Jump to content

Suspecting infections need help to read logs

Kape33

By Kape33
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Staff
Malwarebytes

Malwarebytes

Posted
  • Staff
Posted

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Farbar Recovery Scan Tool (FRST)
    1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
    2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
    3. Press the "Scan" button
    4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
  • MB-Check
    1. Download MB-Check and save to your desktop
    2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
    3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Hi Kape33 :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
  • As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread


This being said, it's time to clean-up some malware, so let's get started, shall we? :)

a6csRll.pngMalwarebytes Anti-Rootkit Beta

  • Download Malwarebytes Anti-Rootkit Beta and extract it to your desktop (MBAR will be launched shortly after the extraction)
  • Click on Next, and then on the Update button to let it update its database. Once the database has been successfully updated, click on Next
  • Make sure all the checkboxes are checked, then click on the Scan button, and let it completes its scan (this can take a while)
  • Once the scan is done, make sure that every item is checked, and click on the Cleanup button (a reboot might be required)
  • After that (and the reboot, if one was required), go back in the mbar folder and look for a text file called mbar-log-TODAY'S-DATE.txt
  • Copy/paste the content of that log in your next reply

Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted

Hi, Aura! Thanks for your time.
Malwarebytes still dosen't run.

Here's the log data:

Downloaded database version: v2018.03.12.08
Downloaded database version: v2018.03.08.03
Downloaded database version: v2018.01.20.01
=======================================
Initializing...
Driver version: 4.3.0.15
------------ Kernel report ------------
     03/13/2018 02:32:13
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\cng.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\WppRecorder.sys
\SystemRoot\system32\drivers\SleepStudyHelper.sys
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\system32\drivers\mssecflt.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\system32\drivers\21216198.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\iaStorA.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\drivers\amdkmpfd.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volume.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\drivers\iorate.sys
\SystemRoot\system32\Drivers\fsbts.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\system32\DRIVERS\eamonm.sys
\??\C:\Program Files\ESET\ESET NOD32 Antivirus\em015_64.dat
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\ehdrv.sys
C:\Program Files\ESET\ESET NOD32 Antivirus\em006_64.dat
C:\Program Files\ESET\ESET NOD32 Antivirus\em018_64.dat
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\vmbkmclr.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\adgnetworkwfpdrv.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\system32\DRIVERS\VBoxNetAdp6.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\??\C:\Program Files (x86)\Bignox\BigNoxVM\RT\YSDrv.sys
\SystemRoot\system32\DRIVERS\VBoxDrv.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\??\C:\WINDOWS\System32\drivers\GUSBootStartup.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\drivers\bam.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_9c1fb8f4db31c348\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\CAD.sys
\SystemRoot\System32\DriverStore\FileRepository\igdlh64.inf_amd64_12cbd645391cbdcb\igdkmd64.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\drivers\rt640x64.sys
\SystemRoot\System32\drivers\Netwtw04.sys
\SystemRoot\system32\DRIVERS\wdiwifi.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\DriverStore\FileRepository\c0324065.inf_amd64_81adb2fe7e7c6a58\atikmpag.sys
\SystemRoot\System32\DriverStore\FileRepository\c0324065.inf_amd64_81adb2fe7e7c6a58\atikmdag.sys
\SystemRoot\System32\drivers\CmBatt.sys
\SystemRoot\System32\drivers\BATTC.SYS
\SystemRoot\System32\drivers\AcpiVpc.sys
\SystemRoot\System32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\ETD.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\System32\drivers\tpm.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\iwdbus.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\CHDRT64.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\system32\Drivers\RtsUer.sys
\SystemRoot\system32\DRIVERS\ibtusb.sys
\SystemRoot\System32\drivers\BTHUSB.sys
\SystemRoot\System32\drivers\bthport.sys
\SystemRoot\system32\DRIVERS\rtsuvc.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_iaStorA.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\drivers\WUDFRd.sys
\SystemRoot\System32\drivers\mshidumdf.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\wcifs.sys
\SystemRoot\system32\drivers\cldflt.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\epfwwfpr.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\npf.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\drivers\rassstp.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\DRIVERS\NDProxy.sys
\SystemRoot\System32\drivers\AgileVpn.sys
\SystemRoot\System32\drivers\vwifimp.sys
\SystemRoot\System32\drivers\rasl2tp.sys
\SystemRoot\System32\drivers\raspptp.sys
\SystemRoot\System32\DRIVERS\raspppoe.sys
\SystemRoot\System32\DRIVERS\ndistapi.sys
\SystemRoot\System32\drivers\ndiswan.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\WINDOWS\system32\drivers\5735E5BC.sys
----------- End -----------
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-1026048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-2-415698944-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-3-417521664-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\prilock.sys-k.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\prilock.sys-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\prilock.sys-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\prilock.sys-(1)-r.mbam...
Removing C:\Windows\System32\drivers\prilock.sys...
Removing C:\Program Files (x86)\TNod\uninst-tnod.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\g2B7D.tmp.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\data.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\00024791\LaCiePrivatePublic_Setup.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\3808781\ic-0.328b22821c456.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\3808781\ic-0.ad63287f09724.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\3808781\ic-0.d78a39833ff44.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\3808781\ic-0.e1589504088de.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\3808781\RunBoosterSetup64_3231.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\4795500\ic-0.19e279a104a12c.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\4795500\ic-0.bc580d71c695c.exe...
Removing C:\Users\Nuno Jesus\AppData\Local\Temp\4795500\RunBoosterSetup64_3231.exe...
Removing C:\Windows\KMS-QADhook.dll...
Removing C:\Windat\syslog.bat...
Removing C:\Program Files\Shadowsocks\unins000.dat...
Removing C:\Program Files\Shadowsocks\unins000.exe...
Removing C:\Applications\websock.exe...
Removing C:\Applications\Service.exe...
Removing C:\WinSys\sysConfig.bat...
Removing C:\Users\Nuno Jesus\AppData\Roaming\tmp546.dat...
Removing C:\Disk\WebService.exe...
Removal finished
Done!

Scan started
Database versions:
  main:    v2018.03.12.08
  rootkit: v2018.03.08.03

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffff8508ba275690, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffff8508bb7c3860, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffff8508ba275690, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffff8508bb79ae40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffff8508bc02d380, DeviceName: \Device\00000023\, DriverName: \Driver\iaStorA\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: E52D3

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 1024000
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1026048  Numsec = 414672507
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Other (0x27)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 415698944  Numsec = 1820672
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 417521664  Numsec = 1536000000
    Partition is not bootable
    Partition file system is NTFS

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
File "C:\Windows\System32\KERNELBASE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\apphelp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\AcLayers.dll" is sparse (flags = 32768)
File "C:\Windows\System32\msvcrt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\user32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\GDI32FULL.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MSVCP_WIN.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ucrtbase.dll" is sparse (flags = 32768)
File "C:\Windows\System32\shell32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rpcrt4.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sspicli.dll" is sparse (flags = 32768)
File "C:\Windows\System32\BCRYPTPRIMITIVES.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STORAGE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\advapi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\setupapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winspool.drv" is sparse (flags = 32768)
File "C:\Windows\System32\bcrypt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ole32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wintrust.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wininet.dll" is sparse (flags = 32768)
File "C:\Windows\System32\comdlg32.dll" is sparse (flags = 32768)
File "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\iertutil.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winhttp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\urlmon.dll" is sparse (flags = 32768)
File "C:\Windows\System32\msIso.dll" is sparse (flags = 32768)
File "C:\Windows\System32\dnsapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\cldapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\aepic.dll" is sparse (flags = 32768)
File "C:\Windows\System32\TEXTINPUTFRAMEWORK.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\COREMESSAGING.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STATEREPOSITORYPS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ntshrui.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winlogon.exe" is sparse (flags = 32768)
File "C:\Windows\System32\services.exe" is sparse (flags = 32768)
File "C:\Windows\System32\FONTDRVHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\spoolsv.exe" is sparse (flags = 32768)
File "C:\Windows\System32\SECURITYHEALTHSERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" is sparse (flags = 32768)
File "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" is sparse (flags = 32768)
File "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rasapi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\APPXDEPLOYMENTCLIENT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\STATEREPOSITORY.CORE.DLL" is sparse (flags = 32768)
File "C:\Windows\explorer.exe" is sparse (flags = 32768)
File "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" is sparse (flags = 32768)
File "C:\Windows\System32\SMARTSCREEN.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\sppsvc.exe" is sparse (flags = 32768)
File "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\GdiPlus.dll" is sparse (flags = 32768)
File "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\EXPLORERFRAME.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\edputil.dll" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bam.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\acpi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\clfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\SPACEPORT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\afd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sdstor.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\srv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\APPVCLIENT.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wcifs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\srv2.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bthport.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cng.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cldflt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\dxgkrnl.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ksecdd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\tcpip.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fltMgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\FSDEPENDS.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fvevol.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mrxsmb.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\http.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndproxy.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netbt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\msiscsi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mskssrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mrxsmb20.sys" is sparse (flags = 32768)
File "C:\Windows\System32\VSSVC.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\nwifi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netbios.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netvsc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndis.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\partmgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\raspptp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rdbss.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sdbus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\Spectrum.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\srvnet.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\storahci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\stornvme.sys" is sparse (flags = 32768)
File "C:\Windows\servicing\TRUSTEDINSTALLER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\USBXHCI.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vhdmp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vmbus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vwifimp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volmgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volsnap.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wanarp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\WdiWiFi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wfplwfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\winnat.sys" is sparse (flags = 32768)
File "C:\Windows\System32\SEARCHINDEXER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\NATURALAUTH.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\appinfo.dll" is sparse (flags = 32768)
File "C:\Windows\System32\audiosrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STATEREPOSITORY.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\AUDIOENDPOINTBUILDER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\APPXDEPLOYMENTSERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\DEVICESETUPMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\umpo.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ListSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\bisrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\pnrpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ClipSVC.dll" is sparse (flags = 32768)
File "C:\Windows\System32\TETHERINGSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\dusmsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DIAGTRACK.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\dnsrslvr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ENTERPRISEAPPMGMTSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\FntCache.dll" is sparse (flags = 32768)
File "C:\Windows\System32\FRAMESERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\INSTALLSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ipnathlp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\lsm.dll" is sparse (flags = 32768)
File "C:\Windows\System32\MPSSVC.dll" is sparse (flags = 32768)
File "C:\Windows\System32\nlasvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\netlogon.dll" is sparse (flags = 32768)
File "C:\Windows\System32\NETSETUPSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\APHOSTSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\pcasvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\p2psvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\PEERDISTSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PHONESERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PIMINDEXMAINTENANCE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PUSHTOINSTALL.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\rasauto.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rasmans.dll" is sparse (flags = 32768)
File "C:\Windows\System32\schedsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SCardSvr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SEMgrSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SENSORSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\SMSROUTERSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\StorSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sysmain.dll" is sparse (flags = 32768)
File "C:\Windows\System32\TOKENBROKER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\Unistore.dll" is sparse (flags = 32768)
File "C:\Windows\System32\USERDATASERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\usermgr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\usocore.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wbiosrvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wwansvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wlansvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wcncsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WebClnt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wuaueng.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ie4uinit.exe" is sparse (flags = 32768)
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\03D22C9C66915D58C88912B64C1F984B8344EF09 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\0F684EC1163281085C6AF20528878103ACEFCAAB --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\1667908C9E22EFBD0590E088715CC74BE4C60884 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\18DEA4EFA93B06AE997D234411F3FD72A677EECE --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\249BDA38A611CD746A132FA2AF995A2D3C941264 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\31AC96A6C17C425222C46D55C3CCA6BA12E54DAF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\331E2046A1CCA7BFEF766724394BE6112B4CA3F7 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3353EA609334A9F23A701B9159E30CB6C22D4C59 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\373C33726722D3A5D1EDD1F1585D5D25B39BEA1A --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3D496FA682E65FC122351EC29B55AB94F3BB03FC --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4420C99742DF11DD0795BC15B7B0ABF090DC84DF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5240AB5B05D11B37900AC7712A3C6AE42F377C8C --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5DD3D41810F28B2A13E9A004E6412061E28FA48D --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7457A3793086DBB58B3858D6476889E3311E550E --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\76A9295EF4343E12DFC5FE05DC57227C1AB00D29 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\775B373B33B9D15B58BC02B184704332B97C3CAF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\872CD334B7E7B3C3D1C6114CD6B221026D505EAB --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\88AD5DFE24126872B33175D1778687B642323ACF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9132E8B079D080E01D52631690BE18EBC2347C1E --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\982D98951CF3C0CA2A02814D474A976CBFF6BDB1 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9C43F665E690AB4D486D4717B456C5554D4BCEB5 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A5341949ABE1407DD7BF7DFE75460D9608FBC309 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A59CC32724DD07A6FC33F7806945481A2D13CA2F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AD4C5429E10F4FF6C01840C20ABA344D7401209F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AD96BB64BA36379D2E354660780C2067B81DA2E0 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\CDC37C22FE9272D8F2610206AD397A45040326B8 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\DB303C9B61282DE525DC754A535CA2D6A9BD3D87 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\DB77E5CFEC34459146748B667C97B185619251BA --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\E22240E837B52E691C71DF248F12D27F96441C00 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\ED841A61C0F76025598421BC1B00E24189E68D54 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\F83099622B4A9F72CB5081F742164AD1B8D048C9 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\FBB42F089AF2D570F2BF6F493D107A3255A9BB1A --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\03D22C9C66915D58C88912B64C1F984B8344EF09 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\0F684EC1163281085C6AF20528878103ACEFCAAB --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\1667908C9E22EFBD0590E088715CC74BE4C60884 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\18DEA4EFA93B06AE997D234411F3FD72A677EECE --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\249BDA38A611CD746A132FA2AF995A2D3C941264 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\31AC96A6C17C425222C46D55C3CCA6BA12E54DAF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\331E2046A1CCA7BFEF766724394BE6112B4CA3F7 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3353EA609334A9F23A701B9159E30CB6C22D4C59 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\373C33726722D3A5D1EDD1F1585D5D25B39BEA1A --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\3D496FA682E65FC122351EC29B55AB94F3BB03FC --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4420C99742DF11DD0795BC15B7B0ABF090DC84DF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5240AB5B05D11B37900AC7712A3C6AE42F377C8C --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\5DD3D41810F28B2A13E9A004E6412061E28FA48D --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7457A3793086DBB58B3858D6476889E3311E550E --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\76A9295EF4343E12DFC5FE05DC57227C1AB00D29 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\775B373B33B9D15B58BC02B184704332B97C3CAF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\872CD334B7E7B3C3D1C6114CD6B221026D505EAB --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\88AD5DFE24126872B33175D1778687B642323ACF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9132E8B079D080E01D52631690BE18EBC2347C1E --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\982D98951CF3C0CA2A02814D474A976CBFF6BDB1 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9C43F665E690AB4D486D4717B456C5554D4BCEB5 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A5341949ABE1407DD7BF7DFE75460D9608FBC309 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\A59CC32724DD07A6FC33F7806945481A2D13CA2F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AD4C5429E10F4FF6C01840C20ABA344D7401209F --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\AD96BB64BA36379D2E354660780C2067B81DA2E0 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\CDC37C22FE9272D8F2610206AD397A45040326B8 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\DB303C9B61282DE525DC754A535CA2D6A9BD3D87 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\DB77E5CFEC34459146748B667C97B185619251BA --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\E22240E837B52E691C71DF248F12D27F96441C00 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\ED841A61C0F76025598421BC1B00E24189E68D54 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\F83099622B4A9F72CB5081F742164AD1B8D048C9 --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\FBB42F089AF2D570F2BF6F493D107A3255A9BB1A --> [Trojan.DisabledAVSecurityCerts]
Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 --> [Trojan.DisabledAVSecurityCerts]
Scan finished

 

Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted

Here's adwcleaner log: (Which after rebooting malwarebytes started with the boot somehow it open and im running it now then i will post below the adwcleaner log)

# AdwCleaner 7.0.8.0 - Logfile created on Tue Mar 13 03:31:07 2018
# Updated on 2018/08/02 by Malwarebytes
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

 

*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [6438 B] - [2018/2/9 12:7:45]
C:/AdwCleaner/AdwCleaner[C1].txt - [1538 B] - [2018/2/9 12:23:35]
C:/AdwCleaner/AdwCleaner[C2].txt - [3507 B] - [2018/2/25 14:41:6]
C:/AdwCleaner/AdwCleaner[C3].txt - [5425 B] - [2018/3/12 6:44:13]
C:/AdwCleaner/AdwCleaner[S0].txt - [4984 B] - [2017/10/17 15:9:52]
C:/AdwCleaner/AdwCleaner[S1].txt - [5052 B] - [2017/10/23 21:9:26]
C:/AdwCleaner/AdwCleaner[S2].txt - [6957 B] - [2018/2/9 12:3:58]
C:/AdwCleaner/AdwCleaner[S3].txt - [1378 B] - [2018/2/9 12:22:58]
C:/AdwCleaner/AdwCleaner[S4].txt - [3608 B] - [2018/2/25 14:33:26]
C:/AdwCleaner/AdwCleaner[S5].txt - [7021 B] - [2018/3/12 5:26:8]
C:/AdwCleaner/AdwCleaner[S6].txt - [6446 B] - [2018/3/12 6:32:35]
C:/AdwCleaner/AdwCleaner[S7].txt - [5775 B] - [2018/3/12 6:43:59]
C:/AdwCleaner/AdwCleaner[S8].txt - [1748 B] - [2018/3/13 3:30:39]


########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt ##########

 

 

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

I will wait for further instructions.
I see many disallowed certificates trojans
After rebooting malwarebytes opened.

