Solved Windows Powershell randomly popping up, MBytes blocking outbound comm

[Glockwork Orange]

Hi,

please see the info above. MBytes blocked communication marked as "macrosoftman[.]info" which I tracked to the following site: https://www.cybereason.com/the-dawn-of-sophisticated-powershell-adware-campaigns/

And also to another user's post that had a solution but it was marked as individual and potentially dangerous and/or not working for another system, so I am asking for help myself as well.

Thanks in advance.

 

[TwinHeadedEagle]

Hello,


Please download Zemana AntiMalware and save it to your Desktop.

• Install the program and once the installation is complete it will start automatically.
• Without changing any options, press Scan to begin.
• After the short scan is finished, if threats are detected press Next to remove them.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.​

• Open Zemana AntiMalware again.
• Click on
  
  icon and double click the latest report.
• Now click File > Save As and choose your Desktop before pressing Save.
• The only left thing is to attach saved report in your next message.

 

[Glockwork Orange]

Thanks Blondie.

I ran it, it found a whole bunch of stuff that the FRST report pointed out. Attaching the report of Zemana and I also ran a new report of FRST in case it's of any interest.

I cannot confirm right away if it had helped or not (the PowerShell popups are rather random).

 

[TwinHeadedEagle]

Please remove this from your Control Panel:
DNS Unlocker (HKLM-x32\...\DNSUnlocker.ns) (Version: - ) <==== ATTENTION


And let me know if everything is okay now.

 

[Glockwork Orange]

Hi again,

I seem to be unable to remove it from the Control Panel. I think I may have deleted it manually some time ago, so the files don't actually exist on my drive (when I try to click uninstall in CP, it says it could not find the uninstall.exe in a folder that well, does not exist anymore).

I suppose I should manually remove its entry in the registry?

 

[TwinHeadedEagle]

Yes, if you know how, please do it.