Command box pops up every hour

[Azzychan]

Hello,

I noticed that others have also reported this.  I will be working on my computer, and a box will pop up around the :27 or :28 of every hour.  It goes so quick that I can't see what it is actually doing.  It has now been doing this for a few days.

System:  Windows 10 with all current updates

I have run Windows Defender, MalwareBytes Pro, and Kaspersky Virus Removal Tool.  All show no threats.

I have Hidden Files showing and have my download directory for FireFox as my Desktop.

I am attaching all the files you guys request on any topic.  Please note that I run a HOSTS File from MVPS.org that stops many of the unwanted servers to load on my computer while surfing the net.

Rkill.txt

MalwareBytesScan.txt

Edited May 30, 2017 by Azzychan
Had text that needed to be removed.

[kevinf80]

Hello Azzychan and welcome to Malwarebytes,

My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please:

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Thank you, Kevin....

[Azzychan]

Here are the two files that were created by FRST.

FRST.txt

Addition.txt

[kevinf80]

Thanks for those logs, do not see any obvious Malware or Infection. Continue with the following:

Download and save RogueKiller to your Desktop from this link: https://www.fosshub.com/RogueKiller.html/setup.exe Right click setup.exe and select Run as Administrator to start installing RogueKiller. At the next window Checkmark "Install 32 and 64 bit versions, then select "Next" In the next window skip Licence I.D. and Licence Key, select "Next" In the next window make no changes and select "Next" In the next window leave both "Additional Shortcuts" checkmarked, then select "Next" In the next window make no changes and select "Install" RogueKiller will extract and complete installation, in the new window leave "Launch Roguekiller" checkmarked, then select finish. RogueKiller will launch. Accept UAC, then read and accept "User Agreements" In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan" When the scan completes select "Open Report" In the new Window select "Export text" name that file RK.txt, save to your Desktop and attach to your reply Let me see that log in your reply... Next, Scan with HitmanPro In any case don't remove on your own anything that Hitman Pro detects! This scanner is really good for checking, it has however been known for deleting files instead of curing them, in some cases this may render the machine unbootable. Any removals will be done manually after careful analysis of the scan results! Please download HitmanPro by SurfRight and save it to your desktop. Temporary disable your AntiVirus and AntiSpyware protection - instructions here.   Right-click on icon and select Run as Administrator to start the tool. If the program won't run please run it while holding down the left CTRL key until it's loaded! Click on the Next button. You must agree with the terms of EULA (if asked). Check the box beside No, I only want to perform a one-time scan to check this computer. Click on the Next button. The program will start to scan the computer. It would only take several minutes. When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore. If there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro!Navigate to C:\ProgramData\HitmanPro\Logs, open the report and include it it your next reply. Click on the Next button. Click on the Save Log button. Save that file to your desktop. Please include that logfile in your next reply. Don't forget to re-enable your security! Let me see those logs in your reply... Thank you, Kevin

[Azzychan]

Here you go!

RogueKiller.txt

HitmanPro_20170530_1310.log

[kevinf80]

Both of those logs are clean, do you have any remaining issues or concerns....?

[Azzychan]

I am still getting a popup every hour.

I did look this up prior to putting information here, and eliminated all things in Task Scheduler that could be causing it.

[kevinf80]

Thanks for the update, run the following:

Please download Gmer from Here by clicking on the "Download EXE" Button.   Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent. If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO. In the right panel, you will see several boxes that have been checked. Uncheck the following ... Sections IAT/EAT Show All ( should be unchecked by default )   Leave everything else as it is. Close all other running Programs as well as your Browsers. Click the Scan button & wait for it to finish. Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop. Please post the content of the ark.txt here. **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries **If GMER crashes** Follow the instructions here and disable your security temporarily… Let me see that log..... Thank you, Kevin...

[Azzychan]

GMER crashes and gives me this when trying to run (even if I disable firewall, MS Defender, and MB Pro):

 

[Azzychan]

There is a "What failed" that shows up on that BSOD as well, but I can't really read it too well.

