Persistent Malware, need some help!

[Dieks]

Hello,

I suspect that my computer has been infected by malware, usually I wouldn't be worried and use a few programs to remove it on my own. This time, however, the malware is very persistent.
A few symptoms I noticed on my own are:

1. A blank process taking a little over half of my CPU
2. A second blank process which doesn't take up any significant amount resources
3. An inability to use the Windows File Explorer

The problem appeared after downloading a wrong installer which installed multiple programs (I assume these to have been virusses or other malware) which I mostly removed, although some has been left behind.

As far as what I have done goes: I have

1. Scanned it with Malwarebytes
2. Scanned it with Roguekiller
3. Reboot my PC multiple times
4. Downloaded AVG Anti-virus and did a complete thorough scan (without finding anything)

I followed the pinned post telling me what to do, and the results are in the attached files.
The reason why the Malwarebytes Threat Scan Logs might be different from a normal one is due to me having to copy it and then paste it onto a .txt file on my own.

Thank you for your time!

FRST.txt

Addition.txt

Malwarebytes Threat Scan Log.txt

[Aura]

Hi Dieks

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Fix button
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
• Copy and paste its content in your next reply
  

fixlist.txt

[Dieks]

Hello Aura,
Thank you for helping me!

I have done as you requested, although FRST did require me to restart my computer after the fix was completed.?
Either way, the requested log is attached below.

Fixlog.txt

Kind regards,
Dieks

[Aura]

That's normal. Can you do me a favor? Can you .zip the C:\FRST\Quarantine folder and attach it here?

[Dieks]

I would love to, however, I seem to be having an issue trying to use the Windows File Explorer, namely how it often stops responding or gets stuck on the last bit while trying to load.
I will keep trying, but if there is a way to fix this before I succeed please do tell me!

[Dieks]

I managed to find a way around this issue by using %appdata% file location and then navigating to the mentioned folder. I then ran into another problem which I fixed by granting verified users full control over the folder by going to Properties -> Security -> Edit and grant verified users full control. As requested, I have provided a zipped Quaranteed folder below!

The reason for me writing down every step I took is to make sure that you can see if I made any mistakes.
 

Quarantine.zip

[Aura]

Thank you. Now let's do a sweep with AdwCleaner and RogueKiller.

AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
  

RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply
  

Your next reply(ies) should therefore contain:

• Copy/pasted AdwCleaner clean log
• Copy/pasted RogueKiller clean log
  

[Dieks]

As requested, here are the logs for both AdwCleaner and RogueKiller.

AdwCleaner:
 

Quote

# -------------------------------
# Malwarebytes AdwCleaner 7.2.3.1
# -------------------------------
# Build:    09-03-2018
# Database: 2018-09-06.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    09-08-2018
# Duration: 00:00:02
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF1F1901-098E-4B7E-BDAB-BBAD7AEC2086}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [5066 octets] - [05/09/2018 15:36:58]
AdwCleaner[C00].txt - [4504 octets] - [05/09/2018 15:37:20]
AdwCleaner[S01].txt - [1462 octets] - [08/09/2018 14:12:55]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########
 

 

And RogueKiller:
 

Quote

RogueKiller V12.12.34.0 (x64) [Sep  3 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.17134) 64 bits version
Started in : Normal mode
User : dieks [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 09/08/2018 14:24:23 (Duration : 00:28:44)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA HDWD110 +++++
--- User ---
[MBR] f0317af197b0065d2b4938fec872afe2
[BSP] db91b9a7d278b4bf9eb267a0217b4797 : Empty|VT.Unknown MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 499 MB
1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 1024000 | Size: 100 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 1228800 | Size: 16 MB
3 - Basic data partition | Offset (sectors): 1261568 | Size: 953253 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: TOSHIBA DT01ACA200 +++++
--- User ---
[MBR] 703903d4f3903668c4dc30991ba79209
[BSP] 9e3b3c473b1db0daa516427cdae6e1cc : Windows Vista/7/8 MBR Code
Partition table:
0 - Microsoft reserved partition | Offset (sectors): 34 | Size: 128 MB
1 - Basic data partition | Offset (sectors): 264192 | Size: 1907600 MB
User = LL1 ... OK
User = LL2 ... OK

 

[Aura]

Good! How's your system behaving now? Were there any other issues to address?