Here's the scan result log:

42BD5CD9A716C9111E41EDA166EFC898307A147DFF2265A11C91438B1020D461
{
   "applicationVersion" : "3.4.4.2398",
   "clientID" : "MbamUI",
   "clientType" : "fullUIScan",
   "componentsUpdatePackageVersion" : "1.0.322",
   "cpu" : "x64",
   "dbSDKUpdatePackageVersion" : "1.0.4322",
   "detectionDateTime" : "2018-03-13T03:37:55Z",
   "fileSystem" : "NTFS",
   "id" : "ea90db24-266f-11e8-8e65-507b9d7a3a4b",
   "isUserAdmin" : true,
   "licenseState" : "free",
   "linkagePhaseComplete" : true,
   "loggedOnUserName" : "DESKTOP-I8MFVJM\\Nuno Jesus",
   "machineID" : "",
   "os" : "Windows 10 (Build 16299.248)",
   "schemaVersion" : 7,
   "sourceDetails" : {
      "clientMetadata" : {
         "jobId" : "",
         "scheduleId" : "",
         "scheduleTag" : ""
      },
      "objectsScanned" : 346020,
      "scanEndTime" : "2018-03-13T03:51:56Z",
      "scanOptions" : {
         "pumHandling" : "detect",
         "pupHandling" : "detect",
         "scanArchives" : true,
         "scanFileSystem" : true,
         "scanMemoryObjects" : true,
         "scanPUMs" : true,
         "scanPUPs" : true,
         "scanRookits" : false,
         "scanStartupAndRegistry" : true,
         "scanType" : "threat",
         "useHeuristics" : true
      },
      "scanResult" : "completed",
      "scanStartTime" : "2018-03-13T03:37:55Z",
      "scanState" : "completed",
      "type" : "scan"
   },
   "threats" : [
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:09Z",
            "generatedByPostCleanupAction" : false,
            "id" : "109c38e0-2670-11e8-8170-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "B1625CD9E01FEFE06CEE92786AC5EDCC",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\ic-0.0991ef07f5dc84.exe",
            "objectSha256" : "7871F53718730D7480D9B8F245E03FA5CC42C27695F38B01C8A935AC3BEB0A43",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [
            {
               "cleanAction" : "quarantine",
               "cleanResult" : "successful",
               "cleanResultErrorCode" : 0,
               "cleanTime" : "2018-03-13T03:52:25Z",
               "generatedByPostCleanupAction" : false,
               "id" : "192e033a-2670-11e8-87be-507b9d7a3a4b",
               "linkType" : "dirContent",
               "objectMD5" : "D41D8CD98F00B204E9800998ECF8427E",
               "objectPath" : "C:\\Users\\Nuno Jesus\\AppData\\Local\\Temp\\3808781\\dlreport",
               "objectSha256" : "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
               "objectType" : "file",
               "suggestedAction" : {
                  "chromeExtensionOther" : false,
                  "chromeExtensionPreferences" : false,
                  "chromeExtensionSecurePreferences" : false,
                  "chromeExtensionSyncData" : false,
                  "chromeUrlOther" : false,
                  "chromeUrlSecurePreferences" : false,
                  "chromeUrlSyncData" : false,
                  "chromeUrlWebData" : false,
                  "fileDelete" : true,
                  "fileReplace" : false,
                  "fileTxtReplace" : false,
                  "folderDelete" : false,
                  "isChromeObject" : false,
                  "minimalWhiteListing" : false,
                  "moduleUnload" : false,
                  "noLinking" : false,
                  "physicalSectorReplace" : false,
                  "priorityHigh" : false,
                  "priorityNormal" : false,
                  "priorityUrgent" : false,
                  "processUnload" : false,
                  "regKeyDelete" : false,
                  "regValueDelete" : false,
                  "regValueReplace" : false,
                  "treatAsRootkit" : false,
                  "useDDA" : false
               }
            },
            {
               "cleanAction" : "quarantine",
               "cleanResult" : "successful",
               "cleanResultErrorCode" : 0,
               "cleanTime" : "2018-03-13T03:52:25Z",
               "generatedByPostCleanupAction" : false,
               "id" : "19445982-2670-11e8-9a6b-507b9d7a3a4b",
               "linkType" : "dirContent",
               "objectMD5" : "49CE716F1F10F38575480B9222F045B2",
               "objectPath" : "C:\\Users\\Nuno Jesus\\AppData\\Local\\Temp\\3808781\\ic-0.4449976d67bf2.exe",
               "objectSha256" : "16E9893C7C4CF32D0CB8765A85E5B73DFE6EDEEE57301A57CFDEEBFA64BF8DC5",
               "objectType" : "file",
               "suggestedAction" : {
                  "chromeExtensionOther" : false,
                  "chromeExtensionPreferences" : false,
                  "chromeExtensionSecurePreferences" : false,
                  "chromeExtensionSyncData" : false,
                  "chromeUrlOther" : false,
                  "chromeUrlSecurePreferences" : false,
                  "chromeUrlSyncData" : false,
                  "chromeUrlWebData" : false,
                  "fileDelete" : true,
                  "fileReplace" : false,
                  "fileTxtReplace" : false,
                  "folderDelete" : false,
                  "isChromeObject" : false,
                  "minimalWhiteListing" : false,
                  "moduleUnload" : false,
                  "noLinking" : false,
                  "physicalSectorReplace" : false,
                  "priorityHigh" : false,
                  "priorityNormal" : false,
                  "priorityUrgent" : false,
                  "processUnload" : false,
                  "regKeyDelete" : false,
                  "regValueDelete" : false,
                  "regValueReplace" : false,
                  "treatAsRootkit" : false,
                  "useDDA" : false
               }
            },
            {
               "cleanAction" : "quarantine",
               "cleanResult" : "successful",
               "cleanResultErrorCode" : 0,
               "cleanTime" : "2018-03-13T03:52:26Z",
               "generatedByPostCleanupAction" : false,
               "id" : "194bd8ba-2670-11e8-911b-507b9d7a3a4b",
               "linkType" : "dirContent",
               "objectMD5" : "9FA0B1B1626E39517A3214F43497F15E",
