[Wolfman360]

Dear G2G team,

 

I recently installed NetExtender for a work project and today windows defender informed me that the version I installed was actually a rigged version

https://www.sonicwal...ers-information

https://www.microsof...atID=2147944484

 

I've removed the virus flagged by Windows Defender but I still have parts of NetExtender showing on my computer. I was hoping you would be able to help with ensuring it is all completely removed and that there are no other viruses present please. Anything Sonicwall/Netextender if this could be removed please.

 

Many thanks,

 

FRST Logs attached.

Attached Files

•  FRST.txt   85.64KB   20 downloads
•  Addition.txt   171.75KB   12 downloads

[Advertisements]

Hello ,  Wolfman360..!    My name is icotonev and I'm here to help you remove malware ..! 

 

Please give me some time to examine your logs and I will get back to you as soon as possible.

 

Thank you..!   

 

 

[icotonev]

Hello ,  Wolfman360..!    My name is icotonev and I'm here to help you remove malware ..! 

 

Please give me some time to examine your logs and I will get back to you as soon as possible.

 

Thank you..!   

 

 

[icotonev]

Farbar Recovery Scan Tool - Fix
 
NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone
 
Please download the attached file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.
 
Run FRST and click Fix only once and wait.
 The Computer will restart when the fix is completed.
 

It will create a log (Fixlog.txt) please post it to your reply.

• Copy/paste the following in the Search: box

Searchall: SonicWall;NetExtender

• Click Search Files button

• When completed click OK and a Search.txt document will open on your desktop

• Аttach the report in your reply. If the file is too large zip and upload it here.

 

In your next reply, please include:

• Fixlog.txt

• Search report

 

•  fixlist.txt   15.83KB   8 downloads

[Wolfman360]

Thank you for your help it is greatly appreciated.

 

See attached below

Attached Files

•  Fixlog.txt   35.44KB   7 downloads
•  Search.txt   16.36KB   9 downloads

[icotonev]

Thank you ..! Let"s remove the leftovers..!

 

Farbar Recovery Scan Tool - Fix
 
NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone
 
Please download the attached file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.
 
Run FRST and click Fix only once and wait.
 The Computer will restart when the fix is completed.
 

It will create a log (Fixlog.txt) please post it to your reply.

 

 

In your next reply, please include:

 

 fixlist.txt   9.5KB   4 downloads

[Wolfman360]

Many thanks - see attached.

 

 

Occasionally finding that my computer goes a bit slow/mouse stutters. Whether you'd be able to help to look in to this too?

Attached Files

•  Fixlog.txt   10.02KB   4 downloads

[icotonev]

Thank you ..!

IMPORTANT: Please allow FRST to announce that the procedure has been completed. A message will be generated on your desktop..! 

 

Fresh FRST logs

 

Please run FRST tool once more, and attach for me fresh logs:

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produce two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach these two logs in your next reply.

 

Run Malwarebytes

• Download Malwarebytes and save it to your Desktop.
• Once downloaded, close all programs and Windows on your computer.
• Double-click on the icon on your desktop named MBSetup.exe. This will start the installation of MBAM onto your computer.
• Follow the instructions to install the program.
• When finished, double click the program's icon created on your Desktop.
• Click the little gear on the top right (Settings) and when it opens, click the General tab. Under the title Windows Security Center, make sure the option is disabled.
• Click the Scan and Detections tab and under the Scan options title, enable Scan for rootkits option. Do not change any other option.
• Return to the Dashboard and choose Scan.
• Malwarebytes will now scan your computer for browser hijackers and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check the status of the scan to see when it is finished.
  • When removing files, Malwarebytes may require a reboot to fully eliminate some threats. If you see a message indicating that a reboot is needed, please allow it. Once your computer has restarted and you are logged back in, you can continue with the remaining steps.
• When finished, you will see the Threat Scan Summary window open.
• If threats are not found, click View Report and proceed to the two last steps below.
  
  If threats are found, make sure that all threats are selected and click the "Quarantine" button.
  • Malwarebytes will now delete all of the files and registry keys and add them to the program’s quarantine.
  • Open Malwarebytes again, click on the Scanner, and then on the Reports tab.
  • Find the report with the most recent date and double click on it.
  • Click on Export and then Copy to Clipboard.
  • Paste its content here, in your next reply.

