I thought it was only one, it might have been two, maybe more...

[Alpha2]

About a week ago (maybe more like two now) I noticed Powershell trying to pop up a window at the same exact minute every hour, followed by Avira poping up a couple of minutes later saying a website had been blocked, so I shut down Powershell. Doing google search of the website turned up nothing, so I did a scan with both Avira and Malwarebytes and found I'd caught a crypto currency miner, which I removed promptly. Later I noticed issues with a bunch of my downloaded fonts vanishing from the majority of my art applications (which may or may not just be Microsoft's issue as it seems unresolved for almost anyone that seemed to have similar issues and the solutions that worked for some didn't work for me) for this I did the usual disc utilities: no drive errors, no corruptions as far as the computer was concerned, but if I tried to just drag and drop replacement fonts into the folder it would cause every bit of text in the file manger to vanish requiring me to use a restore point. I then did SFC scannow and restore health functions, which both seemed to return no results. I downloaded FRST and ADWcleaner,  ran the cleaner first and it pulled a couple of items in folders related to the Tencent Android emulator that I THOUGHT had deleted almost a year ago (which might have just been a messy uninstall, but it seemed suspect so I got rid of them anyway,) then did a FRST scan which I was looking through myself at first but I got distracted and never tried to upload here.

Putting that aside, a day later my Streamlabs OBS started freezing up on me everytime I started it up to the point where ctrl/alt/del didnt help and I had to power cycle the computer. This was despite it working fine the previous day with no changes being done and even later going through all the refresh protocols they said should've stopped the freezing (deleting the client folder and reinstalling, drivers were up to date, and directX was reinstalled.)

The font and OBS issues might not even be related to malware of viruses, but after that crypto miner I need to make sure something else isn't exacerbating the issues let alone causing them. I did one more scan with Malwarebytes last night and it had one new result which I quarantined and another scan this morning along with FRST. before posting. Malwarebytes only seemed to have issue with a modded EXE for Need for speed 11, which I've had for more than a year and nothing seemed to be troubled by it up til now even on a previous computer. I wanted to make this post before trying to see if OBS works now in case I have to reset again.

FRST.txt Addition.txt

[AdvancedSetup]

Hello @Alpha2

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Alpha2]

mwb results.txt AdwCleaner[C01].txt AdwCleaner[S01].txt

[Alpha2]

FRST.txt Addition.txt

[Alpha2]

As stated FRST was run before but I'm not sure where you wanted me to put a checkmark,Addition.txt is included, though.

[AdvancedSetup]

FRST was run on: 22-05-2020 23:57:28
Addition was run on: 23-05-2020 00:02:27

 

OLD runs of FRST are useless and why I need them provided in the exact order provided.

Please delete FRST and ADDITION log files. RESTART the computer

Then run FRST again and make sure you place a check mark on the ADDITION and post back both NEW logs

Thank  you

 

[AdvancedSetup]

Also, please run the following. Open an elevated admin command prompt and type in exactly or better copy/paste the following code and press the Enter key. Then save the file and attach.

SCHTASKS /Query /fo table /v > 0 && notepad 0 | ECHO >NUL  & DEL 0 

Then do the same thing with this one

TASKLIST /FO table /v > 0 && notepad 0 | ECHO >NUL  & DEL 0 

Thank you

 

[Alpha2]

Sorry, I guess I held on to the original FRST log and accidentally gave you the second Addition txt. For the record Addition was checked the first time I ran it. here are both files from the scan you asked for, I'll put the cmd  logs in the next post.

FRST.txt Addition.txt

[Alpha2]

0 .txt 1 .txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Once that is done please run the following additional scanner to double-check nothing is found.

 

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

I'll check back on you either later tonight or tomorrow

 

[Alpha2]

KVRT claims to have found nothing.

Fixlog.txt

[AdvancedSetup]

Good, It would seem our fix from Recovery Environment worked. Both SFC and DISM both ran properly this time and all looks good.

How is the computer running now?
Are there any other signs of infection or other issues?

 

[Alpha2]

Aside from having to relog into all my accounts in firefox (which I kinda expected) things seem to be working fine, unfortunately so far the two issues that made me decide to check with you don't seem to have been fixed (ie, the supposedly corrupted fonts and the Streamlabs OBS freezing,) but this just mostly confirms for me that they weren't virus related.

After running KVRT, I checked the About tab in the Windows 10 settings screen and all the entries had green checks. I think I saw Windows complain that Antivirus hadn't been activated but I think it was just that MWB was a little slow to fire up on reboot. I replaced Avira with Panda Antivirus as a back up to Malwarebytes (I'd gotten a little concerned that Aveira had installed like 5 unwanted applications along with it's antivirus package) and after confirming that SL OBS still freezes, which forced me to powercycle/reboot, I noticed the "device performance and Health" check had become a gray dot. Would that be related to the fact that I'd installed Panda antivirus? or the reboot? Or maybe it was slow in picking up on my deferred windows update settings? I had intentionally stopped it since much of microsoft's forced feature patching in recent months had become almost as dangerous as viruses.

Thank you sincerly for helping me thoroughly cleanse my system. Hopefully this means there's nothing else left to distract me from focusing on trying to fix my fonts which I need for work. As for the other issue, I'm dumping Streamlabs OBS for Regular OBS studio, far less resource usage and no freezing.

 

[Alpha2]

Okay, turns out it did turn on Windows update, fortunately I remembered how to stop it in time.