               "objectPath" : "C:\\Users\\Nuno Jesus\\AppData\\Local\\Temp\\3808781\\ic-0.da0f2b897e81.exe",
               "objectSha256" : "6CBEE1E2AA58CD1C3730FD0285F8308B124358D33FA692B88A698BED13B3D6D8",
               "objectType" : "file",
               "suggestedAction" : {
                  "chromeExtensionOther" : false,
                  "chromeExtensionPreferences" : false,
                  "chromeExtensionSecurePreferences" : false,
                  "chromeExtensionSyncData" : false,
                  "chromeUrlOther" : false,
                  "chromeUrlSecurePreferences" : false,
                  "chromeUrlSyncData" : false,
                  "chromeUrlWebData" : false,
                  "fileDelete" : true,
                  "fileReplace" : false,
                  "fileTxtReplace" : false,
                  "folderDelete" : false,
                  "isChromeObject" : false,
                  "minimalWhiteListing" : false,
                  "moduleUnload" : false,
                  "noLinking" : false,
                  "physicalSectorReplace" : false,
                  "priorityHigh" : false,
                  "priorityNormal" : false,
                  "priorityUrgent" : false,
                  "processUnload" : false,
                  "regKeyDelete" : false,
                  "regValueDelete" : false,
                  "regValueReplace" : false,
                  "treatAsRootkit" : false,
                  "useDDA" : false
               }
            }
         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:27Z",
            "generatedByPostCleanupAction" : false,
            "id" : "109c38e1-2670-11e8-8b45-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:41:23Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66eb6ab8-2670-11e8-b741-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "49CE716F1F10F38575480B9222F045B2",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\ic-0.4449976d67bf2.exe",
            "objectSha256" : "16E9893C7C4CF32D0CB8765A85E5B73DFE6EDEEE57301A57CFDEEBFA64BF8DC5",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:41:23Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66eb6ab9-2670-11e8-a006-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:41:24Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66f24d42-2670-11e8-b317-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "9FA0B1B1626E39517A3214F43497F15E",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\ic-0.da0f2b897e81.exe",
            "objectSha256" : "6CBEE1E2AA58CD1C3730FD0285F8308B124358D33FA692B88A698BED13B3D6D8",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:41:24Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66f24d43-2670-11e8-ac90-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:28Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66fa4326-2670-11e8-9dea-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "B1625CD9E01FEFE06CEE92786AC5EDCC",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\4795500\\ic-0.8518e18d73fda.exe",
            "objectSha256" : "7871F53718730D7480D9B8F245E03FA5CC42C27695F38B01C8A935AC3BEB0A43",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [
            {
               "cleanAction" : "quarantine",
               "cleanResult" : "successful",
               "cleanResultErrorCode" : 0,
               "cleanTime" : "2018-03-13T03:52:28Z",
               "generatedByPostCleanupAction" : false,
               "id" : "69f19200-2670-11e8-a22d-507b9d7a3a4b",
               "linkType" : "dirContent",
               "objectMD5" : "D41D8CD98F00B204E9800998ECF8427E",
               "objectPath" : "C:\\Users\\Nuno Jesus\\AppData\\Local\\Temp\\4795500\\dlreport",
               "objectSha256" : "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
               "objectType" : "file",
               "suggestedAction" : {
                  "chromeExtensionOther" : false,
                  "chromeExtensionPreferences" : false,
                  "chromeExtensionSecurePreferences" : false,
                  "chromeExtensionSyncData" : false,
                  "chromeUrlOther" : false,
                  "chromeUrlSecurePreferences" : false,
                  "chromeUrlSyncData" : false,
                  "chromeUrlWebData" : false,
                  "fileDelete" : true,
                  "fileReplace" : false,
                  "fileTxtReplace" : false,
                  "folderDelete" : false,
                  "isChromeObject" : false,
                  "minimalWhiteListing" : false,
                  "moduleUnload" : false,
                  "noLinking" : false,
                  "physicalSectorReplace" : false,
                  "priorityHigh" : false,
                  "priorityNormal" : false,
                  "priorityUrgent" : false,
                  "processUnload" : false,
                  "regKeyDelete" : false,
                  "regValueDelete" : false,
                  "regValueReplace" : false,
                  "treatAsRootkit" : false,
                  "useDDA" : false
               }
            }
         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:29Z",
            "generatedByPostCleanupAction" : false,
            "id" : "66fa4327-2670-11e8-9401-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\4795500",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 5,
            "cleanTime" : "2018-03-13T03:52:29Z",
            "generatedByPostCleanupAction" : false,
            "id" : "6a02b4ea-2670-11e8-b667-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\F83099622B4A9F72CB5081F742164AD1B8D048C9",
            "objectSha256" : "",
            "objectType" : "regKey",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : true,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 436622,
         "rulesVersion" : "1.0.4322",
         "threatID" : 8214,
         "threatName" : "Trojan.DisabledAVSecurityCerts"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 5,
            "cleanTime" : "2018-03-13T03:52:29Z",
            "generatedByPostCleanupAction" : false,
