Another "system_init.bat"

[Edu4rd0]

Good morning!
This day when I turned on the pc I got a message from the UAC asking permission to run the file "System_ini.bat", I answered cautiously NO and the message was repeated.

My case is practically the same as:
https://forums.malwarebytes.com/topic/276910-system_initbat/

So I have followed the indications of that thread and I send my logs (Malwarebytes Report, adwcleaner Report and Farbar Recovery Scan Tool's reports).

I am very grateful for your attention and time. Thank you!

PS: After quarantining the infections detected by Malwarebytes (which required restarting the PC) the UAC message asking permission to run "System_ini.bat" no longer appears.

AdwCleaner[S00].txt MalwarebytesReport.txt Addition.txt FRST.txt Shortcut.txt

[Maurice Naggar]

Hello @Edu4rd0    

My name is Maurice.  Let me know what nickname you prefer to go by.

[   1   ]

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

 

[  2   ]

I would suggest a free scan with the ESET Online Scanner.  This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.

 

• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

• When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

Press Continue when all done. You should click to off the offer for “periodic scanning”.

Please make sure you attach the log report.

[Edu4rd0]

Hi Maurice, thanks for your time and help, you can call me Eduardo.

I followed your indications and I attach the Eset log.

Eset.txt

[Maurice Naggar]

Hello Eduardo.   Thank you for the ESET online scanner report.

NOTE:  The tool FRST64 is on the folder  D:\Descargas\Virus

We will be using FRST64 to do a custom script run.

There is more cleanup work to be done here.  Please do not be using other apps or web browsers during these next procedures. Only use web browser for purpose to get to this forum.

[    1    ]

As a next basic step, Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[    2    ]

We will use FRSTE64.exe  on  D:\Descargas\Virus    folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Edu4rdo  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.

One major goal is to remove  a file  system_init.txt   from the Desktop.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will run the Windows DISM tool to check system.  It will rebuild the Winsock.  

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

Passwords that were saved already will not be affected.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the  D:\Descargas\Virus   folder   

Fixlist.txt

Start the Windows Explorer and then, to the  D:\Descargas\Virus     folder.

RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it do its thing.    We will do more after this.  Persistence & patience are called for here.

Cheers.

[Edu4rd0]

Ok Maurice, done.

Thank you.

Fixlog.txt

[Maurice Naggar]

Hello.   Thank you.
The Windows System File Checker reports making some corrections. Windows Resource Protection found corrupted files and successfully repaired them.

Tell me, How is the situation at this point ?

[Edu4rd0]

Maurice,

I have not noticed any strange behavior, the UAC message asking for permission to run "System_ini.bat" no longer appears, I have done some checks on my own and everything seems to be Ok. So I come to the conclusion that my system is virus free.

Thank you very much for your help and your time Maurice!

[Maurice Naggar]

Hi.    

You are very welcome. I am glad to have worked with you.

You can proceed with cleanup of tools  used.

To remove the FRST64 tool & its work files, do this. Go to your D:\Descargas\Virus folder. Do a RIGHT-click on FRST64.exe & select RENAME & then change it to UNINSTALL.exe.
Then run that ( double click on it) to begin the cleanup process.

I wish you all the best. Stay safe.

Sincerely.

Maurice      

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you