task manager (seems to be a windows system program)

 

I literally haven't installed any software on this laptop other than steam, VLC, chrome, etc. Its been about 4 months since I installed software, but like 2 months since I've been having this fucking popup

 

 

 

There is nothing odd in the program list.

 

 

 

 

I just had it come back in a game of rocket league, and it keeps minimizing the game to open itself. How the hell do I blast its ass off my laptop? I don't visit sketchy sites, I don't spam 'next' when installing programs, and this is the first issue I've had since I built my first PC 5 years ago.

if you can find the file and are having problems deleting install file assassin from Malwarebytes 

[JohnnyCorporalTech]

Just now, JohnnyCorporalTech said:

where is the mshta.exe file located

 

if it is not located within the system32 folder it is likely malicious

http://www.file.net/process/mshta.exe.html 

lol just realized the screen shot's. 

 

probably would follow @deXxterlab97's comment

[captain_to_fire]

20 minutes ago, iamdarkyoshi said:

What I've done: Update to the latest windows version (Didn't do anything)

 

Run windows defender (Didn't find anything, massive surprise there)

 

Install Malwarebytes (Came back after a month)

 

Install ADWCleaner (Came back after a month)

 

Browse to the EXE responsible for it in task manager (seems to be a windows system program)

Try this https://technet.microsoft.com/en-us/sysinternals/bb896653

 

Then any of these two [here and here], or if you want you can try Norton Power Eraser (might lead to false positives though). You can also try to Reset your PC without removing your files:

 

Start>Settings>Update and Security>Recovery>Advanced Startup

 

If those still doesn't work, you might need to reformat your PC.

 

[NoRomanBatmansAllowed]

22 minutes ago, Thatruriddler said:

This may sound stupid, but if you have any extensions on your Chrome, linked to your account, and you've been logging in with the same account each time, there may be something attached to the account itself. Check your extensions, and make sure there isn't anything there. I had a similar problem myself once before, and by deleting the extension, it all went away. I also fixed a friend's computer which had the same issue, so it isn't totally unheard of.

ADW CLEANER TO THE RESCUE! 

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

 

Cleans out all the crap stuff from your browser, registries, shortcuts, and much more! : D

 

[iamdarkyoshi]

1 hour ago, JDE said:

Try Avira. 

Tried this, like other AV, it found one issue (the fucking popup) and got rid of it, but lets see if it comes back...

[vaiwalker]

something could be sitting in your services. even if you uninstall it, delete it, rename it, the service probably starts up with windows and redownloads the virus. you might have to delete the service entry from the registry so it'll go away from the services list. probably sitting somewhere in %appdata% as well, look for any suspicious folders in there and delete them, probably in safe mode.

[demonix00]

I'd suggest getting rid of it with the programs that did detect it and also either disable or wipe out all the system restore points since it might be that it's hiding in there and restoring itself a while (also it's likely that it's using that process (which is a legit program) is being used by the virus to generate the window).

 

If all things fail, then the only thing you can do is break out the tactical formatting nuke and starting from scratch with a clean OS plate.

[dfsdfgfkjsefoiqzemnd]

If it returned after being removed, there's probably something else in your PC.  Deleting it MAY help with some viruses, but often it can come back or something else could still be lingering in there and collecting your passwords or keystrokes. 

That's why with a virus there is only one correct action : format the PC and restore your data from backups.  Rolling back to an earlier restore point or refreshing Windows may not help.  If Windows doesn't recognize the malware or if it is outside the usual locations, it often ignores it during the rollback which means it persists. 

 

Don't bother wasting your time on keeping this install rolling, just wipe it.