Windows 10 system files infected Help

[7devils]

Possible DLL hijack or some other form of malware. Tried windows reset from cloud but didn't help. 

I believe my wifi network is compromised since it keeps on re-appearing.

Ran farbar once.. i can share the text files

[7devils]

Also checked the farbar TXT files and read a section where it said that the antivirus closed before completion but my mcafee, malwarebytes showed completed on the tool(UI)

[7devils]

PFA logs

FRST.txt Addition.txt Shortcut.txt

[Maurice Naggar]

Hello @7devils    

    

In Malwarebytes for Windows program, we want to do a special scan.

Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.

Then click the Security tab.   

Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON        👈

Click it to get it ON  if it does not show a blue-color

.

Next, click the small x on the Settings line   to go to the main Malwarebytes Window.

 

Next click the blue button marked Scan.

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

You can actually click  ( tick )   the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).    👈

🔻

 

 

Then click on Quarantine selected.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

 

[7devils]

Says no threat detected .. but I'm sure there was/is something wrong

MBlog_01.txt

[Maurice Naggar]

Thanks for the report.     

Do a full Custom scan with Malwarebytes for Windows.

This special scan will take several hours,

Start Malwarebytes for Windows.

Now look at the middle pane "Scanner"  and only just click on a general spot or white space there.   We want to see a list of sub-options.

On the next display, look way down at bottom  & click on Advanced scanners   ( way at the bottom )

Then look in the middle at the one "Custom Scan".   there, click on "Configure Scan"

 

Once at the initial Custom scan window,  the check-box for "scan for rootkits" is clear.

One needs to click on the check box for that, so "Scan for rootkits"  is ON. 

One needs to pick  ( check-mark)  the drive letter for the drive to be scanned.   You want to be sure that you check the box for C  ....the C drive.

Then click the Scan button.   Have lots of patience.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

 

[7devils]

Nothing found here too. It took around 25 mins for the custom scan

MBlog_custom_01.txt

[Maurice Naggar]

Thank you for the scan report.   The result is re-assuring.   As to the network, I can provide a link later on on what you could consider.

The Microsoft Safety Scanner  is a free Microsoft stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Please select the " FULL "  scan option.

Let me know the result of this.

The log is named MSERT.log 

the log will be at  C:\Windows\debug\msert.log

Please attach that log with your reply.

 

[7devils]

Done

1610344474276_msert.log

[7devils]

Frist tried running it as administrator, thrower an error saying i do not have administrator group permissions. Had to run it normally.

[Maurice Naggar]

The Microsoft Safety Scanner found no virus / no malware.  We need to do a different scan with a different tool.

I would suggest a free scan with the ESET Online Scanner
Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.

When presented with the initial ESET options, click on "Computer Scan".
Next, when prompted by Windows, allow it to start by clicking Yes
When prompted for scan type, Click on Full scan

Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
Have patience.  The entire process may take an hour or more. There is an initial update download.

There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
Press Continue when all done.  You should click to off the offer for “periodic scanning”.

[7devils]

Showed nothing .. maybe you’ll find something in the logs

esetlog.txt

[Maurice Naggar]

The ESET Online scanner found no virus / no malware.

12-01-2021 02:29:44
Files scanned: 246001
Detected files: 0
Cleaned files: 0

As a next step, to checkout your system a bit more, a new scan with Sophos.

Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...
 

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View log file... (bottom left hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program
• If no threats were found please confirm that result....

The Virus Removal Tool scans the following areas of your computer:

• Memory, including system memory on 32-bit (x86) versions of Windows
• The Windows registry
• All local hard drives, fixed and removable
• Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs

[7devils]

/bump

to keep the thread alive. Didn’t get time to use my laptop. Will upload on Saturday 

[Maurice Naggar]

Hello.  Just to be clear, the topic remains open,  There is zero need or purpose to doing "bump".

[AdvancedSetup]

Hello @7devils

Following up to see if you had time to work on your system yet. Please post a status update when you get a moment.

Thank  you

 

[7devils]

Nothing found.

please check attached logs 

SophosVirusRemovalTool.log

[Maurice Naggar]

Thanks.  There is no indication of any finding of a infection.   Nothing reported as a infection.

Your PC has the McAfee LiveSafe .   Did you do a recent scan with it ?

 

[7devils]

It has been a week or 2 since my last McAfee scan

[Maurice Naggar]

Hello.   Today, please make time, and do a scan of the system with the McAfee LiveSafe .  Let me know the result.

[Maurice Naggar]

Good morning.  It's been a while since I last heard from you.  Have you made progress ?

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks