Jump to content

Recommended Posts

I believe we have at least one virus which is causing very high cpu use similar to a coin mining virus which engages whenever the computer is idle for a few minutes. I believe the culprit is shown in the screen shot attached (which is from a ccleaner registery cleaner action report). I believe it may also be embedded in my windows 10 photo app because the Photos app process also shows as running  at the same time with a corresponding runtime broker with extremely high cpu use (even though I am not using the photo app.  Ccleaner deletes problem from registery but it comes right back, and Malwarebytes does not detect anything with scan. Thanks for your help.

Screenshot (259).png

Link to post
Share on other sites
14 minutes ago, mostexcellentdesigns said:

I believe we have at least one virus

I have asked for your post to be moved to the correct section for one on one assistance.

In the meantime please follow the following instructions. Please have patience as the malware removal section is quite busy.

  Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
Link to post
Share on other sites
Hello mostexcellentdesigns and welcome to malwarebytes....

Continue with the following:

Open Malwarebytes, select > "settings" > "security tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Single click on the target sight above scanner window.
  • In the new window select Report
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Export to Txt" then attach the log to your reply...


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin....
Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Hello mostexcellentdesigns,

I also need the secondary log from FRST "addition.txt" Logs are saved here: C:\FRST\Logs

AdwCleaner logs are saved here: C:\AdwCleaner\Logs

Thank you,

Kevin...

Link to post
Share on other sites

Hiya mostexcellentdesigns,

Thanks for those logs, do not see anything related to wwifomak.dll as shown in your thread opening information image... Continue:

Run FRST one more time:

Type the following in the edit box after "Search:".

wwifomak.dll

Click Search Registry button and post the log it makes (SearchReg.txt) to your reply.

Next,

Upload a File to Virustotal

Go to http://www.virustotal.com/
 
  • Click the Choose file button
  • Navigate to the file C:\WINDOWS\system32\agentactivationruntimestarter.exe
  • Click the Scan it tab
  • If you get a message saying File has already been analyzed: click Reanalyze file now
  • Copy and paste the URL address back here please.

Thank you,

Kevin

 

Link to post
Share on other sites

After you open VirusTotal (website) select File from the three options File - URL - Search then select Choose File

Explorer will then open, navigate to and select the file inquestion, the file will be scanned. On completion copy the URL from the address bar and copy to your reply..

Link to post
Share on other sites

Still having the same problem. Every I step away from computer for more than 5 minutes it starts racing with very high cpu usage and Windows Photo app along with a Runtime broker correspondingly appear in task manager even though they are not in use. That's why I think it may be related to the Photos app.

Link to post
Share on other sites

Thanks for the update, run the following AV scan see what the log shows..

 
Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...
 
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
  • If no threats were found please confirm that result....



The Virus Removal Tool scans the following areas of your computer:
  • Memory, including system memory on 32-bit (x86) versions of Windows
  • The Windows registry
  • All local hard drives, fixed and removable
  • Mapped network drives are not scanned.



Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.
 

Thanks,

Kevin

Link to post
Share on other sites

Try with ESET scanner...

Download ESET Online Scanner and save it to your desktop.
  • Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
  • When the tool opens, click Get Started.
  • Read and accept the license agreement.
  • At the Welcome to ESET Online Scanner window, click Get Started.
  • Select whether you would like to send anonymous data to ESET.
  • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
  • Click on the Full Scan option.
  • Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
  • ESET will now begin scanning your computer. This may take some time.
  • When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
  • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
  • On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
  • Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.
Link to post
Share on other sites

Hi Kevin. Unfortunately, I'm having the same issue as shown in the attached screen shot of task manager. Whenever the computer is idle for about 5 minutes, the Photos app comes on with a corresponding Runtime Broker causing a very high cpu usage and which slows my computer dramatically.1850154780_Screenshot(276).thumb.png.ba6f76d9bb6c3a353bd8d8385215730b.png1009143014_Screenshot(275).thumb.png.cc184e439bd0324277dd03b0e9970202.png

Link to post
Share on other sites

Thanks for the update and images, continue:

 
user posted imageScan with Autoruns

Please download Sysinternals Autoruns from the following link: https://live.sysinternals.com/autoruns.exe save it to your desktop.

Note: If using Windows Vista, Windows 7, Windows 8/8.1 or Windows 10 then you also need to do the following:
 
  • Right-click on Autoruns.exe and select Properties
  • Click on the Compatibility tab
  • Under Privilege Level check the box next to Run this program as an administrator
  • Click on Apply then click OK
     
  • Double-click Autoruns.exe to run it.
  • Once it starts, please press the Esc key on your keyboard.
  • Now that scanning is stopped, click on the Options button at the top of the program and verify that the following are checked, if they are unchecked, check them:

    Hide empty locations
    Hide Windows entries

     
  • Click on the Options button at the top of the program and select Scan Options... then in the Autoruns Scan Options dialog enable/check the following two options:

    Verify code signatures
    Check VirusTotal.com

     
  • Once that's done click the Rescan button at the bottom of the Autoruns Scan Options dialog and this will start the scan again, this time let it finish.
  • When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the file to your desktop and close Autoruns.
  • Right click on the file on your desktop that you just saved and hover your mouse over Send To and select Compressed (zipped) Folder
  • Attach the ZIP folder you just created to your next reply

Thanks,

Kevin..

Link to post
Share on other sites

Hiya mostexcellentdesigns,

Thanks for that information, try the following:

Select start > right click on "Photos" from the list select "More" from the new window select "App Settings" from the new window scroll to and select "Repair"

When complete reboot your PC, see if that fixes the problem... if not go over the same instruction again, this time select "Reset"

When complete reboot again and see if the issue is fixed...

Thanks,

Kevin..

photo 1.JPG

photo 2.JPG

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.