            "id" : "6a0e553e-2670-11e8-b1e4-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\F83099622B4A9F72CB5081F742164AD1B8D048C9",
            "objectSha256" : "",
            "objectType" : "regKey",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : true,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 436622,
         "rulesVersion" : "1.0.4322",
         "threatID" : 8214,
         "threatName" : "Trojan.DisabledAVSecurityCerts"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:47:55Z",
            "generatedByPostCleanupAction" : false,
            "id" : "501b935c-2671-11e8-9c9d-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "B1625CD9E01FEFE06CEE92786AC5EDCC",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\4795500\\IC-0.8518E18D73FDA.EXE",
            "objectSha256" : "7871F53718730D7480D9B8F245E03FA5CC42C27695F38B01C8A935AC3BEB0A43",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:47:55Z",
            "generatedByPostCleanupAction" : false,
            "id" : "501b935d-2671-11e8-95ff-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\4795500",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:29Z",
            "generatedByPostCleanupAction" : false,
            "id" : "50a1bfe0-2671-11e8-ae96-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "E62CB3991C7C44EF3166B9DF331714F6",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\OFFICE ACTIVATOR 2016.RAR",
            "objectSha256" : "F3DF8DCABE48B677224F417B8C7C325B95C369D680EF7227462C1EA77175B156",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 476347,
         "rulesVersion" : "1.0.4322",
         "threatID" : 84,
         "threatName" : "RiskWare.BitCoinMiner"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:47:58Z",
            "generatedByPostCleanupAction" : false,
            "id" : "51d2f956-2671-11e8-9c7a-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "B1625CD9E01FEFE06CEE92786AC5EDCC",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\IC-0.0991EF07F5DC84.EXE",
            "objectSha256" : "7871F53718730D7480D9B8F245E03FA5CC42C27695F38B01C8A935AC3BEB0A43",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:47:58Z",
            "generatedByPostCleanupAction" : false,
            "id" : "51d2f957-2671-11e8-8bdd-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:47:58Z",
            "generatedByPostCleanupAction" : false,
            "id" : "51ee0dc2-2671-11e8-adf7-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "9FA0B1B1626E39517A3214F43497F15E",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\IC-0.DA0F2B897E81.EXE",
            "objectSha256" : "6CBEE1E2AA58CD1C3730FD0285F8308B124358D33FA692B88A698BED13B3D6D8",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 391393,
         "rulesVersion" : "1.0.4322",
         "threatID" : 1467,
         "threatName" : "PUP.Optional.YeaDesktop"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:30Z",
            "generatedByPostCleanupAction" : false,
            "id" : "51f5db42-2671-11e8-a9b2-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "D45DE0D447E91821E9E63BFD2371CAA9",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\ATIVADOR_OFFICE_2016_PERMANENTE_DEFINITIVO_PH_DOWN.RAR",
            "objectSha256" : "D2AB136ED3F6F5A89951E10E4D0AC98E95FEFEDE59F56C47DC25AE8F34D1D28E",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 499724,
         "rulesVersion" : "1.0.4322",
         "threatID" : 152,
         "threatName" : "Adware.FileTour"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:48:02Z",
            "generatedByPostCleanupAction" : false,
            "id" : "5469e648-2671-11e8-a01b-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "49CE716F1F10F38575480B9222F045B2",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781\\IC-0.4449976D67BF2.EXE",
            "objectSha256" : "16E9893C7C4CF32D0CB8765A85E5B73DFE6EDEEE57301A57CFDEEBFA64BF8DC5",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "duplicate",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:48:02Z",
            "generatedByPostCleanupAction" : false,
            "id" : "5469e649-2671-11e8-b15b-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\3808781",
            "objectSha256" : "",
            "objectType" : "folder",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : false,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : true,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 463480,
         "rulesVersion" : "1.0.4322",
         "threatID" : 18,
         "threatName" : "PUP.Optional.BundleInstaller"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:31Z",
            "generatedByPostCleanupAction" : false,
            "id" : "5710e3d8-2671-11e8-9dbd-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "C32DB3257D0E9002B47A7FB0F1D9E557",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\RE-LOADER.RAR",
            "objectSha256" : "FFB901C45A00BE411FD271226E2E05B9DEAB0A688AF756AF682F2F3865FEA678",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 476347,
         "rulesVersion" : "1.0.4322",
         "threatID" : 84,
         "threatName" : "RiskWare.BitCoinMiner"
      },
      {
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "cleanAction" : "quarantine",
            "cleanContext" : {
            },
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "2018-03-13T03:52:32Z",
            "generatedByPostCleanupAction" : false,
            "id" : "5777db10-2671-11e8-b005-507b9d7a3a4b",
            "linkType" : "none",
            "objectMD5" : "0BDF0083A4DB722469444CEFB673EC37",
            "objectPath" : "C:\\USERS\\NUNO JESUS\\APPDATA\\LOCAL\\TEMP\\KMSAUTO NET.ZIP",
            "objectSha256" : "8EAE4F26BB63A6343E99987AD5AE93FEEAC100DCFB89348A15A9F006F368B45B",
            "objectType" : "file",
            "suggestedAction" : {
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "treatAsRootkit" : false,
               "useDDA" : false
            }
         },
         "ruleID" : 380488,
         "rulesVersion" : "1.0.4322",
         "threatID" : 2,
         "threatName" : "PUP.Optional.InstallCore"
      }
   ],
   "threatsDetected" : 10
}

