Bovrinox

Thanks Usasma, I have removed daemon tools, the sptd driver wasn't found by the uninstaller. I have removed amd overdrive, ASUS Music maker, ASUS welcome. There is still ASUS Manager and Device Setup in my add/remove programs list, but it wont let me remove them. The Device Setup one says "A program required for this install could not be run". When i try to uninstall ASUS manager, it says "the model does not support this application". Does this mean there are parts of these programs missing, causing some issues? Windows updates found an update for Windows Defender antivirus, so I have downloaded that, no other updates found. I shall try running the driver verifier tonight and see what happens. Thanks Matt

Hey Kevin, Yeah very peculiar. Thinking of thermal paste etc, my friend has a new cpu for me, and some fresh paste to mount it with. Also an after market cpu cooler, so i shall fit those when i can get the chance, if anything changes after that i shall be sure to let you know! Thanks for all your help mate Matt

Here ya go Kevin, hope it helps with your investigations. Matt SearchReg.txt

HI, I dont seem to have the Asus Secure Delete program on my system, so i have run BSODCollectionApp and attached the .zip file it created. I have also attached the Perfmon report for your enjoyment. Cheers Matt SysnativeFileCollectionApp.zip perfom report.zip

Hi there, Had another crash today, not had a chance to try what you have suggested yet but I will do it now. I have attached the new minidump. Thanks, Matt 032018-24687-01.dmp

Cheers Kevin, Here is the search log, it also had another restart today ill post the dump in the BSOD thread Matt Search.txt

Hey there chaps, I have been having problems with my pc randomly restarting for no apparent reason. A grand chap by the name of Kevin has been helping me after fixing an unrelated issue, and he has kindly pointed me in the direction of this forum. The original thread is here with some log files and more info: https://forums.malwarebytes.com/topic/224620-malware-not-removing-things-properly/ Any more insight would be greatly appreciated! Thanks

Hi Kevin, Thanks, i shall do that. Thought you might also be interested in this. It restarted again today almost immediately after logging in, as before no BSOD. It booted up as per normal, however instead of going straight to windows log in, it gave me a plain blue screen with white writing in the middle saying incorrect username and password. I clicked OK, and then logged in as normal, using the same details. It has created another minidump which i have attached. I shall pass on this info as you have suggested, thank you ever so much for all your efforts. Matt 031918-26843-01.dmp

Hi Kevin, Good timing there was just about to log in to my emails to tell you it hasn't, but then i clicked Chrome on my taskbar and it restarted! I checked the advanced system settings again, and it is still set not to restart on system crash, but it did anyway, with no BSOD. It has created a minidump log this time however, which i have attached. Thanks 031818-25265-01.dmp

