Sure, here’s the re-scan which I had already run after removing earlier today.
However, just now, after rebooting later in the day, it found another threat through its realtime protection, this is the entry in the protrection log (not a scan log):
[*]Wait for initial scan to finish - if there is any query, click No;
[*]Click Scan button and wait until the full scan is complete;
[*]Click Save … - save the report to the Desktop (named Gmer );
1. Open notepad and copy/paste the text present inside the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts C:\export.reg
cmd: del %windir%\temp\*.* /f /s /q
cmd: del %temp%\*.* /f /s /q
2. Save notepad as fixlist.txt to your Desktop. NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait. If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply. Note: If the tool warned you about the outdated version please download and run the updated version.
I’ve attached the fixlog, but it didn’t make an export.reg.
I saw this:
========= reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts C:\export.reg =========
ERROR: The system was unable to find the specified registry key or value.
I have been having the same problem, nothing found by malwarebytes, etc.
However, I’ve had no notifications about port 6881 until a couple of minutes after I started Tune-In Radio. Do you run this too? (Windows 8 application)?
There is no malware here…there were signs of malware, but it is not active…
We need to remove used tools:
Preuzmi “Xplode”-ov DelFix i saèuvaj ga na Desktop
[*] Dvoklikom pokreni program.
Štikliraj sledeæe opcije:
[] Remove disinfection tools
[] Purge System Restore
[*] Reset system settings
[*] Klikni na dugme “Run” i prièekaj da program završi rad. Alat ce ukloniti sve koriscene alate u ovoj temi…
[*] Kada alat završi, otvoriæe izvestaj u notepadu. Napomena: Izvestaj ce takodje biti sacuvan na C:\DelFix.txt
As far as I know, I do not have BingDesktop installed, so I don’t know why they were there. I was unable to remove them until I rebooted into recovery mode command prompt (see Advanced Startup Options).
I’ve also had this report from RogueKiller previously:
I can’t understand why it’s considered a false positive. Here is what I know:
My laptop has been trying to make 6881 connections from explorer.exe to random sites in Eastern Europe for weeks now
I did not have Bing Desktop installed (it’s listed in Updates, but not selected for download)
I have no torrent software installed
I had DLLs installed that were being held open by some process (presumably explorer.exe - I didn’t check this)
Since I removed the DLLs, all suspicious 6881 connections have ceased.
Personally I’m convinced those DLLs are malware, yet nothing would detect and remove them. Hence, I contest the false positive classification applied to those DLLs.