 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Good :) Now let's run RogueKiller.

RQKuhw1.pngRogueKiller

  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply

Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted

Here's the log:

RogueKiller V12.12.8.0 (x64) [Mar 12 2018] (Free) por Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Site : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Sistema Operativo : Windows 10 (10.0.16299) 64 bits version
Iniciou : Modo normal
Utilizador : Nuno Jesus [Administrador]
Começado de : C:\Users\Nuno Jesus\Downloads\RogueKiller_portable64.exe
Modo : Apagar -- Data : 03/13/2018 16:59:19 (Duration : 00:41:46)

¤¤¤ Processos : 0 ¤¤¤

¤¤¤ Registo : 15 ¤¤¤
[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KMS-R@1n (C:\Windows\KMS-R@1n.exe) -> Apagado
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F3EC4574-CA6A-4280-BB27-94BA0E77C9AD} : v2.27|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Users\Nuno Jesus\AppData\Roaming\ACEStream\engine\ace_engine.exe|Name=AceStream| [x] -> Apagado
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {727EB51E-2428-4EC0-8E51-961BE7E9F145} : v2.27|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Users\Nuno Jesus\AppData\Roaming\ACEStream\engine\ace_engine.exe|Name=AceStream| [x] -> Apagado
[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {2CA8D196-17C1-4F16-B5F0-7BC52F685D6A} : v2.27|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=1688|App=C:\Windows\KMS-R@1n.exe|Name=KMS-R@1n| [-] -> Apagado
[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {32682497-5B0B-4160-94DC-2291F072614E} : v2.27|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|LPort=1688|App=C:\Windows\KMS-R@1n.exe|Name=KMS-R@1n| [-] -> Apagado
[Adw.Microtool] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{DEF84442-A7C7-4AB0-AFCF-6D7396EF848B}C:\windows\window.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\windows\window.exe|Name=window|Desc=window|Defer=User| [x] -> Apagado
[Adw.Microtool] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{50CD2587-05DD-4A8F-AF1F-4E93E959E7C2}C:\windows\window.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\windows\window.exe|Name=window|Desc=window|Defer=User| [x] -> Apagado
[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSppSvc.exe | Debugger : KMS-R@1nhook.exe [-] -> Apagado
[PUP.HackTool|VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe | Debugger : KMS-R@1nhook.exe [-] -> Apagado
[PUP.HackTool|VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSppSvc.exe | Debugger : KMS-R@1nhook.exe [-] -> ERROR [2]
[PUP.HackTool|VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe | Debugger : KMS-R@1nhook.exe [-] -> ERROR [2]
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Substituído (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Substituído (2)
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1185937808-2822752954-2417405274-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Substituído (1)
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1185937808-2822752954-2417405274-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0  -> Substituído (1)

¤¤¤ Tarefas : 0 ¤¤¤

¤¤¤ Arquivos : 31 ¤¤¤
[BitMiner.Gen0][Ficheiro] C:\Disk\securedisk.exe -> Apagado
[PUP.HackTool][Pasta] C:\Windows\AutoKMS -> Apagado
[PUP.HackTool][Ficheiro] C:\Windows\AutoKMS\AutoKMS.exe -> Apagado
[PUP.HackTool][Ficheiro] C:\Windows\AutoKMS\AutoKMS.log -> Apagado
[PUP.HackTool][Ficheiro] C:\Windows\KMS-R@1n.exe -> Apagado
[PUP.HackTool][Ficheiro] C:\Windows\KMS-R@1nhook.exe -> Apagado
[PUP.Gen0][Ficheiro] C:\Windows\SECOH-QAD.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.6_42094\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.8_42449\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.8_42576\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_42606\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_42923\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_42973\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_43295\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.5.0_43804\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.5.0_43916\utorrentie.exe -> Apagado
[PUP.uTorrentAds][Ficheiro] C:\Users\Nuno Jesus\AppData\Roaming\uTorrent\updates\3.5.0_44090\utorrentie.exe -> Apagado
[PUP.Gen1][Pasta] C:\Users\Nuno Jesus\AppData\Local\PackageAware -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shark007 Codecs\64bit Settings Application.lnk [LNK@] C:\PROGRA~1\Shark007\Tools\SETTIN~1.EXE -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shark007 Codecs\Settings Application 32bit.lnk [LNK@] C:\PROGRA~2\Shark007\Advanced\Tools\SETTIN~1.EXE -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shark007 Codecs\Uninstall 32bit Advanced.lnk [LNK@] C:\PROGRA~2\Shark007\Advanced\Tools\SETTIN~1.EXE uninstall -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shark007 Codecs\Uninstall x64Components.lnk [LNK@] C:\PROGRA~1\Shark007\Tools\SETTIN~1.EXE uninstall -> Apagado
[PUP.HackTool][Pasta] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TNod User & Password Finder -> Apagado
[PUP.HackTool][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TNod User & Password Finder\README.lnk -> Apagado
[PUP.HackTool][Ficheiro] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TNod User & Password Finder\Uninstall.lnk -> Apagado
[PUP.HackTool][Pasta] C:\Program Files\KMSpico -> Removido na reinicialização [91]
[PUP.HackTool][Pasta] C:\Program Files\KMSpico\scripts -> ERROR [5]
[PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup -> ERROR [5]
[PUP.AutoIt.Gen][Ficheiro] C:\Program Files\Shark007\Tools\Settings64.exe -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\Program Files (x86)\Shark007\Advanced\Tools\conflict.exe -> Apagado
[PUP.AutoIt.Gen][Ficheiro] C:\Program Files (x86)\Shark007\Advanced\Tools\Settings32.exe -> Apagado
[Tr.Gen][Pasta] C:\Program Files (x86)\TNod -> Apagado
[Tr.Gen][Ficheiro] C:\Program Files (x86)\TNod\CREDITS.txt -> Apagado
[Tr.Gen][Ficheiro] C:\Program Files (x86)\TNod\LEEME.txt -> Apagado
[Tr.Gen][Ficheiro] C:\Program Files (x86)\TNod\tnodicons.icl -> Apagado

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Arquivos de hosts : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

¤¤¤ Navegadores : 0 ¤¤¤

¤¤¤ Verificação da MBR : ¤¤¤
+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] 37105426c042f3a6ce9eb9265b9b6720
[BSP] 2703dd6fb3d861835d8b5e366778bead : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1026048 | Size: 202476 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 415698944 | Size: 889 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 417521664 | Size: 750000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

The file Malwarebytes detected was already quarantined by RogueKiller, so it's fine :)

iO3R662.pngFarbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

  • Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
  • Right-click on the FRST executable and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Fix button
    NYA5Cbr.png
  • On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
  • Copy and paste its content in your next reply


 

fixlist.txt

Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted

Fix result of Farbar Recovery Scan Tool (x64) Version: 14.03.2018
Ran by Nuno Jesus (15-03-2018 15:47:25) Run:1
Running from C:\Users\Nuno Jesus\Downloads
Loaded Profiles: Nuno Jesus &  (Available Profiles: Nuno Jesus)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-1185937808-2822752954-2417405274-1003\...\Run: [] => [X]
GroupPolicy: Restriction <==== ATTENTION

SearchScopes: HKLM -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> DefaultScope value is missing

Task: {0439AF2F-CDB0-46E8-BD5E-0AFF02FC9D3C} - \Microsoft\Windows\Management\Provisioning\PostResetBoot -> No File <==== ATTENTION
Task: {16A8D5A6-53AF-44DC-AEF3-E36C8929B99E} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {CDA905F6-DE7A-482A-A042-9FC1B911E077} - System32\Tasks\{9BD9769F-9644-4E5D-B4A4-D30A6A9B72BA} => C:\WINDOWS\system32\pcalua.exe -a "C:\Program Files\KMSpico\UninsHs.exe" -d "C:\Program Files\KMSpico\sounds" -c /u0=KMSpico

