Regsvr running high CPU and infection Keeps coming back

[Lucid_Enemy]

I have been battling this malware for over a month now. I get rid of it and it keeps coming back. I did a trial with malware-bytes and its kept it from reinstalling but randomly regsvr32 runs and hogs CPU and then I kill it and everything is fine for anywhere from a week to an hour. obviously there is something in the registry causing it to constantly check if the latest malware is installed or not. It was at first triggered by chrome but I uninstalled and reinstalled chrome (clearing left over files so I had a fresh install of chrome, I even switched from chrome to FF but not just for that reason) I have attached my FRST and Malware-bytes logs. I'm pretty good at things like this but for some reason this one has me stumped. If I need to run any other logs let me know (Im used to Hijackthis but it seems that is outdated :P)

malwarebytesexport.txt Addition.txt FRST.txt

[Lucid_Enemy]

Im not sure if this is right but it looks like

Task: {37E59ECA-5ABE-420D-A6C7-AC7B21E37456} - System32\Tasks\Reason Antivirus UI => C:\Program [Argument = Files\Reason\Reason Antivirus\ReasonAV.exe MMO]

ask: {4E6E490B-AA31-4B93-944A-733AD73DD179} - System32\Tasks\2380C978-D791-BDE8-480C-A83A70A60991 => C:\WINDOWS\SysWOW64\regsvr32.exe /n /s /i:"/178747020981477f /q" "C:\PROGRA~3\137F24~1\{9B0DF~1."

Task: {6BDB9221-A9CE-41BA-9C77-9A3C65E6F1D8} - \Adroit System Care_Logon -> No File <==== ATTENTION

Task: {A82D3CFE-9BD6-426D-8EAB-D88DE23418C6} - \Adroit System Care_DDelayScheduled -> No File <==== ATTENTION

Task: {AA4A5050-2DC0-4197-A5B4-6D7E9FB736AE} - System32\Tasks\C5FF7040-4A71-D20B-40F8-4AD75EA81252 => C:\WINDOWS\SysWOW64\regsvr32.exe /n /s /i:"/15d99afa9c6be140 /q" "C:\PROGRA~3\31FE8C~1\{5AEEF~1."

 

seem to be the culprits do I just copy that into FRST and hit fix? Ive never used FRST before

[Maurice Naggar]

Hi, 

My name is Maurice. I will be helping and guiding you, going forward on this case.

Please do NOT do any fixes on your own,

We need to get additional information from this machine in order to have the proper detail to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

    Download Malwarebytes Support Tool
    
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.4.0.615.exe to run the report
        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !
    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
    Please attach the ZIP file in your next reply.

 

Thank you.

 

[Lucid_Enemy]

mbst-grab-results.zip

[Maurice Naggar]

Thanks for the report file.  I do not see any scan reports from Malwarebytes nor the Malwarebytes for Windows installed.

We really should do a scan with Malwarebytes for Windows first.

 

Here is what I would suggest to start with.

We need to get these entries out of the Hosts file.   (later on I can provide alternate ways )

0.0.0.0                   telemetry.malwarebytes.com
0.0.0.0                   telemetry.mwbsys.com

Follow the tips on Windows 10 at this article at Microsoft

https://support.microsoft.com/en-us/help/972034/how-to-reset-the-hosts-file-back-to-the-default

[ 2 ] Next, install Malwarebytes for Windows.

Use this how-to-guide  https://support.malwarebytes.com/docs/DOC-1141

Next

Start Malwarebytes for Windows.

Click Settings button >> click the Application tab

Click the grey button "Install Application Updates".   You should see some updating & then a notice to Upgrade to the new version 3.8.3

Reply YES & follow the prompts to install the latest Update.

[ 3 ]

Start Malwarebytes.

Click Settings. Click Protection tab & scroll down to Scan options.
( use the scroll bar at the right as needed).
Be sure *Scan within archives* is set to OFF.

On the section "Potential Threat Protection"
look down at the one "Potentially Unwanted Programs (PUPs)" look and make sure it is set to
"Always detect PUPS ".

and

look down at the one "Potential Unwanted Modifications (PUM)" look and make sure it is set to
"Always detect PUM ".

and
scroll all the way down to the section Automatic Quarantine
On the line "Automatically quarantine detected malware" be sure it is ON

 

You may click the Application tab & then look for Usage and Threat Statistics
and then Click to Off  for "Help fight malwareby providing usage and threat statistics"     ( this is a alternate way, rather than having the settings in Hosts, which the latter have  ramifications for the working of the program).


