Inactive HKCU\Software\Cyber threat

[fulf]

So, yesterday I went to download a book online. Being distracted this time I clicked on one of the big (ad) download buttons instead of the real one. Without knowing that, I also clicked the download on Chrome, so that it will open after it's finished. Next thing I know, my computer starts to run really slow and have lots of hiccups.

I ran Malwarebytes and removed 98% of the threats. The only remaining one is in the registry, HKCU\Software\Cyber.

Manually removed - appears after restart

Read the internet, deducted svchost.exe is the problem. Compared it with a clean PC, it was 4KB smaller. I replaced it with the clean one, but the registry still appears.

I've ran out of solutions unfortunately.

 

[fulf]

Fixed it:

Went to TaskManager, Processes and found two suspicious processes. I hit Open Process Location, and it sent me to Temp. From there I knew these were the malicious ones.

One is named sys(something).exe and the other I have no idea. After deleting them, I ran CCleaner and it reported to have sys(something).exe in a autorun registry from Windows. (it reported that because I have deleted the file).

 

[Broni]

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

 

[fulf]

Thanks for the warm welcome!

You can close the topic right away, I fixed it. I'm 100% sure my PC is clean. I know my PC ^^ (being a programmer and all has it's benefits).

Anyway, if I'll encounter more problems that I can't solve, I'll be sure to drop by again and follow those steps first.

Have a nice day,
Fulf

 

[Broni]

Same to you