Malware/rootkit has taken over my computer and my scan finds nothing!!!

[pkismyname]

This morning, I was watching a video on youtube, when all of the sudden my computer started using a lot of resources, and it started running very slow. I went into control panel to look at a few things, and now I cant access anything with UAC control, because an admin account with corresponding password has been created, and it was not this way before.

I can tell that there have been extra files created in my c and c:windows folder just moments after all of this started happening.

I have the paid version of malwarebytes, but it is finding nothing when I run a threat scan. I know something is up, but I cannot seem to figure this out. PLEASE SOMEONE HELP!!!! Any guidance/information would be greatly appreciated!!!!!!!!

P.S. My computer once had a rootkit a long time ago, and my computer is displaying very similar behavior when compared to when it was previously infected. 

[AdvancedSetup]

Hello @pkismyname and

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[pkismyname]

Hi Ron,

Thank you for the reply. At the top of my Malwarebytes program screen, it says Malwarebytes premium 3.3.1. However, when I open the program, it prompts me to install a newer version. I tried to install it that way, and I also downloaded the newest version from the link in step 1, however I am not able to install any programs because I am prompted for a password by UAC. As i said in my first post, I never created an administrator account, and I also did not create any password. So I am not sure how to proceed with installing any of the programs listed in steps 1-3. I have attached the export summary as requested. 

Also, I was able to download the Farbar Recovery Scan Tool, and install it without being prompted by UAC, which surprised me because i was not able to install the program listed in step 2. I have not yet run the Farbar scan, as it is step 3, and I did not run step 2 yet. I just didnt want to do things out of order without your say so. 

Thanks again, Ron!!

PK

Threat Scan.txt

[AdvancedSetup]

Well, assuming you own the computer and have physical access to it you can try the following to see if you can reset the Administrator password. If your own account has Admin rights then you can go into the Users accounts and change the local administrators' password and enable the account.

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/enable-and-disable-the-built-in-administrator-account

https://www.makeuseof.com/tag/3-ways-to-reset-the-forgotten-windows-administrator-password/

If that does not work then you can try the following

https://www.isunshare.com/windows-10-password/reset-remove-windows-10-administrator-password-with-usb.html

 

[pkismyname]

Hello again,

OK I reset the password and I have followed all 3 steps. Attached is all of the requested documentation. As you can see, 2 log files were generated by AdwCleaner, so I attached them both. Also, I am attaching the Threat Scan that I ran today (instead of attaching the one I ran on 3/29).  I hope I did everything correctly!

Regards,

PK

 

 

 

Updated Threat Scan.txt

Addition.txt

FRST.txt

AdwCleaner[C0].txt

AdwCleaner[S0].txt

[AdvancedSetup]

As you can see. You ran FRST as the PC account (which is limited) - I would highly recommend that you create a secondary account that has Admin rights that you use for this. There are times or reasons one may want or need another valid account that has Admin rights. Having only the built-in account if it got corrupted could prove very difficult to fix if needed, by having a 2nd account with Admin rights (even if you never or rarely used it) would be prudent in my opinion.

Ran by PC (ATTENTION: The user is not administrator) on PK (02-04-2018 16:28:26)

We need you to run FRST with an account that has Admin rights, please.

Thank you

Ron

 

[pkismyname]

Here are the 2 text documents that were generated when I ran FRST with an admin account.

Thanks

PK

FRST.txt

Addition.txt

[AdvancedSetup]

Okay, those logs look pretty good overall. Nothing server showing in the logs.

How is the computer running now? What issues are you still having?

Thanks

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks