Occassional Pops "virus Detected" Website, And Computer Always Running At High Memory Usage

patrcarl · Nov 10, 2016

Thank you in advance for your help! My problems started with high memory usage, though I have a Dell XPS with a solid state hard drive, Core i7 processor and 16gb of RAM. Recently, sometimes when I'm on Chrome and I click on a link to go to a new page, it opens a new tab that displays a page (with sound) saying that a virus has been detected and I need to call a number on the screen. This happens about every 5th time I click a link.

I switched to Internet Explorer to work through the Major Geeks process here, and have been getting even more new tabs/sites popping up - even when clicking to download some of the software!

Malware Bytes found over 1,000 items that are currently in quarantine. I have attached logs from HitmanPro, RK, and MGLogs.zip.

TDSSkiller did not find anything, so that's not posted.

By the way, my trial version of Hitman Pro (from going through this 18 months ago), but I'm not adverse to purchasing if I need to so I can get the computer totally clean again

Thank you again for taking the time to help me through this!

dr.moriarty · Nov 10, 2016

You're welcome, patrcarl

The high RAM usage may be related to the type applications you have running at startup.

Re-run RogueKiller.exe. (Vista/Windows7/8/10 users should right-click and select "Run as Administrator")
After it finishes the scan, select the following tabs and then select any of the below that exist and then click the Remove Selected button.
Registry

[PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{4BD42D14-0348-A242-61F3-87543FFCDD27} (C:\ProgramData\topbuYer\IqrtfL.x64.dll) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4BD42D14-0348-A242-61F3-87543FFCDD27} (C:\ProgramData\topbuYer\IqrtfL.x64.dll) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A28C8452-20D5-40A2-9AE6-D89EE8813C5C} : v2.22|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\Patrick\AppData\Local\Temp\nsnCF3D.tmp\CnetInstaller-75914483.exe|Name=proinstaller1933666855| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {2C8C26B6-4A5E-4F31-8541-1A5602FB27A9} : v2.22|Action=Allow|Active=TRUE|Dir=Out|App=C:\Users\Patrick\AppData\Local\Temp\nsnCF3D.tmp\CnetInstaller-75914483.exe|Name=proinstaller1933666855| [x] -> Found

Files

[PUP][Folder] C:\ProgramData\FFinder LTD -> Found

[PUP][Folder] C:\ProgramData\FFinder LTD -> Found

Please download ZHPCleaner to your desktop.

Close all applications (including your web browsers and antivirus)

Double-click on ZHPCleaner to run the tool.

If you are using Windows Vista, 7/8/10; instead of double-clicking, right-mouse click ZHPCleaner and select "Run as Administrator".

Please click the "J'accepte/I agree" button.

First press the "Scanner" button. Be patient, the scan takes longer than 5mins.

Do NOT fix/repair anything yet! Please upload that logfile with your next reply.

Then download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: Make sure you download the correct version ( 32 bit or 64 bit ) for your PC. Only the correct version will run so if you make a mistake and download the wrong one, go back and get the other.

Double-click to run it. When the tool opens click Yes to disclaimer.

Press the Scan button and wait.

The first time the tool is run it makes two logs, FRST.txt and Addition.txt in the same directory the tool is run.

Please upload them in your next reply.

Tell me how your PC is running now.

patrcarl · Nov 14, 2016

Dr. Moriarty,

Thanks again for your help!

I did the RogueKiller work, but the second folder is showing "Error[3]" after the removal process. I exported the report and attached it here.

I also ran the other two scans and attached their related reports here.

I noticed an Ask.com toolbar from the ZHP report ... that's an example of something I definitely don't want/need. So, feel free to let me know anything else that you see in these that I might not want, and how to get rid of them.

You are much appreciated!

dr.moriarty · Nov 14, 2016

Your system's startup and shutdown time could be trimmed down by thinning your Scheduled Tasks.

Re-run ZHPCleaner per previous instructions

After the scan has completed - press the Repair button.

Browsers will automatically shut down.

A logfile will automatically open after the scan has finished.

Please upload that logfile with your next reply.

Tell me how the PC is now running.

patrcarl · Nov 16, 2016

Hey Doc - I ran ZHPCleaner and repaired everything it found. Attached is the report. Everything with the computer seems to be running great but it may be too early to tell .

I did trim down the Scheduled Tasks for startup, like turning off the aut0-start on the Apple products, but not sure what else might be a scheduled task that I would change. Could you tell me a few common examples, and where to turn them off?

Alas, the item that I still don't understand is why, at rest, my task manager is showing a minimum of 8% CPU usage at all times, and minimum of 40% memory usage. I do have about 25 tabs open on Chrome, but can't imagine that having this significant of an impact. Perhaps I need to expand allocation to each of those?

I'm running Windows 8.1 on a Dell XPS laptop with a solid state hard drive, i7 processor and 16gb of RAM, so hardware shouldn't be the issue here .

I don't do any gaming, and only use this for Excel spreadsheets, email, and web. The tasks that seem to be taking up most of the memory allocation are:
Chrome - 145 MB
Outlook - 102 MB
Skype - 72 MB

But I also have 122 Background processes running ... and some individual programs have a lot:
36 from Chrome
5 from HD Audio Background Process
12 are various from Intel
9 are various from NVIDEO

dr.moriarty · Nov 16, 2016

patrcarl said: ↑

the item that I still don't understand is why, at rest, my task manager is showing a minimum of 8% CPU usage at all times, and minimum of 40% memory usage. I do have about 25 tabs open on Chrome, but can't imagine that having this significant of an impact.
....
But I also have 122 Background processes running ... and some individual programs have a lot:
36 from Chrome
5 from HD Audio Background Process
12 are various from Intel
9 are various from NVIDEO
Click to expand...

A look at your sysinfo.txt shows 6 GB + RAM being used while you have the above going on, quite a bit actually. The best forum for tweaking your system's performance is the Software Forum, as your PC is now malware-free.

It is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase it, it provide no protection. It do not use any significant amount of resources ( except a little disk space ) until you run a scan.

Go back to step 6 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, Win 7/8/10 - it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Go to the C:\MGtools folder and find the MGclean.bat file. Double-click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7/8/10, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work through the below link:

How to Protect yourself from malware!

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

Log in or Sign up

Occassional Pops "virus Detected" Website, And Computer Always Running At High Memory Usage

patrcarl Private E-2

Attached Files:

HitmanPro_20161109_2331.log

RK Log 11-9-16.txt

MGlogs.zip

MalwareBytes Log 11-9-16.txt

dr.moriarty Malware Super Sleuth Staff Member

patrcarl Private E-2

Attached Files:

Addition.txt

FRST.txt

RK Log 11-14-16.txt

ZHPCleaner Log 11-14-16.txt

dr.moriarty Malware Super Sleuth Staff Member

patrcarl Private E-2

Attached Files:

ZHPCleaner Log 11-15-16.txt

dr.moriarty Malware Super Sleuth Staff Member