BitCoin Miner

[The_Help]

I think I've been infected with a bitcoin mining virus, League of Legends, Steam, Internet Explorer and Microsoft Edge all use 100% GPU if I run them. 

MWB 6-2-2019.txt Addition_02-06-2019 14.11.59.txt FRST_02-06-2019 14.11.59.txt

[AdvancedSetup]

Hello @The_Help and

Please run the following fix and we'll go from there.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[The_Help]

Here's the Fixlog

Fixlog.txt

[The_Help]

The problems persist, I've updated my video drivers and ran the fixlist a second time with no luck.

[AdvancedSetup]

Yes, that was just for some general clean up.

Please run the following in the provided order.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[The_Help]

 -------------------------------
# Malwarebytes AdwCleaner 7.3.0.0
# -------------------------------
# Build:    04-04-2019
# Database: 2019-05-27.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    06-06-2019
# Duration: 00:00:01
# OS:       Windows 10 Home
# Cleaned:  14
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\ProgramData\SecuritySuite
Deleted       C:\Users\Crater\AppData\Local\MalwareProtectionLive
Deleted       C:\Users\Crater\AppData\Roaming\BrowserExtensions

***** [ Files ] *****

Deleted       C:\Users\Crater\Downloads\SpyHunter-Installer.exe

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Browser Extensions
Deleted       HKCU\Software\SSProtect
Deleted       HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}
Deleted       HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61db39d5-034c-45c0-8bb2-daf857edcf3b}
Deleted       HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|MalwareProtectionLive
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1672163f-8651-4c0d-9c05-4ba941123972}
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61db39d5-034c-45c0-8bb2-daf857edcf3b}
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{90E4CD0C-426F-4207-805B-7885AB32D43F}
Deleted       HKLM\Software\Wow6432Node\\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAE9BEC8-4723-4347-AFC6-25EE3326BA5B}

***** [ Chromium (and derivatives) ] *****

Deleted       Amazon Assistant for Chrome

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2709 octets] - [06/06/2019 19:38:06]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 

Addition 6-6-2019.txt MWB 6-6-2019.txt FRST 6-6-2019.txt

[AdvancedSetup]

Please follow the directions from the following topic

Then reboot and let me know how the computer is running now

 

[The_Help]

@AdvancedSetup  The 100% GPU use is still present when running the previously mentioned affected programs. 

[AdvancedSetup]

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

[The_Help]

@AdvancedSetup  Scanned 4 times and restarted twice. Found 5 Objects. Three of which were humorously named "not_a_virus" 

Unfortunately the issue is still not resolved. 100% GPU Usage on the same programs. 

[AdvancedSetup]

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• Open Chrome and at the top right, click  More tools  Extensions
• Write down the list of Extensions installed.
• Next, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
   
  • 
     
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and let me know if it's any better or not.

Thanks

Ron

 

 

[The_Help]

@AdvancedSetup  Completed steps. GPU Usage issue still apparent in League launcher and Steam. IE and Edge are both "blocked from accessing graphics hardware" by windows defender.

[AdvancedSetup]

Okay, I don't believe you're infected but you do appear to have something odd going on with the computer.

Let's try the following fix and see if it helps to resolve the issue. It will check your OS files and run a disk check as well.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Ron

 

[The_Help]

@AdvancedSetup Ran it. Here's the log. Looks like an error occurred. The same issues are still happening. 

Fixlog.txt

[AdvancedSetup]

Please upload this log file. You can zip it if you like

 C:\WINDOWS\Logs\DISM\dism.log

 

[The_Help]

@AdvancedSetup Here it is

dism.log

[AdvancedSetup]

Please restart the computer one more time and try running the same script again and let me know if it gets the same error.

 

[The_Help]

@AdvancedSetup  Ran the fixlist again. No Fixlog created this time. No changes in issues.

[AdvancedSetup]

It should always create a new log.

My concern is if the DISM command ran properly this time or not.

 

Please open an Admin command prompt and type or  copy/paste the following. Then post back the results either by text or screenshot

 

DISM.exe /Online /Cleanup-image /Restorehealth

 

Ron

 

[The_Help]

C:\WINDOWS\system32>DISM.exe /Online /Cleanup-image /Restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.765

[===========================82.7%===============           ]
Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log
 

dism.log

[The_Help]

@AdvancedSetup It seems to be some error with .NET framework. 

[AdvancedSetup]

Please see if the following guide helps. You basically need to get a good source file for it to use to do the repair. Ignore their ads and don't install anything except from Microsoft.

https://www.wintips.org/fix-dism-0x800f081f-error-in-windows-10-8/

Similar article on how to fix

https://www.winhelponline.com/blog/dism-restorehealth-error-0x800f081f-windows-10/

Let me know.

Ron

 

Edited June 8, 2019 by AdvancedSetup
updated information

[The_Help]

@AdvancedSetup Completed the entire guide. Re-performed (DISM.exe /Online /Cleanup-image /Restorehealth) with 0 Errors.

 

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.765

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

 However, nothing has changed. Still the same issues with the same programs. 

I tried uninstalling the graphics card and re-installing all drivers once more. 

 

 

[AdvancedSetup]

Please restart the computer into Safe Mode with Networking. The games may not play but see if you can determine if the issue has changed from safe mode or not.

If not able to tell, then please create a new user account with Admin rights. Then log into that new account and see if you're still having the same issue or not

 

[The_Help]

@AdvancedSetup ...Launching in safemode with networking has eliminated the problem. All programs run smooth with no GPU overuse.