 

Scan with SecurityCheck by glax24

• Temporarily disable Microsoft SmartScreen only if it blocks the download of the software. The program is safe
• Download SecurityCheck by glax24 from here
• If SmartScreen blocks the file from running click on More info and Run anyway
• This tool is safe. Smartscreen is overly sensitive. You can check the VirusTotal scan of the tool from here
• Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow it to run
• Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file. Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

 In your next reply, please post:

• Fresh FRST logs
• The Malwarebytes report
• SecurityCheck.txt

[Wolfman360]

Hi Hristo,

 

Thanks for your help. Nothing on the MBAM scan. See other scans attached.

 

Thanks,

Attached Files

•  Addition.txt   174.52KB   4 downloads
•  FRST.txt   82.11KB   5 downloads
•  SecurityCheck.txt   14.63KB   3 downloads

[icotonev]

Thank you ..! :)

 

Mandatory step:

 

deviceTRUST ICA Client Extension v25.3 x64 v.25.3.120.0 Warning! This software is no longer supported. Please uninstall it and use another software.

Malwarebytes version 5.3.2.195 v.5.3.2.195 Warning! Download Update

deviceTRUST ICA Client Extension v25.3 x86 v.25.3.120.0 Warning! This software is no longer supported. Please uninstall it and use another software.

Speccy v.1.32 Warning! Download Update

NVIDIA GeForce Experience 3.27.0.120 v.3.27.0.120 Warning! Download Update

PowerShell 7-x86 v.7.2.0.0 Warning! Download Update

Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433 v.14.42.34433.0 Warning! Download Update

Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433 v.14.42.34433.0 Warning! Download Update

WinRAR 5.71 (64-bit) v.5.71.0 Warning! Download Update

Discord v.1.0.9004 Warning! Download Update

Zoom v.5.17.5 (31030) Warning! Download Update

Java 8 Update 251 (64-bit) v.8.0.2510.8 Warning! Download Update

Uninstall old version and install new one (jre-8u451-windows-x64.exe).

Java 8 Update 291 v.8.0.2910.10 Warning! Download Update

Uninstall old version and install new one (jre-8u451-windows-i586.exe).

Spotify v.1.2.5.1006.g22820f93 Warning! Download Update

Google Chrome v.137.0.7151.120 Warning! Download Update

 

 

Recommended step (you decide):

 

Razer Cortex v.9.13.18.1333 Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall. Possible you became a victim of fraud or social engineering. Computer experts no longer recommend this program.

 

Wondershare Helper Compact 2.6.0 v.2.6.0 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.

 

 

 

Next..:

 

Farbar Recovery Scan Tool - Fix
 
NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone
 
Please download the attached file to the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.
 
Run FRST and click Fix only once and wait.
 The Computer will restart when the fix is completed.
 

It will create a log (Fixlog.txt) please post it to your reply.

 

 

Next..:

 

DoesNotBelong

Temporarily disable Smart Screen and your antivirus (if needed) to download and run the following tool:
Please download DoesNotBelong.exe and save it to your desktop.

Note: Please save all your existing work / windows as this tool will attempt to close all non-essential processes during the course of its scan. This includes the internet browser you're currently using to view this message and Windows explorer (temporarily).

• Right-click DoesNotBelong.exe and then click Run as administrator.
• Click Yes to the Disclaimer
• The script will begin to run. Be patient.
• When the scan is finished, a log entitled DoesNotBelong_[date]_[time].txt will be on the desktop and at C:
• Attach DoesNotBelong_[date]_[time].txt to your next reply

 

In your next reply, please include:

• Fixlog.txt
• DoesNotBelong_[date]_[time].txt

 

 

 fixlist.txt   2.2KB   5 downloads

 

[Wolfman360]

Thank you - I'll enact the changes you've recommended. In the interim here are the logs

 

Thanks!

Attached Files

•  Fixlog.txt   7.84KB   2 downloads
•  DoesNotBelong_2025_07_04__13_54_19.txt   25.44KB   2 downloads

[Wolfman360]

The fix seems to have allowed all startup programs to run again, the system is now quite slow, videos I'm watching on youtube are stuttering.