Then once all set there, click on SCAN button
Then insure Threat scan has a check mark. Then click Start scan.
Review the results list.
Then I would suggest you make sure all lines have a check mark

To that end, if you click the very top left checkbox you can force all detected lines ( if any are detected)  to be selected for removal. Be sure each line is checked.

Then you can proceed to click on the blue button Quarantine selected.

Let me know how it goes.
In Malwarebytes.
Click the Reports button ( on the left )
Look for the "Scan Report" that has the most recent Date and time.

When located, click the check box for it and click on View Report.
Then click the Export button at the bottom left.
Then select Text File (*.txt)

Put in a name for that file and remember where the file is created.

Then attach that file with your reply.
Thank you.

[Lucid_Enemy]

my first post has a log file of malware bytes scanning. it was the free version but after the infection came back I pulled the trigger and bought a home license. I am going to reinstall malware bytes now. but I feel like this is a run around I posted FRST and a malware-bytes log on the first post and then you had me run another tool that did the same thing. mean while I have had regsvr running and doing what made me post this in the first place. I really hope after this reinstall and this log you want me to post you can tell me what is actually happening and not have me run some other tool that we already have done.

[Maurice Naggar]

The FRST had not shown any Malwarebytes installed.

Further, I would never give you a run around.  Lets please have patience and follow my guidance.

I cannot possibly judge as to what is going on on this box.

I want to be sure that your pc has the latest just released version 3.8.3.2965

and complete a new scan like I suggested before.

and then send me a copy of that scan log.

Later on, we will do more.

[Lucid_Enemy]

did the above... to note I did have this scan done when I first posted... now another malware is found and heres the log for that. This doesn't address the fact that it keeps coming back. with different infections. I have attached a screen shot of what im talking about (after having quarantined the malware it detected and rebooted) I did create a dump of that process but its 80mb and the max size here is 58.29MB

again.txt

[Lucid_Enemy]

I am grateful for your service I guess I might be frustrated. Sorry.

[Maurice Naggar]

The scan report still shows for each tagged line .....   No Action By User

That is why I provided extensive notes to review all items after the scan phase & then to insure each line had a tick-mark  & then Quarantine.

Lets do this instead, for the time being.

Close all open work  ( if any) including Task Manager.  I do not need any more screen grabs , Thanks.

 

Please read all of these lines first so that it is all clear to you about our plan. I need a one time run of MBAR like listed here, please.

Please download Malwarebytes Anti-Rootkit (MBAR) from here this link
http://www.malwarebytes.org/products/mbar/
and save it to your desktop.

 

Doubleclick on the MBAR file and allow it to run.

•Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.

•mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.

•After reading the Introduction, click 'Next' if you agree.

•On the Update Database screen, click on the 'Update' button.

•Once you see 'Success: Database was successfully updated' click on 'Next', then click the Scan button.

With some infections, you may see two messages boxes:

1.'Could not load protection driver'. Click 'OK'.
2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

•If malware is found, press the Cleanup button when the scan completes. .

Please attach the log it produces, you'll find the log in that mbar folder as MBAR-log-<date and time>***.txt . Please attach that to your next reply.
 

NOTE:  There will be more to do later.   Kindly continue to have patience.

[Lucid_Enemy]

I saved the log file before hitting the quarintine button sorry. figured it would be easier for me. Either way I will run the anti rootkit in a hour after work is done. Thank you again.

[Lucid_Enemy]

it didnt find any rootkits

mbar-log-2019-06-27 (18-24-43).txt

[Maurice Naggar]

Hi,  Thanks for the MBAR log.

Please Close and save any open work files before you start this next step.  It may involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRST tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE AS and save it directly ( as is) in the Downloads folder 

The tool named FRSTENGLISH.exe  is already on the Downloads folder.

Start the Windows Explorer and then, open the Downloads folder.


Double click FRSTENGLISH  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
Click the Fix button just once, and wait.

 

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. Some machines take longer than others.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Kindly attach the Fixlog.txt with your next reply.

Cheers.

 

 

fixlist.txt

[Lucid_Enemy]

should I run FRST again?

Fixlog.txt

[Maurice Naggar]

Thanks for the Fixlog report.  That run has been completed.

I would suggest to run a new Scan with Malwarebytes for Windows.   Let me know what that result is.

Thanks,

[Lucid_Enemy]

Quote

Quote

 

 

That did come back clean and reading over a new frst run it seems to be clean. I'd say mark resolved and if anything I'll just come back. Thank you very much for your help!

[Maurice Naggar]

I am glad to know that the Malwarebytes scan is showing no malware & no P U P.

I will mark this case for closure.  If there is anything else you need at this point, let us know.

Best wishes to you.

Sincerely,

Maurice

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks