Trojan Multi DNS Changer in System memory, advanced disinfection stuck at 1% problem

[naba23]

Advanced disinfection stuck at 1% and 0 files scanned. Other scan like quick scan just keeps loading.

[Berny]

@naba23 Welcome. Can you please submit a screenshot.

[naba23]

I restarted my laptop and it eventually disappeared. But this is the file that is being detected and every time I click disinfect and restart the computer, the “advanced disinfection stuck at 1% and 0 files scanned” appears and it is just stuck there.

[Berny]

@naba23 Can you please provide a GSI Log :

https://support.kaspersky.com/common/diagnostics/3632 

[naba23]

Here

[Berny]

@naba23

Please download and run AdwCleaner as ADMIN.
1)  ⚠ Don’t fix eventual detections ⚠
2)  Please attach the TXT Log in your next post

[naba23]

here

[Berny]

@naba23 Here are some suspicious PUP entries

***** [ Registry ] *****PUP.Optional.DNSUnlocker        HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220EPUP.Optional.DNSUnlocker        HKLM\Software\Wow6432Node\\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220EPUP.Optional.DNSUnlocker.ACMB2  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E1527582-8509-4011-B922-29E3FB548882}_is1PUP.Optional.Legacy             HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\azlyrics.comPUP.Optional.Legacy             HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.azlyrics.comPUP.Optional.Legacy             HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\azlyrics.comPUP.Optional.Legacy             HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.azlyrics.comPUP.Optional.TheBrightTag       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\s.thebrighttag.comPUP.Optional.TheBrightTag       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\thebrighttag.comPUP.Optional.TheBrightTag       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\s.thebrighttag.comPUP.Optional.TheBrightTag       HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\thebrighttag.comPUP.Optional.Wajam              HKCU\Software\WajIEnhancePUP.Optional.Wajam              HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9PUP.Optional.Wajam              HKLM\Software\SrcAAAesom Browser EnhancerPUP.Optional.Wajam              HKLM\Software\Wow6432Node\SrcAAAesom Browser EnhancerPUP.Optional.Wajam              HKLM\Software\Wow6432Node\\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9

• Please take care to backup your registry ⚠
• Run AdwCleaner as ADMIN
• Clear only above entries ⚠
• Don’t clear the preinstalled entries ⚠
• Reboot

[naba23]

Hi, do I have to backup my registry first before deleting those? I don’t know how to backup registry. Thanks.

[Berny]

@naba23 Please follow these steps :

• Run “REGEDIT”
• Select “File”
• Select “Export”

[naba23]

Hi, i followed the instructions on deleting the PUP entries. There is one left. Here is my updated TXT log.

[Berny]

@naba23 Please clean it.

[naba23]

It is all cleaned thank you. What do I do next?

[Berny]

@naba23 If the problem is persisting please contact K-Lab Technical Support : https://center.kaspersky.com 

[naba23]

thank you so much! lastly, what do I do with the quarantined files on the adwcleaner do i delete them?

[Berny]

@naba23 The quarantined malicious files will not harm your system , please keep them temporary before trashing.