Url re-direct, weird and slow internet, setting change?

[SuperMann]

Hi everyone, can someone help me out with this:

Url re-direct, weird and slow internet, setting change, another storage wtf?

I think someone can have access to my pc, I when to kick em out? What I need to do?

Thanks alot

SuperMann

[SuperMann]

I have just made the FRST 64bit like I have seen on the forum, take a look!

[veeg]

Hello

I will tag our expert.

@Malnutrition

[SuperMann]

Hello

I will tag our expert.

@Malnutrition

Thanks alot!

[Malnutrition]

OK, I just got the alert. I will take a look at the logs here in about an hour.

[SuperMann]

OK, I just got the alert. I will take a look at the logs here in about an hour.

Thanks alot, I really appreciate! I have nothing important on my pc, but I need it secure, I can’t work when I dont have the control of my OWN pc .

[Malnutrition]

Adware Cleaner

[ul]
[li]Download AdwCleaner and save it to your Desktop[/li][li]Right-click on AdwCleaner.exeand select, Run as Administrator[/li][li]Accept the EULA (I accept), then click on Scan Now[/li][li]Let the scan complete[/li][li]Once the scan completes, make sure that every item listed in the different tabs is checked and click on the Quarantine and delete.[/li][li]Once the cleaning process is complete, AdwCleaner will ask you to restart your computer[/li][li]Close all other open windows and allow it to restart[/li][li]After the restart, Notepad will open with the AdwCleaner cleaning log[/li][li]Please Attach the contents of that log into your next reply to me[/li][/ul]

---

Download Malwarebytes v.4 . Install and run.

[ul]
[li]Once the MBAM dashboard opens, click on Settings (gear icon).[/li][li]Click on Security tab and make sure that all four Scan options are enabled.[/li][li]Close Settings and click on the Scan button on the dashboard.[/li][li]Once the scan is completed make sure you have it quarantine any detections it finds.[/li][li]If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.[/li][li]If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.[/li][li]If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and include that log on your next reply.[/li][/ul]

[Malnutrition]

@SuperMann

Copy the content of the code box below.
[COLOR=rgb(184, 49, 47)]Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.

