Dell

Greetings and welcome to the Major Geeks Malware Forum.

Please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

• Download FRST64 and save the file on your Desktop
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• When completed, FRST.txt and Addition.txt reports will be saved on the Desktop
• Please attach the reports to your reply

===================================================

Things I would like to see in your next reply.

• Attached reports

 

Thank you for the reports.

It does not appear Webroot is currently installed. Was it once present then uninstalled?

Please do this.

===================================================

Farbar Recovery Scan Tool SearchAll

--------------------

• Launch FRST
• Copy and paste the following in the Search: box

Code:

SearchAll: AnyDesk;philandro;OneStart;PDFEditor;McAfee;Webroot

• Click the Search Files button
• When completed click OK and a Search.txt document will open on your desktop
• Please zip and upload the file to GoFile or the file hosting site of your choice and post the download link in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Webroot?
• Download link

 

There are AnyDesk files still on the computer. We are also going to remove entries related to Webroot, McAfee,OneStart, and PDFEditor.

Please do this. It would be helpful to take a cellphone picture of, or print out the instructions for reference.

Create a Restore Point and confirm it is successful before continuing further.

===================================================

Farbar Recovery Scan Tool Fix - Safe Mode Command Prompt with Attached File

--------------------

• If necessary, download Farbar Recover Scan Tool for 64 bit systems and save it to a USB device
• Download and save the attached Fixlist.txt onto the same USB device
• Click Start, type msconfig, then select Run as administrator
• Click on the Boot tab
• Check Safe boot, then select Alternative shell
• Click Apply, then OK
• Click Restart and allow the black Command Prompt window to appear
• Insert the USB device into your compromised computer
• In the command window type in Notepad and press Enter.
• Click File then select Open
• Locate and and left click on your USB drive letter
• Near the lower right hand corner of the Open window change Text Documents (*.txt) to All Files (*.*)
• Right click on the FRST64 icon and select Run as administrator
• Click Yes to disclaimer that may appear
• Press Fix
• Click OK to automatically restart your computer into Normal Boot
• A fixlog.txt file will be saved on the USB drive. Please attach the report to your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Attached Fixlog

 

Yes please.
You can press Enter to get to the below options of if that is not available you can follow the below.

===================================================

System Restore From Windows 10 Recovery Environment

--------------------

• Start the compromised computer then and after 5-10 seconds hold down the power button until the computer shuts down. Do this step twice
• Restart the computer and you should then see Preparing Automatic Repair, Diagnosing your PC, then Advanced options
• Select Advanced options
• Select Troubleshoot
• Select System Restore
• Select the user account and provide the password if requested
• Click Next, select a Restore Point prior to the issue arising
• Click Next, Finish, then Yes
• If you receive a notice of anything other than System Restore Competed Successfully repeat the steps and select an older restore point

 

Great.

Let's do this a little differently.

===================================================

McAfee Consumer Product Removal Tool

--------------------

• Please download McAfee Consumer Product Removal Tool and save it to your Desktop
• Right click the icon and select Run as administrator
• Select Run
• Click Next
• Select Agree then Next
• Complete Security Validation and click Next (letters are case sensitive)
• When prompted click Restart

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Code:

Start::
CreateRestorePoint:
CloseProcesses:
C:\Windows\System32\spool\drivers\x64\PCC\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a.cab
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a.ini
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver-manifest.ini
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.cat
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriver.gpd
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\anydeskprintdriver.inf
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\anydeskprintdriver.PNF
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter-PipelineConfig.xml
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a\AnyDeskPrintDriverRenderFilter.dll
C:\Users\Tim\Downloads\AnyDesk.exe
C:\Users\Tim\AppData\Local\Temp\AnyDeskUninst18af.exe
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk
C:\Windows\System32\DriverStore\FileRepository\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
C:\Users\Tim\Videos\AnyDesk
C:\ProgramData\AnyDesk
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\USBPRINT\AnyDesk
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\WSDPRINT\AnyDesk
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.anydesk
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\AnyDesk
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\PackageInstallation\Windows x64\DriverPackages\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\PrinterMigrationEx\AnyDesk Printer
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AnyDesk
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Print\PackageInstallation\Windows x64\DriverPackages\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Print\PrinterMigrationEx\AnyDesk Printer
DeleteKey: HKEY_USERS\S-1-5-21-1753294736-2213500278-957046147-1002\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Cloud\{fcbddc29-b076-49a5-9202-0da4c4dd7319}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$anydesk
DeleteKey: HKEY_USERS\S-1-5-21-1753294736-2213500278-957046147-1002\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\{fcbddc29-b076-49a5-9202-0da4c4dd7319}$windows.data.apps.appmetadata$appmetadatalist\windows.data.apps.appmetadata$anydesk
DeleteKey: HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\anydeskprintdriver.inf_amd64_07b22d0a6997cb3a
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• McAfee removed?
• Fixlog

 

Let's do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Code:

Start::
CreateRestorePoint:
CloseProcesses:
C:\Users\Tim\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_myaccount.webroot.com_0.indexeddb.leveldb
C:\Program Files\Webroot
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\webroot
Powershell: Get-AppxPackage -allusers *5A894077.McAfeeSecurity* | Remove-AppxPackage
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog

 

Thank you.

Are you getting any Javascript error messages? How is your computer performing?

 

Great.

There are some AnyDesk remnants resisting traditional efforts to remove them but they are of no consequence.

Are there any remaining questions or concerns you might have before I post some tool/log clean up instructions and other information for you to consider going forward?

 

Excellent.

Here is our final step and some additional information to consider.

===================================================

KpRm by Kernel-panik

--------------

• Download KpRm and save it to your Desktop (see here if you must use Chrome)
• Note: If the file is detected as malware it is not and it is safe to download. The detection is a false positive.
• Right click on the icon and select Run as administrator
• Click Yes on the Disclaimer
• Place a check mark in Delete Tools, Create Restore Point, and Delete in 7 days
• Click Run
• Click OK on All operations are completed
• KpRm will delete itself from you Desktop and you can either save or remove the report that is generated
• You are free to remove any other tools/reports still remaining

===================================================

All Clean!

--------------

Your computer is now clean. Please consider this going forward.

• Answers to common security questions - Best Practices
• So How did I get infected?
• Why I Stopped Using Third-Party Antivirus on Windows
• Pirated Software is All Fun and Games Until Your Data is Stolen
• Why You Should Update All Your Software

Thank you for placing your trust in Major Geeks. It was a pleasure serving you.

 

My pleasure, you are always welcome here.