[AdvancedSetup]

What is wrong with Windows Updates? The threat landscape of active exploits is much faster than it used to be and Microsoft works to patch new found exploits all the time. Using older versions of Windows makes it much easier to infect your computer.

 

[Alpha2]

At the time that I paused them, Windows updates were poorly quality inspected and causing lost data, and lost work for folks.

I was coming off Windows 7 where updating was still voluntary and the machine rand flawlessly outside of being outdated. A few days after I got this machine I kept finding it on and running for no reason even though I'd actively turned it off. It would turn it on in the middle of the night, EVERY night, and it would still be active when I woke up the next day. If it turned on in the middle of the night and I turned it off it would turn right back on as if off was not a concept it understood, at first I thought maybe it could be a virus but the thing was brand new I'd barely done anything with it. I discovered this was due to windows update. So I wasn't keen on the frequency or aggressive/sneaky way they were applied. When the updates would pop while I was actively using the machine, they "allow" me initially to hold them off for 30 days? But if the fix for one of their wonderful new bugs that I kept reading were showing up due to lousy QA testing wasn't found in that time, they'd force me to apply it regardless of what I was doing at the time with my machine? I have irregular hours, sometimes if I'm working on a project I'll use my computer for 16 hours in a stretch so "scheduling downtime" is not something I can do easily, or should frankly have to. I felt control of my machine was more important then their inconvenient demands to shut down so they could add features I didn't typically care about, so I got frustrated and hunted down a way to jam a wrench in it permanently.

Also windows update has caused me more lost productivty in the last 20 years than viruses have. That includes the time a virus destroyed every EXE on the c drive of an old laptop of mine, so forgive my being gun-shy.

[Alpha2]

To be clear I'd have no problem using the malicious software removal tools or even applying a security update if it weren't for the fact that it would instantly want to do that at THEIR convenience and not mine, the end user who paid good money for the device.

[AdvancedSetup]

You can force the update yourself. Then once done you can pause them if you like. I hear you and so do many others, and why Microsoft has made some changes. Part of the issue is that armies of compromised computers are used for criminal purposes and the users were not even aware of it. Microsoft finally took a hard stance on it with Windows 10 because too many people like you were disabling or never updating. Then their computers were getting infected from known exploits that would have prevented the infection had the user updated the computer.

I myself have lost work from forced reboots a few years ago but I've not had that issue for a couple years now. I would still highly suggest you do pick a day and go through and check for and apply the updates. Backup your personal data (one should always be doing this regardless of Windows version) and create a System Restore Point and get the updates done.

https://support.microsoft.com/en-us/help/4028685/windows-10-get-the-update

https://www.thewindowsclub.com/how-to-force-update-windows-10/

 

Have all the issue you originally came here for been resolved?

Thanks @Alpha2

[Alpha2]

I'll consider your advice in regards to the security updates and if I can install those separately I will, but I do not want their forced feature updates if they're continuing to half ass QA testing. Lost data from not backing up is one thing, but them saying "Hey we're going to close down this program now regardless of what you're doing even if you haven't had a chance to save so we can install a new theme. Oh! and have a few broken functionalities that we didn't care enough about to carefully test, for free, on us!" is another thing entirely, they haven't re-earned that trust yet... if they ever had it.

But, yes! My thanks once again for your efforts, I think everything you could have addressed has been addressed.

[AdvancedSetup]

I can only speak for myself. I did have the issues you speak of but that was a long time ago. In the past year I have not experienced any update issues or closing while I have something open. But, I am more proactive myself and manually checking and updating instead of waiting for Microsoft to auto do it.

Do like others suggest and disable it for a week or so and let others test it out. Then research it and see if any bad issues are reported. If not, then do the update.

This site does a good job on keeping up with issues. You might consider joining their newsletter (one of the few I use) https://www.askwoody.com/

 

[Alpha2]

Thanks! I'll keep an eye on this. There were a couple of Youtube accounts I was following that discussed which updates were safe and which were causing issues, but I'd fallen off after I got fed up and locked down the updates. I'll try the site and see, while trying to find a solution for the font problem is briefly considered trying an update but many of the complaints I'm finding about the font issue comes from people who claim they experienced it after an update and my computer can't update so how did it happen if it wasn't a viral issue? And if the updates have caused the problem for other people It's probably not a solution either, but I'll consider an update once I figure this font issue out.

[AdvancedSetup]

I only recall one font issue for Windows 10 and that was with KB4489868 I believe.

Not exactly sure what issue you're having with fonts but here is at least one web page about it

https://windowsreport.com/font-bugs-windows-10/

 

[Alpha2]

Thanks again for this one.

I currently have like 3 tabs open about the issue, a couple of times I've read about a foreign languages problem ,but I don't think it's that because I've never had issues with non English fonts in browser windows and that's usually referred to as a post update issue. I keep seeing one suggestion to "install fonts for all users" which might be an option that became available on a later update of win10 since I don't see it, or it might be because I'm the only user on the machine, so I don't feel like that's applicable. I've tried copying some of the fonts from my Win7 machine, but that results in file manager text freaking out and completely going missing.

The last 3 solutions on the page all equally sound like they might work: Registry edit, FontReg application, and/or clearing the font cache, this last one is the more common one that comes up and sounds like a possibility. I'll try setting a restore point before diving into any of these.

[AdvancedSetup]

Okay then. Best of luck and I hope you get your font issue resolved.

As the malware threat, issue has been resolved I will go ahead and close  your topic now. Take care and stay safe out there and have great week.

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you