SOLVED PLEASE HELP! I have a strange running process (MidnightBlueByte).

[davehc]

Ok. Another. In the search bar type the full program name (programrabbittechnology.) and see if it will allow you to delete every instance.

But, you haven't exactly said it, have you tried merely deleting the whole folder?

 

[Radipta]

As I wrote above I can't change anything from there..no option can be changed and I can't kill the process.

View attachment 12862

You can force stop that service with CMD method. Follow these steps:
1. Search for "Command Prompt" > Run as administrator.
2. Type sc queryex ProgramRabbitechnologiesBFO > Enter.
3. Identify the PID.
4. Type taskill /pid [pid number] /f > Enter.
For example you get 0811, then you must type taskill /pid 0811 /f
5. Exit and make sure the service is stopped, then uninstall the program.

 

[Radipta]

Ok. Another. In the search bar type the full program name (programrabbittechnology.) and see if it will allow you to delete every instance.

But, you haven't exactly said it, have you tried merely deleting the whole folder?

It's impossible because the program still running.

 

[Wolfie]

You still haven't told us if you have run your preferred AV app?.

 

[davehc]

It's impossible because the program still running.

Thar was addressed to the op!

 

[davehc]

You still haven't told us if you have run your preferred AV app?.

Or if he has tried in safe mode, or another couple of suggestions.

 

[davehc]

I can see the owner is system - the plot thickens.

Run this reg utility, then right click the folder and "Take ownership" See if you can then get into it and delete anything
Fwiw. Have you ever download a backup program called rabbit-tech

 

[Bastet]

Have you tried my suggestions to run MalwareBytes & AdwCleaner & if so what was the outcome?
Have you registered with the removal forum?
Have you tried uninstalling with Revo Uninstaller?
https://www.revouninstaller.com/products/revo-uninstaller-free/ If it refuses to uninstall then continue with the scan to remove any leftovers, this will force uninstall. If it still fails then you’re infected imo. A browser hijack may not affect other Windows programs. If the browser is constantly redirecting you to other websites then this is a good indication of a browser infection.

Edit: Found this: https://blog.malwarebytes.com/detections/adware-specialsearchoffer/ & https://forums.malwarebytes.com/topic/241332-removal-instructions-for-special-search-option/ which show you ARE infected by a browser hijacker.

 

[davehc]

.? Silence? Hope the op comes back with info. This thread is very interesting. I cannot find any reference to this “virus” on the web, other than postings on other forums by the same op

 

[Kappa69]

Ok so now I'm trying to kill the process in cmd and then delete. If not working then I'll try with Revo Uninstaller. I did scan with MalwareBytes but nothing found. I did not try in safe mode to scan tho but that is in queue TO-DO list.

 

[Kappa69]

You can force stop that service with CMD method. Follow these steps:
1. Search for "Command Prompt" > Run as administrator.
2. Type sc queryex ProgramRabbitechnologiesBFO > Enter.
3. Identify the PID.
4. Type taskill /pid [pid number] /f > Enter.
For example you get 0811, then you must type taskill /pid 0811 /f
5. Exit and make sure the service is stopped, then uninstall the program.

Ok I wrote the first cmd.
Its saying WIN32_OWN_PROCESS and NOT_STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN.

 

[Kappa69]

UPDATE: I force kill it now I'l delete it.

 

[Kappa69]

Ok when I tried to delete its folder...(File in use) and it's back on task manager running.

 

[Wolfie]

Hi,

don't run Malwarebytes, run your Anti Virus app!.

 

[davehc]

What was the answer to my "Have you ever download a backup program called rabbit-tech"

 

[Kappa69]

What was the answer to my "Have you ever download a backup program called rabbit-tech"

No, I didn't. I don't remember installing an app called rabbit-tech or something.

 

[davehc]

OK. Tks for the feedback
I am still trying to trace the source! I see that BPO 's are often ransomeware. You haven't had anyt popups demanding money?

One of the notorious sites for getting this infection is an old Dos site - VETUSWARE.COM . Anything from there?

 

[Bastet]

When running Malwarebytes ensure scan for Rootkits is ticked.

 

[Kappa69]

OK. Tks for the feedback
I am still trying to trace the source! I see that BPO 's are often ransomeware. You haven't had anyt popups demanding money?

One of the notorious sites for getting this infection is an old Dos site - VETUSWARE.COM . Anything from there?

No, I have no pops up just the process sitting there and doing nothing. This is my first time when I clicked on that site so no I don't think i got it from that Dos site. Is there any way to force delete the process from cmd or something ? Taskkill /f did work but the process gets back up. And how can I change the start-up from automatic to manual in service if the option is not clickable ?

 

[Kappa69]

When running Malwarebytes ensure scan for Rootkits is ticked.

I ticked it and I got only one rootkit days ago when I stared this thread and then restarted the pc.