Strange & Suspicious EventViewer logs, are these indicating malware?

[Bananapies]

Hi, I have been getting a lot of stronger RDP (Remote Desktop) eventlogs, aswell as very strange logs that say that 500+ files have been deleted from SVCHost? They dont make sense to me and google searching keywords / the whole log shows nothing up so I'm a little bit worried.

Here are the logs:

 

"Event ID 7028: 

Spoiler

 

Removed Microsoft.AAD.BrokerPlugin_1000.19041.423.0_neutral_neutral_cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.Windows.CallingShellApp_1000.19041.423.0_neutral_neutral_cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.Windows.StartMenuExperienceHost_10.0.19041.610_neutral_neutral_cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.MicrosoftEdgeDevToolsClient_1000.19041.423.0_neutral_neutral_8wekyb3d8bbwe package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.BioEnrollment_10.0.19041.423_neutral__cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.Windows.Apprep.ChxApp_1000.19041.423.0_neutral_neutral_cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.AsyncTextService_10.0.19041.423_neutral__8wekyb3d8bbwe package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

Removed Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.423_neutral__cw5n1h2txyewy package from HKEY_CURRENT_USER_LOCAL_SETTINGS families key because it is no longer referenced in the state repository.

 

 

"Capability change" "HttpProbeSecceeded???"

Spoiler

 

"Capability change on {ab3d3016-5256-44e9-995f-9b414aa9f882} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)"

 

Thousands of files being deleted, I do not know what files are being deleted NOR do I know why, or why it labels "Process name" as random processes, such as SVCHost, EpicGamesLauncher, MalwareBytes, chrome, ect. The file deletions are compeltely random and I have no idea how to track what is being delete or WHY:
 

Spoiler

"In the past 3603 seconds 921 files were deleted.  921 of the deletions record their process name.

           Volume Id: {ade30f12-7a87-4524-bf8c-0b2cc06d52d5}
           Volume name: C:
           Is boot volume: true

           Process name: svchost.exe
           Delete file count: 22



In the past 3603 seconds 921 files were deleted.  921 of the deletions record their process name.

           Volume Id: {ade30f12-7a87-4524-bf8c-0b2cc06d52d5}
           Volume name: C:
           Is boot volume: true

           Process name: chrome.exe
           Delete file count: 844

In the past 3601 seconds 8956 files were deleted.  8956 of the deletions record their process name.

           Volume Id: {ade30f12-7a87-4524-bf8c-0b2cc06d52d5}
           Volume name: C:
           Is boot volume: true

           Process name: svchost.exe
           Delete file count: 27"

 

"Microsoft-Windows-WinRM/Operational WSMan operation Enumeration failed, error code 2150858770"

 

I disabled TCP & UDP ports 139, 445, 3389, 443, 449 in Windows Firewall by adding Inbounding rules, because I'm afraid someone is trying to remote access my computer now at this point, I do not know what to do. I have already system restored twice and I still get these suspicious EventViewer logs, so my paranoia is increasing slightly.

 

Are these logs weird, or normal system errors? I have more logs that are worrysum as well, I will dig them up when I find them again.

Please get back to this post, I'm super stressed about these endless logs and cant find any relief on the internet because there is nothing on these types of EventViewer errors.

 

Thank you for taking the time to check this out. It really does mean a lot.

[Bananapies]

I have been getting alot of STRANGE* event logs, sorry for typos.

[AdvancedSetup]

Hello @Bananapies

It certainly seems odd in that I've never seen anyone report this type of Event Log issue before. Let's go ahead and scan the system with a few scanners and see what we can find.

Do you own your own Router? Have you done a factory reset on the router?

How To Reset Your Router
https://setuprouter.com/networking/how-to-reset-your-router/

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[Bananapies]

Thank you for getting back to me

I have to go to work, but I will be home in 8 hours from this posting.

I will follow these directions when I get home, expect a reply later today. Thanks again! 

[AdvancedSetup]

Sounds good. Go ahead and post back the logs when ready.

Have a good day @Bananapies

 

[Bananapies]

So I got home today and my computer booted up normally, granted a little faster than usual but thats surely anecdotal.

Anyways, upon signing into my PC, the first thing I did was open Task Manager, then proceeded to locate and open MalwareBytes, which did not work. Malwarebytes was not able to open. This was all within 10 seconds mind you.

At this point, with malwarebytes not opening, I tried to open Google, which wouldn't load as well, seconds later, my mouse gave a constant blue loading circle, then suddenly my entire screen went black with only the previously opened Task manager being left in the background, which I could still control, until the entire computer froze and I could not do anything.

 

So, I decided I would boot into Safe Mode and try to run MalwareBytes to see if I could catch any possible malware that was affecting my PC this heavily. Booted into Safemode without networking without any issues, went straight to MalwareBytes, and it gave me an error saying "Cannot connect to update service" or something along those lines, then closed. 

Since malwarebytes wouldnt open, I decided to try to scan with GMER since I had that downloaded.

I pressed start, and after it began scanning, my computer randomly bluescreened and shutoff.

I booted into Normal mode after that, and began writing this. Here I am now. 

 

[Bananapies]

I followed your instruction on factory resetting my router, this has been completed without issue. 

I am now going to continue onto your next given steps, I will report back to you with the logs you desire shortly.

[Bananapies]

Here are the logs.

Malwarebytes turned up clean, however Adwcleaner found 11 items of interest.

 

 

FRST.txt Addition.txt MalwareBytes scan.txt AdwCleaner.txt

[AdvancedSetup]

What is this software for? This appears to be a Mac computer software program?

Combo Cleaner - RCS LT

 

The computer appears to be failing Microsoft Licensing and looks to be running a tool from Microsoft that attempts to analyze and collect data trying to keep Windows running well.

https://support.microsoft.com/en-us/windows/fix-windows-10-activation-error-0x803f7001-4238206e-da53-a416-07f5-d1a956aba678

Did you recently install Windows 10? It shows an install date of 2021-05-21 but that may have been when this last update was installed.

Do you have license for Windows 10? If so it might be a good idea at this point to just do a fresh clean install from scratch.

 

 

 

[AdvancedSetup]

If you do want to do a clean install here are some links to help assist in doing so.

 

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

 

 

 

How to set up Windows 10 with a local account
https://www.windowscentral.com/how-set-windows-10-local-account

How to Clean Install Windows 10
https://www.tenforums.com/tutorials/1950-clean-install-windows-10-a.html

How to do a Clean Install of Windows 10 the Easy Way
https://www.howtogeek.com/224342/how-to-clean-install-windows-10/

How to do a clean installation of Windows 10
https://www.windowscentral.com/how-do-clean-installation-windows-10

How to install Windows 10 from DVD, USB, or ISO file
https://www.digitalcitizen.life/how-install-windows-10/

How to Custom Install Windows 10
https://www.tenforums.com/tutorials/120352-custom-install-windows-10-a.html

[Bananapies]

I already reinstalled windows thats why the date says that, and im still getting these weird logs and random bluescreens

[AdvancedSetup]

Well, the logs don't look completely right for a clean install.

Please use a USB installation disk and remove the partitions as shown. Follow the directions below from Greg. Do not install any other software except Windows. Then when ready post back and let me know and I'll take another look.

 

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you