Virus/Malware issue, unable to permanently detect or remove from anti-virus

Hi Dilip

For STATUS_INVALID_IMAGE_HASH look through

https://support.google.com/chrome/thread/40711305?hl=en 

https://support.google.com/chrome/thread/42231261?hl=en 

https://support.google.com/accounts/thread/41689406?hl=en

If nothing there fixes it, you may need to do a complete Chrome uninstall then install.

It would appear that the malware has been on your computer since July 8, and the file that kept reinstalling the mal extension was

C:\Program Files (x86)\AgentBackground\SdttingsEame\KRDIAI_LlockeMPR.dll

run from the scheduled task \Hewlett-Packard\Avgvrzbkok

:)

Hi Dilip,

This should sort things out for you.

Select all the text between the asterisks so that it is highlighted, then press Ctrl + C to copy it to the clipboard.

Run FRST as administrator and press the Fix button.

The computer will restart to complete the cleaning process.

A fixlog.txt file will be created in the FRST directory, attach this to your next reply.

*******************************************************************************

Start::

CreateRestorePoint:

CloseProcesses:

HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

Task: {B495BEFC-FF0E-4785-BFE5-D5EAAB3B12B3} - System32\Tasks\Hewlett-Packard\Avgvrzbkok => C:\windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Program Files (x86)\AgentBackground\SdttingsEame\KRDIAI_LlockeMPR.dll" /nologo /u /silent

VirusTotal: C:\Program Files (x86)\AgentBackground\SdttingsEame\KRDIAI_LlockeMPR.dll

C:\ProgramData\Tjdu

C:\Program Files (x86)\AgentBackground

S4 HPPrintScanDoctorService; "C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe" [X]

S4 WirelessKB850NotificationService; %SystemRoot%\system32\WirelessKB850NotificationService.exe [X]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\1624293810doc.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\BOI RECEIPT 1.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\Drawing.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\ESBTR Generation Process - Step by Step Guide.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\HDFC SEC CKYC FORM.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Desktop\IGR - HDFC.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\Affidavit.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\Application (1).pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\Application.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\FLORA DA COPY 1.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\FLORA DA COPY 2.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\FLORA DA COPY.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\SALE AGREEMENT-1.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\SALE AGREEMENT-2.pdf:SandBoxSafeFile [0]

AlternateDataStreams: C:\Users\Dilip Kothari\Downloads\Statement.pdf:SandBoxSafeFile [0]

FirewallRules: [{E9AF449C-C9FD-456D-A975-0F8E325D75C7}] => (Allow) C:\Users\Dilip Kothari\AppData\Roaming\Zoom\bin\airhost.exe => No File

FirewallRules: [{28A1DDFA-CCF1-421B-BE4F-0DEEFCC2EB34}] => (Allow) C:\Users\Dilip Kothari\AppData\Roaming\Zoom\bin\airhost.exe => No File

FirewallRules: [{7B80975D-FAAA-4C00-8E6A-A5EBCCCDAFCA}] => (Allow) C:\windows\rss\csrss.exe => No File

EmptyTemp:

End::

*******************************************************************************

There also seems to be a problem with your Windows Update service.

Download the following registry file. Double click the reg file and allow it to merge with the registry, then restart your computer.

https://www.tenforums.com/attachments/tutorials/267530d1582122655-restore-default-services-windows-10-a-windows_update.reg

See if you are able to successfully check for any Windows updates.

Let me know how things are running.

Hey Carlo!

Hope you're having a good day.

I tried the above but sadly the malware was not detected in system. Do you have any other suggestions on how to go about it?

Wishing you have a fantastic weekend ahead!

Regards,

Dilip.

Collect all sample of this malware and place them into a zip file and submit them to Microsoft.

Take a look at Submit a file for malware analysis - Microsoft Security Intelligence

Good Day Dilip-Kothari,

My name is Carlo, I'm an Independent Advisor and community member like you.

I am also using Windows 10 pc. Let us work together to sort this out.

First, try boot your computer is safemode.

-Press the Windows logo key + R.

-Type msconfig and hit enter

-Select the Boot tab.

-Under Boot options, clear the Safe boot checkbox.

-Click "Network" below Safeboot for you to have internet connection while on Safemode

-Click Apply then ok.

Once your computer on Safemode, go to this link below and download the free version of Malwarebytes scanner to check if there are malwares or adware running in your system.

https://www.malwarebytes.com/mwb-download/thank...

Once downloaded and installed, open the app and perform a scan.

Check if there are malwares detected , restart your computer once the scan is done.

I hope the information above helps. Please let me know how it goes.

Have a wonderful day ahead and stay safe.

Sincerely,

Carlo T.

Standard Disclaimer: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.