Guessing Root kit [Requested resource is in use]

[Chrisghifi]

Noticed my keyboard stopped working, after some searching I dled Mbar, but when I try to scan the dda fails after restart. 

Addition.txt

FRST.txt

[TwinHeadedEagle]

Hello and

 

Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Click Start and while holding Shift key on your keyboard click Power --> Restart.
  

Note: It is important that you keep Shift key pressed while doing this or it won't work.

In the Command Prompt please type in:

notepad

and press Enter.

• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.
• Note down the letter and close the notepad.
  

Scan with Farbar Recovery Scan Tool

Once back in the command prompt window, please do the following:

• Type in e:\frst64.exe and press Enter.
  You need to replace ewith the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.
• When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.
  

Transfer it to your clean machine and include it in your next reply.

[Chrisghifi]

Just to note, I could not  get into safe mode without using the diagnostic tool and unfortunately this is my only machine.  

Addition.txt

FRST.txt

[TwinHeadedEagle]

We need to apply this fix and then you need to do as I instructed in my first message.

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[Chrisghifi]

Done. 

Fixlog.txt

FRST.txt

Addition.txt

[TwinHeadedEagle]

You don't understand, I need the report from Recovery environment, not from Safe Mode.

[Chrisghifi]

Wow it has been awhile! I was out of state then headed to surgery, now I'm able to continue this as my computer is still infected sadly after coming back. (No surprise) So my knowledge was that safety environment was safe mode, how do I go about getting into it? 

[TwinHeadedEagle]

Can you try to run MalwareBytes anti-rootkit from this post?

 

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

[Chrisghifi]

No I get the driver error, restart, then it cant scan. 

[TwinHeadedEagle]

In this case, you'll need to work on instructions from my first message in this topic.

[Chrisghifi]

Done

FRST.txt

[TwinHeadedEagle]

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>>  Boot into Recovery Environment

Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

•    Press the Fix button once and wait.
•    FRST will process fixlist.txt
•    When finished, it will produce a log fixlog.txt on your USB flashdrive.
  

 >>  Exit out of Recovery Environment and post me the log please.

Try to boot Windows normally...

fixlist.txt

[Chrisghifi]

Did a scan as well just in case. 

Fixlog.txt

FRST.txt

[TwinHeadedEagle]

Can you now perform a MalwareBytes scan?

[Chrisghifi]

YES! For some reason though it freezes and and I cant do anything, I even let it sit for over 2 hours to see if anything would happen. Also all my normal things are working now which is how I noticed this problem. I will try to individually check the boxes instead of all at once. 

[Chrisghifi]

So I did it individually and system still freezes it, tried multiple ways but now I'm getting an access denied even though I am on admin.

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked. option is checked.

  

• Press Scan button and wait.
  

• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please attach report into your next reply.

[Chrisghifi]

Done!

Addition.txt

FRST.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[Chrisghifi]

Done.

Fixlog.txt