Windows 7 BSOD

[skitahoe5]

I scanned my Win7 with Malwarebytes after it experienced issues.  3 generic Trojans were found& removed. Cleanup / restart took overnight to run.  My PC starts now but I always get a BSOD about 5 minutes after startup, even in Safe Mode.  I've downloaded FRST & run.  It doesn't finish before the reboot, logs are attached.  I'd greatly appreciate any recommendations on next steps to recover.

Addition.txt

FRST.txt

[Aura]

Hi skitahoe5

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules;
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Can you provide me the Malwarebytes log where the detection occurred, so I can review them?

[skitahoe5]

Aura,

Thank you for offering to assist.  I will follow the guidelines listed above.  I attempted to retrieve the malwarebytes log but my machine did not stay up long enough for the log to export.  At this time it will make into safe mode for 3-5 minutes before experiencing a BSOD.  On the restart attempt, it won't detect the hard drive.  After being turned off for some time, it will detect the hard drive and boot into safe mode for the 3-5 minute window.

Is there something besides the log file that can be used?

John

[Aura]

If you can, .zip the content of the C:\Windows\Minidump folder (it'll contain a bunch of .dmp files), and attach it here. These are your BSOD crashdumps, and I'll see if I can identify what's causing them.

[skitahoe5]

I am not able to locate any .dmp files in the above directory.  I've attached a BSOD - I don't know that I have seen anything past the Initializing line.  On a restart, no Hard Disk Drives are detected.  When I wait more than 15 miuntes before attempting to boot, then the PC will detect the hard drive and boot.  The other attachment is the directory listing of the C:\root drive. I think I started experiencing issues on 7/6.

[Aura]

Sadly without any logs (FRST) or minidump files (.dmp), there's nothing I can do. If you have access to another computer, are you able to remove the hard drive from the infected computer and plug it as a secondary hard drive on the second computer?

Also, regarding your hard drive issue, it is entirely possible that your hard drive is currently failing and needs to be replaced. 

Have you tried doing a System Restore to an earlier date yet?

Edited July 28, 2017 by Aura

[skitahoe5]

I can check the hard drive from another pc.  Is the FRST log in the initial post of any use for testing?  I attempted a system restore but that was not successful.

[Aura]

Sadly the logs are incomplete and I cannot work with them. Plug the hard drive in another computer, and use GSmartControl to see if it's failing or not.

GSmartControl
Follow the instructions below to test your hard drive health with GSmartControl:

• Download GSmartControl and save it on your Desktop;
• Extract the content of the GSmartControl .zip archive and execute gsmartcontrol.exe;
• Identify your drive in the list, and double-click on it to bring up it's window (usually you'll find your drive by it's size or it's brand name);
• Go in the Perform Tests tab, then select Extended Self-test in the Test type drop-down list and click on Execute (this test can take a few hours to complete);
• Once the test is over, the results will be displayed at the bottom of the window. Please copy and paste these results in your next reply;
• Also, go in the Attributes tab and if you have any entries highlighted in red or pink, copy and paste their name in your next reply (or take a screenshot of the GSmartControl window and attach it in your next reply);
  
  

[skitahoe5]

Aura,

GSmartControl did not appear to detect failure / imminent falure by the attached results.

GSmartControl_report.txt

[Aura]

Good. Now, are you able to run a scan with Malwarebytes against that hard drive, and provide me the log afterwards?

Also, .zip the following folder from the problematic hard drive, and attach it here.

C:\ProgramData\Malwarebytes\MBAMService\ScanResults

 

[skitahoe5]

Malwarebytes scan results on the drive are attached

MBytes-2017_0729.txt

e10c4636-7488-11e7-b1f7-002170681d1b.zip

[Aura]

Hum. Can you .zip the whole MBAMService folder instead and attach it here? If it's too big, let me know.

[skitahoe5]

The MBAM Service folder is 63 MB when zipped

[Aura]

You can upload it on SendSpace.com and PM me the download link.

[skitahoe5]

The other 2 scan results present in the zip file are for other HD's from the machine that I am using Malwarebytes from, link sent via PM

[Aura]

From the logs you sent me, it seems that Malwarebytes mainly detected and removed files belonging to SlimCleaner. I don't see any of the 3 generic trojan detection you mentionned. Were the detection names really Trojan.Generic? or Generic.Trojan?

[skitahoe5]

I am able to access the original scan files on the other machine, I should have gone to that drive instead of c:\ on the functioning machine.  Attached is the log that detected the malware

eac603e0-65e4-11e7-bab3-000000000000.zip

[Aura]

Yes, that log contain detection for SlimCleaner. It's not a Trojan, but a PUP. Removing it shouldn't prevent your system from running properly.

[skitahoe5]

Thank you for the assistance

[Aura]

Did you manage to solve your BSOD issues?

[Aura]

Hi skitahoe5,

Are you still with me?

[skitahoe5]

 I am, haven't solved the BSOD yet.  My twins had swim lessons this week and work days were a little longer so I didn't have time to work with the machine. 

In Safe mode, the drivers load okay until this point:

Loaded driver \SystemRoot\system32\drivers\disk.sys
Loaded driver \SystemRoot\system32\drivers\avgbuniva.sys
Loaded driver \SystemRoot\system32\drivers\avgbloga.sys
Loaded driver \SystemRoot\system32\drivers\avgbidsha.sys
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%isatap.displayname%;Microsoft ISATAP Adapter
Did not load driver @nettun.inf,%teredo.displayname%;Microsoft Teredo Tunneling Adapter
Did not load driver @hal.inf,%acpi_amd64.devicedesc%;ACPI x64-based PC
Did not load driver @netavpna.inf,%mp-agilevpn-dispname%;WAN Miniport (IKEv2)
Did not load driver @netrasa.inf,%mp-l2tp-dispname%;WAN Miniport (L2TP)
Did not load driver @netrasa.inf,%mp-bh-dispname%;WAN Miniport (Network Monitor)
Did not load driver @netrasa.inf,%mp-ip-dispname%;WAN Miniport (IP)
Did not load driver @netrasa.inf,%mp-ipv6-dispname%;WAN Miniport (IPv6)
Did not load driver @netrasa.inf,%mp-pppoe-dispname%;WAN Miniport (PPPOE)
Did not load driver @netrasa.inf,%mp-pptp-dispname%;WAN Miniport (PPTP)
Did not load driver @netsstpa.inf,%mp-sstp-dispname%;WAN Miniport (SSTP)
Did not load driver HP Officejet Pro 8620
Did not load driver Fax - HP Officejet Pro 8620
Did not load driver HP Officejet Pro 8620 (NET)

If I can get the machine to stay up long enough to disable AVG start up in MS CONFIG I will try that next.

After the BSOD the PC doesn't see either HD or the optical drive on the restart

[Aura]

Yes, it's weird that Windows would attempt to load third-party drivers (AVG's) in Safe Mode, but couldn't load its own.

[Aura]

Hi skitahoe5,

Are you still with me?

[Aura]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!