start::
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
GroupPolicy\User: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKLM-x32\...\RunOnce: [360safeuninst_1f0fb7c2d13cc0c07ff2ca40747bc03e] => C:\Users\Me\AppData\Local\Temp\1f0fb7c2d13cc0c07ff2ca40747bc03e_remove360.bat [632 2023-09-13] () [File not signed] <==== ATTENTION
HKLM\...\Policies\Explorer: [HideSCAMeetNow] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKU\S-1-5-21-2118630591-2447159386-1078315589-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKU\S-1-5-21-2118630591-2447159386-1078315589-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 24.201.245.77 24.200.243.189
Tcpip\..\Interfaces\{89540600-8c74-4bea-8001-fe67aced12ae}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{b695eff4-2933-4378-9d47-fadb9fa53d0d}: [DhcpNameServer] 192.168.0.1 24.201.245.77 24.200.243.189
Tcpip\..\Interfaces\{cd30e077-5e47-4959-8372-424c099b15b4}: [DhcpNameServer] 192.168.0.1 24.201.245.77 24.200.243.189
Tcpip\..\Interfaces\{fce0ef15-df65-4d77-bcea-6776fd0d7f1e}: [DhcpNameServer] 192.168.0.1
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\116.1.57.64\elevation_service.exe" [X]
S4 QHActiveDefense; "C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" [X]
S4 QHProtected; "C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" [X]
S4 uhssvc; "C:\Program Files\Microsoft Update Health Tools\uhssvc.exe" [X]
C:\Program Files (x86)\360
R3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [110800 2023-03-15] (Beijing Qihu Technology Co., Ltd. -> 360.cn)
R3 360netmon; C:\Windows\System32\DRIVERS\360netmon.sys [96424 2023-03-15] (Qihoo 360 Software (Beijing) Company Limited -> 360.cn)
C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys
C:\Windows\System32\DRIVERS\360netmon.sys
R3 360Box64; system32\DRIVERS\360Box64.sys [X]
S1 epp; \??\C:\Users\Me\Desktop\Downloads\Malware Removal\bin64\epp.sys [X]
C:\Windows\Tasks\360Disabled
2023-09-13 10:22 - 2023-09-13 11:31 - 000000000 ____D C:\Users\Me\AppData\Roaming\360DesktopLite
2023-09-13 10:22 - 2023-09-13 10:22 - 094499560 _____ C:\Users\Me\Desktop\360TS_Setup.exe
2023-09-13 10:22 - 2023-09-13 10:22 - 000000000 ____D C:\Program Files (x86)\360
2023-09-13 10:22 - 2023-03-15 01:02 - 000540416 _____ (360.cn) C:\Windows\system32\Drivers\360FsFlt.sys.685
2023-09-13 10:22 - 2023-03-15 01:02 - 000360664 _____ (360.cn) C:\Windows\system32\Drivers\360Box64.sys.816
2023-09-13 10:22 - 2023-03-15 01:02 - 000238304 _____ (360.cn) C:\Windows\system32\Drivers\BAPIDRV64.SYS.upd
2023-09-13 10:22 - 2023-03-15 01:02 - 000110800 _____ (360.cn) C:\Windows\SysWOW64\Drivers\360AvFlt.sys
2023-09-13 10:22 - 2023-03-15 01:02 - 000110800 _____ (360.cn) C:\Windows\system32\Drivers\360AvFlt.sys.000
2023-09-13 10:22 - 2023-03-15 01:02 - 000096424 ____N (360.cn) C:\Windows\system32\Drivers\360netmon.sys
C:\ProgramData\Norton
C:\ProgramData\Emsisoft
CustomCLSID: HKU\S-1-5-21-2118630591-2447159386-1078315589-1001_Classes\CLSID\{4e6f7264-5650-4e00-0000-000000000000}\localserver32 -> "C:\Program Files\NordVPN\NordVPN.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-2118630591-2447159386-1078315589-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Me\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2118630591-2447159386-1078315589-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Me\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2118630591-2447159386-1078315589-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\Me\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe => No File
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
CustomCLSID: HKU\S-1-5-21-2118630591-2447159386-1078315589-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Me\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\amd64\FileSyncShell64.dll => No File
C:\WINDOWS\system32\drivers\etc\hosts
C:\WINDOWS\system32\drivers\etc\hosts.ics
Hosts:
CMD: del /f /s /q %windir%\prefetch\*.*
CMD: del /s /q C:\Windows\SoftwareDistribution\download\*.*
CMD: del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
cmd: del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
cmd: del /s /q "%userprofile%\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\*.*"
CMD: del /s /q "%userprofile%\AppData\Local\temp\*.*"
Cmd: NETSH winsock reset catalog
Cmd: NETSH int ipv4 reset reset.log
Cmd: NETSH int ipv6 reset reset.log
Cmd: ipconfig /release
Cmd: ipconfig /renew
Cmd: ipconfig /flushdns
Cmd: ipconfig /registerdns
Cmd: bitsadmin /list /allusers
Cmd: bitsadmin /reset /allusers
Cmd: Winmgmt /salvagerepository
Cmd: Winmgmt /resetrepository
Cmd: Winmgmt /resyncperf
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
emptytemp:
Reboot:
End::

[/COLOR]

[SuperMann]

hi guy, sorry for the delay, so when I do the awdcleaner, my laptop was unable to restard. That clen alot, like 155 things. So I will need a new iage and restard to 0 (I dont have lost anything important).

I want to make sur that’s my pc will be clean and secure with a new image, hope that my network was not hack (alot of strange things happend , even with my android).

I need some help guys!
Thanks in advance

[SuperMann]

ok guy, I dont know wht to do, I am on the other pc I got and literally, someone control it when I try to delete weird new app. Like we do a battle and malawarebyte find 5 things in the registery key but close my pc when I try to delete it! something go wrong man!

Really need help!!
What to do?

[Malnutrition]

Let’s collect new logs.

Download Malwarebytes Support Tool

Once the file is downloaded, open your Downloads folder/location of the downloaded file
Double-click mb-support-1.4.0.615.exe to run the report
You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
Place a checkmark next to Accept License Agreement and click Next
You will be presented with a page stating, “Get Started!”
Do NOT use the button “Start repair” !
Click the Advanced tab on the left column
Click the Gather Logs button
A progress bar will appear and the program will proceed with getting logs from your computer
Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
Please attach the ZIP file in your next reply.

[SuperMann]

Thanks man for your time, I really appreciate!

[SuperMann]

I can’t send the zip file, alwayls something block me, that’s say to big files to upload etc.. I try to s4end it part by part

[SuperMann]

j

[SuperMann]

Sorry to send it like that’s, nothing else is working.

I mean, something or/and someone have control of everything.
I am on my old laptop right now because like I say, The other one will need to be a fresh and new image but before that I need to know what is this, what to do and they probably get control of my network. Cell phone even home phone is really weird in the last 2 weeks.

I see Devtools sometime, plugging, even my vpn was always put back into mesh to share…

I am so tired of this, I really appreciate man!