C:\Applications
C:\Disk
C:\Windat
C:\WinSys
C:\ProgramData\63e2c58283
C:\ProgramData\9228o60c24w9289
C:\ProgramData\74960f38644l53964z4
C:\Users\Nuno Jesus\AppData\Local\mpress
C:\Users\Nuno Jesus\AppData\Local\installer.dat
C:\WINDOWS\system32\Drivers\WinDivert64.sys

EmptyTemp:
*****************

Processes closed successfully.
Restore point was successfully created.
"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" => removed successfully
"HKU\S-1-5-21-1185937808-2822752954-2417405274-1003\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{0439AF2F-CDB0-46E8-BD5E-0AFF02FC9D3C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0439AF2F-CDB0-46E8-BD5E-0AFF02FC9D3C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Management\Provisioning\PostResetBoot" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{16A8D5A6-53AF-44DC-AEF3-E36C8929B99E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{16A8D5A6-53AF-44DC-AEF3-E36C8929B99E}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => could not remove. Access Denied.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CDA905F6-DE7A-482A-A042-9FC1B911E077}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CDA905F6-DE7A-482A-A042-9FC1B911E077}" => removed successfully
C:\WINDOWS\System32\Tasks\{9BD9769F-9644-4E5D-B4A4-D30A6A9B72BA} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9BD9769F-9644-4E5D-B4A4-D30A6A9B72BA}" => removed successfully
C:\Applications => moved successfully
C:\Disk => moved successfully
C:\Windat => moved successfully
C:\WinSys => moved successfully
C:\ProgramData\63e2c58283 => moved successfully
C:\ProgramData\9228o60c24w9289 => moved successfully
C:\ProgramData\74960f38644l53964z4 => moved successfully
C:\Users\Nuno Jesus\AppData\Local\mpress => moved successfully
C:\Users\Nuno Jesus\AppData\Local\installer.dat => moved successfully
C:\WINDOWS\system32\Drivers\WinDivert64.sys => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 7364608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 224056590 B
Java, Flash, Steam htmlcache => 1227 B
Windows/system/drivers => 41324 B
Edge => 484 B
Chrome => 300437 B
Firefox => 379929709 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 822 B
NetworkService => 0 B
Nuno Jesus => 6184787 B

RecycleBin => 0 B
EmptyTemp: => 589.3 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 15-03-2018 15:55:03)


Result of scheduled keys to remove after reboot:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => could not remove. Access Denied.

==== End of Fixlog 15:55:04 ====

Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted

How to Analyze Boot Logs

Boot logging lists the files that successfully and unsuccessfully processed during startup. You use boot logging to log the Windows features that are processed when you start your computer in safe mode and also in normal mode. By comparing the differences between the two logs, you can determine which features are not required to start.

Windows records the name and path of each file that runs during startup in a log, %WinDir%\Ntbtlog.txt. The log marks each file as successful ("Loaded Driver...") or unsuccessful ("Did Not Load Driver..."). Boot logging appends entries to Ntbtlog.txt when you start Windows in safe mode. Comparing normal mode and safe mode entries enables you to determine which services run in normal mode only-one of which must be the cause of the startup problem if Windows is able to start in safe mode successfully. The following lines are sample Ntbtlog.txt entries. 

Loaded driver \SystemRoot\System32\DRIVERS\flpydisk.sys
Did not load driver \SystemRoot\System32\DRIVERS\sflpydisk.SYS

Note that not every "Did Not Load Driver" message necessarily indicates an error that would prevent Windows from booting, because many drivers are not required for Windows to start. To repair problems caused by problematic drivers when you can start safe mode, follow these steps:

  1. Restart the computer and enable boot logging.
  2. Restart the computer after it fails and then start safe mode.
  3. Click Start and then type %WinDir%\ntbtlog.txt. The boot log file opens in Notepad.
  4. Compare the list of drivers loaded in normal mode to the list of drivers loaded in safe mode. The driver that is causing the system to fail is one of the drivers listed with "Loaded Driver..." in the normal mode boot log, but listed with "Did Not Load Driver..." in the safe mode boot log.
  5. In safe mode, use Device Manager to replace or roll back potentially problematic drivers, as described in the next section, "How to Roll Back Drivers." Start by replacing drivers that have been recently installed or updated. After replacing a driver, repeat this process until the system starts successfully in normal mode.

For the services that run only in normal mode, disable those services one at a time, trying to restart your computer in normal mode after you disable each service. Continue to disable services individually until your computer starts in normal mode.

To repair problems caused by problematic drivers when the computer does not start in safe mode, follow these steps:

  1. Restart the computer and then load System Recovery tools.
  2. Click Command Prompt. At the command prompt, type Notepad %WinDir%\ ntbtlog.txt. Notepad opens and displays the boot log.
  3. Compare the boot log created when the system failed to start in safe mode to a boot log created when the system started successfully in safe mode. If you do not have a boot log that was created when the system started successfully in safe mode, create a boot log on a similarly configured computer by starting it in safe mode. The driver that is causing safe mode to fail is one of the drivers that is not listed in the boot log that was created when the system failed but is listed with "Loaded Driver..." in the boot log created when safe mode started successfully.
  4. Replace the driver file with a working version, using the Copy command at the command prompt. Start by replacing or deleting drivers that have been recently installed or updated. After replacing a driver, repeat this process until the system starts successfully in normal mode.
Link to post
Share on other sites
Kape33

Kape33

Posted
  • Author
Posted (edited)

Yes. Why?
I used this F-SecureOnlineScanner, adwcleaner, malwarebytes, adware removal tool by TSA,  spybot antibeacon after all these problems, i was trying to find infections with this programs one after another and malwarebytes stopped opening but it was already with this boot problems, i think it started after i installed the update w10 fall creators, not at that moment exactly but before that update my boot was faster.

Edited by Kape33
Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.