As a result, I can't get a GMER report

[kevinf80]

Can you try from Safemode..... If that fails give this a go:

Please read carefully and follow these steps. Download TDSSKiller from here  http://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop. Doubleclick on to run the application. The "Ready to scan" window will open, Click on "Change parameters"   Ensure all entries are Checkmarked under Additionl Options, Ensure all entries are Checkmarked under Objects to scan When Loaded Modules is checkmarked a re-boot will be offered, allow that to happen...   Continue after reboot select "Change Parameters" make sure entries are checkmarked and then Select "Start Scan"   If an infected file is detected, the default action will be Cure, click on Continue.   If a suspicious file is detected, the default action will be Skip, click on Continue.   It may ask you to reboot the computer to complete the process. Click on Reboot Now.   If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here. If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. Thank you, Kevin...

[Azzychan]

Yes, even with Safe Mode, GMER gave me a BSOD

Here is the TDSSKiller log:

 

TDSSKiller.3.1.0.15_30.05.2017_19.07.03_log.txt

Edited May 30, 2017 by Azzychan
Found file, which makes this post cleaner.

[kevinf80]

That log is not complete...

[Azzychan]

Sorry about that.  Two files showed up for logs.  Here's the other one:

 

TDSSKiller.3.1.0.15_30.05.2017_19.09.09_log.txt

[kevinf80]

Can you run TDSSKiller again, when TDSS file system is flagged again see if you can select Cure or Delete instead of skip... does that make any difference..

[Azzychan]

Will try that.

UPDATE:  Windows Defender is now finding a whole bunch of Trojan:WinNT/Alureon threats in the files that were created by clicking "Delete"  It seems that Defender removed them all. 

Edited May 31, 2017 by Azzychan

[Azzychan]

[kevinf80]

TDSS file system is part of Alureon infection, what you seemed to have in TDSSKiller log was a remnant from a previous infection....

What is happening with your PC now...?

[kevinf80]

We cross posted there, I just see your defender log after I post... Run the following please:

1.Download Malwarebytes Anti-Rootkit from this link: http://www.malwarebytes.org/products/mbar/ 2. Unzip the File to a convenient location. (Recommend the Desktop) 3. Open the folder where the contents were unzipped to run mbar.exe 4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image: 5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.) 6. The following image opens, select Next. 7. The following image opens, select Update 8. When the update completes select Next. 9. In the following window ensure "Targets" are ticked. Then select "Scan" 10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed. 11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process. 12. If no threats were found you will see the following image, Select Exit: 13. Verify that your system is now running normally, making sure that the following items are functional:   Internet access Windows Update Windows Firewall 14. If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder. 15. Select "Y" from your Keyboard, tap Enter. 16. The fix will be applied, select any key to Exit. 17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder: System - log Mbar - log Date and time of scan will also be shown Thanks, Kevin...

 

[Azzychan]

Here are the two logs.  Will update if the window pops up tomorrow while I am working. 

mbar-log-2017-05-31 (01-50-56).txt

system-log.txt

[kevinf80]

Yes please post back with an update whenever you`re ready....

Thank you,

Kevin....

[AdvancedSetup]

Just an FYI and it may or may not have anything to do with your issue.

 

Please see the following post concerning an hourly popup from a Microsoft Office scheduled task. Credit to ArnoldLayne for information about this issue.

OfficeBackgroundTaskHandlerRegistration flashes a window every hour

Quote by Microsoft employee below

Quote

Microsoft’s Gregory Jensen replied: “This issue is fixed starting with build 16.0.8201.2025 which is now available as the latest update for those participating in the Office Insiders Slow program.

“It will be included in a future update for those not participating in Insiders.”

It currently is unclear when exactly the fix will be rolled out for all Office users.

 

 

[kevinf80]

Hello Azzychan,

Can you let me know how your PC is behaving now, also let me know if the issue posted by @AdvancedSetup is related to your original problem...

Next,

I`d like to see Tasklist entries, do the following:

Open an elevated command prompt, Select the Windows key and X key together. From the list select "Command Porompt (Admin)

Type or copy/paste:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" /s > 0 & notepad 0

Tap enter, please wait, notepad will open post those results….

Thank you,

Kevin....

 

Edited June 1, 2017 by kevinf80
typing error

[Azzychan]

I did the fix in Task Scheduler, which did show to run every hour.

It stopped popping up before then though, so it seems everything is fine now.

Here is the file you asked for:

 

Tasks.txt

[kevinf80]

Thanks for the update Azzychan, if you`ve made the fix in Task Scheduler for the MS Office issue no further action is needed other than clean up tools used etc....

Uninstall RogueKiller and HitmanPro. http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...