Hi Kevin, Here is the log from the disk check. I ran it on C: and D: but there is only one log created. The scan on C: was completed almost instantly, which i though peculiar. Log Name: Application Source: Microsoft-Windows-Wininit Date: 17/03/2018 03:12:33 PM Event ID: 1001 Task Category: None Level: Information Keywords: Classic User: N/A Computer: DESKTOP-HB2D13M Description: Checking file system on D: The type of the file system is NTFS. Volume label is Data. A disk check has been scheduled. Windows will now check the disk. Stage 1: Examining basic file system structure ... 538624 file records processed. File verification completed. 2992 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 1244 reparse records processed. 579500 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found. 1244 reparse records processed. Stage 3: Examining security descriptors ... Cleaning up 37 unused index entries from index $SII of file 0x9. Cleaning up 37 unused index entries from index $SDH of file 0x9. Cleaning up 37 unused security descriptors. Security descriptor verification completed. 20439 data files processed. CHKDSK is verifying Usn Journal... 39367936 USN bytes processed. Usn Journal verification completed. Stage 4: Looking for bad clusters in user file data ... 538608 files processed. File data verification completed. Stage 5: Looking for bad, free clusters ... 68315040 free clusters processed. Free space verification is complete. Windows has scanned the file system and found no problems. No further action is required. 1795596287 KB total disk space. 1521518856 KB in 480281 files. 119112 KB in 20440 indexes. 0 KB in bad sectors. 698155 KB in use by the system. 65536 KB occupied by the log file. 273260164 KB available on disk. 4096 bytes in each allocation unit. 448899071 total allocation units on disk. 68315041 allocation units available on disk. Internal Info: 00 38 08 00 dc a3 07 00 3c da 07 00 00 00 00 00 .8......<....... dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" /> <EventID Qualifiers="16384">1001</EventID> <Version>0</Version> <Level>4</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2018-03-17T15:12:33.987436200Z" /> <EventRecordID>11673</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>Application</Channel> <Computer>DESKTOP-HB2D13M</Computer> <Security /> </System> <EventData> <Data> Checking file system on D: The type of the file system is NTFS. Volume label is Data. A disk check has been scheduled. Windows will now check the disk. Stage 1: Examining basic file system structure ... 538624 file records processed. File verification completed. 2992 large file records processed. 0 bad file records processed. Stage 2: Examining file name linkage ... 1244 reparse records processed. 579500 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found. 1244 reparse records processed. Stage 3: Examining security descriptors ... Cleaning up 37 unused index entries from index $SII of file 0x9. Cleaning up 37 unused index entries from index $SDH of file 0x9. Cleaning up 37 unused security descriptors. Security descriptor verification completed. 20439 data files processed. CHKDSK is verifying Usn Journal... 39367936 USN bytes processed. Usn Journal verification completed. Stage 4: Looking for bad clusters in user file data ... 538608 files processed. File data verification completed. Stage 5: Looking for bad, free clusters ... 68315040 free clusters processed. Free space verification is complete. Windows has scanned the file system and found no problems. No further action is required. 1795596287 KB total disk space. 1521518856 KB in 480281 files. 119112 KB in 20440 indexes. 0 KB in bad sectors. 698155 KB in use by the system. 65536 KB occupied by the log file. 273260164 KB available on disk. 4096 bytes in each allocation unit. 448899071 total allocation units on disk. 68315041 allocation units available on disk. Internal Info: 00 38 08 00 dc a3 07 00 3c da 07 00 00 00 00 00 .8......&lt;....... dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ </Data> </EventData> </Event> I have attached the CBS log, the Scannow in command prompt returned no integrity errors Thanks CBS.rar

Hi Kevin, I think the oldest part will be the HDD, its the only part from the original computer i bought. It has since had new cpu, gpu and motherboard etc. A friend of mine is big into pc gaming so i get all his left overs! The parts aren't particularly old but they are second hand. It is still the same power supply unit, so could that be causing an issue if its not providing enough power? I have checked all the drivers and they are up to date. I did have issues with the Radeon thing running multiple instances a while back, but that seems to be fixed now. Matt

Well that told me no component store corruption detected, so thats good. I ran it twice because the first time it said it was cancelled due to cancel request and it created the attached log file if that means anything to you? cheers dism.log

Ah ok, I shall put that down to a random occurrence then and continue to wait for another episode. Thanks

Hi Kevin, my pc seems to have restarted again while i was away from it, as it was on the login screen rather than where I had left it. When i logged in, chrome was open on the microsoft support webpage for some reason, it definitely wasn't when I left it. Nothing else was running, and I had Steam open at the time I left it. Would the BSOD require interaction, or is it a timed thing? I don't know if it simply restarted for windows automatic updates or something rather than crashing again, and also the minidump folder is empty. Thanks

Hey man, so far no more crashes but i sent you a donation via paypal for all your hard work so far! Very much appreciated, Thanks Matt

OK, i have done all that, now just to wait for the next crash. Unfortunately its so random i have no idea when it will be! I shall be sure to keep you posted

Thanks Kevin, here is the log. VEW.txt

Thanks for all your help Kevin. On a completely unrelated note, I have been having trouble with my PC randomly restarting for no apparent reason, with no errors. Just like pressing the reboot button or something. I suspected it my be thermal shutdown, but after careful mongering it doesn't appear to be the case, and i cant replicate what makes it do it. I was just wondering if anything in the logs may indicate a problem elsewhere that might be causing it? It happens even if no programs are running, sometimes within a few mins of starting up my pc, sometimes it wont do it for days. This has been going on long before i had any malware/viruses that i know of, so i think it is probably hardware related. Any input would be greatly appreciated! Matt