[Dieks]

My system itself seems to be fine, aside from an issue that started after I was infected with Malware, namely that my Windows File Explorer often gets stuck on loading, or just stops responding outright as I have mentioned previously.
I haven't tried troubleshooting this yet as I read that I should not change anything without asking first (although I realise I could've asked about this sooner). I think I can solve this on my own though it would be reassuring to have an expert help me through the process!

If you consider it to be an issue I should solve in my own, then I would like to say thank you for sticking with me through this mess, otherwise I hope to hear my next instructions soon!
 

[Aura]

Does your Windows Explorer crashes (or gets stuck on loading) only when you try to open it using the shortcut from the Windows taskbar? Or only when you open it from a certain folder (ie: This PC, or Quick Access)?

[Dieks]

When opening it from the Windows Taskbar, it opens up the file explorer, after which any action results into it not responding.
If I attempt to open a folder located on the desktop it does not open at all. A workaround I found was searching for "%appdata%" this works for the most part, but it stops responding or gets stuck on loading when I click the following tabs

• Desktop
• Downloads
• Documents
• Pictures
• This PC

[AdvancedSetup]

Hello @Dieks

@Aura is out for a while doing some training. I'll go ahead and assist you while he is away.

Please run the following and we'll see about getting you fixed up. Hopefully the firsts 2 logs come back clean. Then we'll review the updated new FRST logs and see what we can find.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Dieks]

Hello Ron, thank you for assisting me further. I hope Aura will enjoy his training!

Anyway, as you have requested I have attached all of the files below!

I look forward to working with you while Aura is away.

FRST.txt

Addition.txt

Malwarebytes Threat Scan Log.txt

AdwCleaner[C02].txt

[AdvancedSetup]

Okay, since so much unwanted items were found in Google Chrome, let me have you run the following to clean up Chrome.

 

Once that's done. Please reboot the computer and run the same scans again. This time, hopefully they will come back clean.

Any questions or issue, please let me know.

Ron

 

 

[Dieks]

Hi there,
So after following the guide Malwarebytes didn't detect anything anymore, but I still have this issue where Windows File Explorer isn't working correctly.
I suppose that it wasn't related to malware then. Am I required to go to a different forum to ask about this or will you help me?

[AdvancedSetup]

Please run the following fix and let's see if it helps.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Ron

 

 

[Dieks]

It took a little while to complete, but after a reboot the issue still persisted.

Fixlog.txt

[AdvancedSetup]

What specific issue are you still seeing or experiencing please.

 

[Dieks]

When opening the File Explorer, I experience either of these 2 things.

1. It starts up, tries to load Quick Access, and lingers at the end of the loading process and doesn't finish.
2. It stops responding, and I am required to end the process, which seems to also restart Windows? Though I am not 100% sure about that. (Trying to navigate away from Quick Access while it's loading also causes this)

Some things to note are that I can not open Folders located on my desktop, searching for "%appdata%"  works partially, as in I can browse quite a few folders until I go back to My PC, after which it stops responding.

What I've tried on my own so far is:

• To change the starting folder for File Explorer to "My PC" which did not help.
• Change it to start up maximized (again, nothing changed)

I have also checked the health of my Hard Drive using "CrystalDiskInfo" which showed no problems there.

[AdvancedSetup]

Well, might be time to actually look at backing up your data. Formatting the drive and reinstalling Windows

 

[Dieks]

I see, well thank you for trying to help. I hope a fresh install will help.

[AdvancedSetup]

A bit of work, but in the end I think you'll be much happier with a new fresh install of Windows.

I'll go ahead and close your topic but if you need something else please let us know.

Take care and have a great weekend.

Ron