Laptop restarts after malwarebytes scan

garrylee · August 17, 2015

Message that text was too long, have therefore attached copies of logs

Thanks in advance

kevinf80 · August 17, 2015

Hello and welcome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs, also give an update on any remaining issues or concerns...

Thank you,

Kevin...

Fixlist.txt

garrylee · August 17, 2015

Fixlog attached

Fixlog.txt

kevinf80 · August 18, 2015

Post the remaining logs when ready...

Thank you,

Kevin...

garrylee · August 18, 2015

Hi

I ran the malwarebytes scan yesterday, but as it didn't complete until early hours of this morning I closed down after completion, but it did complete the scan.

Ran the scan again today and suffered a shut down, should I start the process again, i.e. from the FRST scan?

Thanks

garry

kevinf80 · August 18, 2015

Continue with other steps after Malwarebytes, let me see the logs.. Also post Malwarebytes log...

garrylee · August 20, 2015

Malwarebytes Anti-Malware
www.malwarebytes.org

Error, 20/08/2015 21:57, SYSTEM, GARRYSLAPTOP, Protection, IsLicensed, 13,
Protection, 20/08/2015 21:57, SYSTEM, GARRYSLAPTOP, Protection, Malware Protection, Stopping,
Protection, 20/08/2015 21:57, SYSTEM, GARRYSLAPTOP, Protection, Malware Protection, Stopped,

(end)

garrylee · August 20, 2015

JRT.txt

garrylee · August 21, 2015

MRT file attachedmrt.log

kevinf80 · August 21, 2015

Use the instructions at the following link to make clean install of Malwarebytes:

https://forums.malwarebytes.org/index.php?/topic/146017-mbam-clean-removal-process-2x/

When the clean istall is complete run again as follows:

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard" then Right click to your reply > select "Paste" that will copy the log to your reply…

Post that log, also give an update on any remaining issues or concerns....

Thank you,

Kevin..

garrylee · August 22, 2015

Log from scans

Laptop shut down and restarted after BSOD

Malwarebytes Anti-Malware

www.malwarebytes.org

Error, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Update, Bad md5 or size: akadomains, 11,

Error, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Update, Bad md5 or size: akaips, 11,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, Domain Database, 0.0.0.0, 2015.7.24.2,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, Remediation Database, 2015.5.13.1, 2015.8.18.1,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, Rootkit Database, 2015.6.2.1, 2015.8.16.1,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, AKA IP Database, 0.0.0.0, 2015.8.21.1,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, IP Database, 0.0.0.0, 2015.7.24.3,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, AKA Domain Database, 0.0.0.0, 2015.8.21.2,

Update, 22/08/2015 20:50, SYSTEM, GARRYSLAPTOP, Manual, Malware Database, 2015.6.3.3, 2015.8.22.4,

Error, 22/08/2015 21:59, SYSTEM, GARRYSLAPTOP, Protection, IsLicensed, 13,

Protection, 22/08/2015 21:59, SYSTEM, GARRYSLAPTOP, Protection, Malware Protection, Stopping,

Protection, 22/08/2015 21:59, SYSTEM, GARRYSLAPTOP, Protection, Malware Protection, Stopped,

(end)

kevinf80 · August 22, 2015

That is not a scan log, you`ve posted a "protection log" Open Malwarebytes select "History" then select "Application logs" then select "Scan log" The scan log you want is recognized by date and time...

garrylee · August 23, 2015

Sorry, no scan logs appear, see attached screenshots

Although I have set up so that log files are kept, there are no files in the folder

kevinf80 · August 23, 2015

Try another scan with Malwarebytes;

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Thank you,

Kevin...

garrylee · August 24, 2015

Have started the scan twice today, laptop restarted before the scan had completed, no scan logs appear on the history, only protection log.

kevinf80 · August 24, 2015

Boot your system to Safemode, run scan with Mawarebytes...

garrylee · August 25, 2015

Thanks, starting safemode appears to have worked, Scan log

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>

-<header>

</header>

-<engine>

<malware-database>v2015.08.24.03</malware-database>

<rootkit-database>v2015.08.16.01</rootkit-database>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>

-<system>

<osversion>Windows 7 Service Pack 1</osversion>

<username>Approach Forecourt</username>

</system>

-<summary>

<type>threat</type>

<result>completed</result>

</summary>

-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>enabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>

-<items>

-<key>

<path>HKU\S-1-5-21-213030612-3576381135-3627209648-1000\SOFTWARE\FileScout</path>

<vendor>PUP.Optional.FileScout.A</vendor>

<action>success</action>

<hash>a5fe62aadbb0f3439a96c6e783815da3</hash>

</key>

-<key>

<path>HKU\S-1-5-21-213030612-3576381135-3627209648-1000\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}</path>

<vendor>PUP.Optional.SuperOptimizer.C</vendor>

<action>success</action>

</key>

-<file>

<path>C:\Users\Approach Forecourt\Documents\APNSetup.exe</path>

<vendor>PUP.Optional.APNToolBar.A</vendor>

<action>success</action>

</file>

-<file>

<path>C:\Users\Naomi\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences</path>

<vendor>PUP.Optional.Vosteran</vendor>

<action>replaced</action>

<baddata>"session":{"restore_on_startup":4,"startup_urls":["http://vosteran.com/?f=7&a=vst_ir_15_04_other&cd=2XzuyEtN2Y1L1QzutDtDtCtCtDzy0FtB0A0F0FtCyB0B0B0AtN0D0Tzu0StCtCtCyEtN1L2XzutAtFyBtFtBtFtCtN1L1CzutCyEtBzytDyD1V1BtAtN1L1G1B1V1N2Y1L1Qzu2StA0Bzy0B0AzytCtCtGzztAzzyCtG0ByDtCtAtGyC0D0AzytGyB0EyCyD0AzztDyC0B0D0ByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0DtCyC0EtCzyzytG0D0F0AzztGyEyDtC0AtGzz0Dzz0EtG0BtCyEyE0EyE0B0AyE0DyDtC2Q&cr=756697838&ir=]},"sync":{"remaining_rollback_tries":0}}</baddata>

<gooddata>"session":{"restore_on_startup":4,"startup_urls":["https://www.malwarebytes.org/restorebrowser/]}}</gooddata>

</file>

</items>

</mbam-log>

kevinf80 · August 25, 2015

Boot to normal mode, run Malwarebytes again:

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Thanks,

Kevin

garrylee · August 25, 2015

Scanned after normal restart, laptop shut down before completing scan, no scan log produced

kevinf80 · August 25, 2015

What do you mean, did the laptop crash?

Run this please and post the log:

Please download VEW by Vino Rosso from HERE and save it to your Desktop.

Double-click VEW.exe. to start, Vista and Windows 7/8 users Right Click and select "Run as Administrator"
Under 'Select log to query...check the boxes for both Application and System.
Under 'Select type to list... select both Error and Critical.
Click the radio button for 'Number of events...Type 15 in the 1 to 20 box.
Then click the Run button.
Notepad will open with the output log. It will take a couple of minutes to generate the log, please be patient.

Please post the Output log in your next reply.

Next,

Zip up and attach the following folder (marked in blue) if present :-

C:\Windows\minidump

Thank you,

Kevin...

garrylee · August 28, 2015

Yes, it crashes and restarts.

VEW log:

Vino's Event Viewer v01c run on Windows 2008 in English

Report run at 26/08/2015 21:39:38

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - Error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 25/08/2015 21:01:15

Type: Error Category: 0

Event: 16 Source: uagqecsvc

The Microsoft Forefront UAG Quarantine Enforcement Client component cannot retrieve the status of the Network Access Protection (NAP) Agent service. System error 1115: A system shutdown is in progress. (0x45b). When the Microsoft Forefront UAG Quarantine Enforcement Client component starts, it attempts to query settings for the NAP agent service.

Log: 'Application' Date/Time: 25/08/2015 15:08:21

Type: Error Category: 0

Event: 16 Source: uagqecsvc

The Microsoft Forefront UAG Quarantine Enforcement Client component cannot retrieve the status of the Network Access Protection (NAP) Agent service. System error 1115: A system shutdown is in progress. (0x45b). When the Microsoft Forefront UAG Quarantine Enforcement Client component starts, it attempts to query settings for the NAP agent service.

Log: 'Application' Date/Time: 25/08/2015 09:31:04

Type: Error Category: 0

Event: 16 Source: uagqecsvc

The Microsoft Forefront UAG Quarantine Enforcement Client component cannot retrieve the status of the Network Access Protection (NAP) Agent service. System error 1115: A system shutdown is in progress. (0x45b). When the Microsoft Forefront UAG Quarantine Enforcement Client component starts, it attempts to query settings for the NAP agent service.

Log: 'Application' Date/Time: 25/08/2015 09:27:29

Type: Error Category: 0

Event: 16 Source: uagqecsvc

The Microsoft Forefront UAG Quarantine Enforcement Client component cannot retrieve the status of the Network Access Protection (NAP) Agent service. System error 1115: A system shutdown is in progress. (0x45b). When the Microsoft Forefront UAG Quarantine Enforcement Client component starts, it attempts to query settings for the NAP agent service.

Log: 'Application' Date/Time: 25/08/2015 09:23:38

Type: Error Category: 0

Event: 16 Source: uagqecsvc

The Microsoft Forefront UAG Quarantine Enforcement Client component cannot retrieve the status of the Network Access Protection (NAP) Agent service. System error 1115: A system shutdown is in progress. (0x45b). When the Microsoft Forefront UAG Quarantine Enforcement Client component starts, it attempts to query settings for the NAP agent service.

Log: 'Application' Date/Time: 25/08/2015 09:17:50

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledSPRetry 52557267

Log: 'Application' Date/Time: 25/08/2015 09:17:50

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledEvent 52557267

Log: 'Application' Date/Time: 25/08/2015 09:17:47

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 24/08/2015 18:41:53

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledSPRetry 3541

Log: 'Application' Date/Time: 24/08/2015 18:41:53

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledEvent 3541

Log: 'Application' Date/Time: 24/08/2015 18:41:53

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 24/08/2015 18:41:52

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledSPRetry 1170

Log: 'Application' Date/Time: 24/08/2015 18:41:52

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledEvent 1170

Log: 'Application' Date/Time: 24/08/2015 18:41:52

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 24/08/2015 17:18:39

Type: Error Category: 0

Event: 100 Source: Bonjour Service

Task Scheduling Error: m->NextScheduledSPRetry 3685196

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - Critical Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 25/08/2015 20:47:30

Type: Critical Category: 63