Thanks again, here is the scan log from malwarebytes Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 3/11/18 Scan Time: 8:03 PM Log File: 4a9825cc-2567-11e8-bb54-74d435fb3972.json Administrator: Yes -Software Information- Version: 3.4.4.2398 Components Version: 1.0.322 Update Package Version: 1.0.4302 License: Trial -System Information- OS: Windows 10 (Build 16299.248) CPU: x64 File System: NTFS User: DESKTOP-HB2D13M\Matthew -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 310998 Threats Detected: 0 (No malicious items detected) Threats Quarantined: 0 (No malicious items detected) Time Elapsed: 9 min, 16 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) (end) And the log from Adwcleaner # AdwCleaner 7.0.8.0 - Logfile created on Sun Mar 11 20:18:57 2018 # Updated on 2018/08/02 by Malwarebytes # Running on Windows 10 Home (X64) # Mode: clean # Support: https://www.malwarebytes.com/support ***** [ Services ] ***** No malicious services deleted. ***** [ Folders ] ***** No malicious folders deleted. ***** [ Files ] ***** No malicious files deleted. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks deleted. ***** [ Registry ] ***** No malicious registry entries deleted. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries deleted. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries deleted. ************************* ::Tracing keys deleted ::Winsock settings cleared ::Additional Actions: 0 ************************* C:/AdwCleaner/AdwCleaner[C0].txt - [1775 B] - [2018/3/10 13:18:18] C:/AdwCleaner/AdwCleaner[C1].txt - [1408 B] - [2018/3/10 13:28:37] C:/AdwCleaner/AdwCleaner[S0].txt - [1715 B] - [2018/3/10 13:17:38] C:/AdwCleaner/AdwCleaner[S1].txt - [1247 B] - [2018/3/10 13:28:24] C:/AdwCleaner/AdwCleaner[S2].txt - [1217 B] - [2018/3/10 13:38:9] C:/AdwCleaner/AdwCleaner[S3].txt - [1284 B] - [2018/3/10 13:54:11] C:/AdwCleaner/AdwCleaner[S4].txt - [1352 B] - [2018/3/11 9:48:52] C:/AdwCleaner/AdwCleaner[S5].txt - [1419 B] - [2018/3/11 20:18:39] ########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt ########## And finally the MSRT log --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v5.57, February 2018 (build 5.57.14524.1) Started On Sun Mar 11 20:29:18 2018 Engine: 1.1.14500.5 Signatures: 1.261.542.0 Run Mode: Interactive Graphical Mode Successfully Submitted Heartbeat Report Microsoft Windows Malicious Software Removal Tool Finished On Sun Mar 11 20:29:44 2018 Return code: 0 (0x0) --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v5.57, February 2018 (build 5.57.14524.1) Started On Sun Mar 11 20:29:53 2018 Engine: 1.1.14500.5 Signatures: 1.261.542.0 Run Mode: Interactive Graphical Mode Results Summary: ---------------- No infection found. Successfully Submitted Heartbeat Report Microsoft Windows Malicious Software Removal Tool Finished On Sun Mar 11 20:33:08 2018 Return code: 0 (0x0) Thanks for your help my man, it does seem to be fixed now, not sure how as the antivirus things didn't find anything haha. Ill stick to my engines, i understand cogs an stuff, not computers! XD Matt Fixlog.txt

Thanks for helping mate. Here are the files requested FRST.txt Addition.txt

Hey chaps. I recently have had issues with adware on my pc, it will randomly open my default web browser (chrome) on a russian ad page. Seems to just happen randomly, nothing appears to trigger it. It will also open a new tab for the page if chrome is open already. Malwarebytes blocks the connection, and tells me to run a scan. However, after removing 7 things from my pc, it never finds any malicious software, but the problem persists. I have run adwcleaner a few times now, and the first 3-4 times, it removed a few things, but different things each time i ran it. However, that too says me pc is now clean. What should i do next? Is there a different program or antivirus i can use that actually works? Thanks