I think my computer is infected deep

[tabeutoi]

Hi, I just bought a brand new computer with 2 TB SSD, RTX 2060, RYZEN 7, 16 go RAM, overall very great computer, I bought it used but in good condition.

 

However, connection is very slow, when I try to make a search on google chrome, it takes 5 seconds to launch the search and 5 secs to finish loading a simple google search page, so I think it's infected.

 

Also, I've already made a windows 10 full reset and started from zero, I don't know how to fix this.

 

Thank you in advance for any help.

[Maurice Naggar]

Hello  

My name is Maurice. I will guide you.

In order to begin to help you properly, I will need a diagnostic report in order to review & diagnose.
Specifically the FRST Farbar diagnostic report.  It is safe to get & use.
https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Attach FRST.txt + Addition.txt with your reply.  You may if you wish, ZIP the 2 into a zip file & then attach.
{ just please do not copy, paste their contents in main body of reply box here.)
 

[tabeutoi]

Hi, thank you very much for your guidance 🙏

 

Attached are the filesfiles.zip you requested me.

[Maurice Naggar]

Hello @tabeutoi

I do not see malware on the FRST reports. If later on there is a issue with Chrome, then please use the EDGE browser.

Next, a custom script to do some checks & some attempted cleanups.

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Tabeutoi  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .    It will rebuild the Winsock.  It will queue up a run of CHKDSK at the next reboot to check disk integrity.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   user Downloads  folder

 

Fixlist.txt

 

Then, Start the Windows Explorer and then, go  to the Downloads  folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

Edited January 6, 2022 by AdvancedSetup
Corrected font issue

[tabeutoi]

Hi, attached the FIXLOG.txt

 

It took 10 sec to open this simple txt file, with a pretty strong computer. I don't understand why it is so slow..

[tabeutoi]

Fixlog.txt

[Maurice Naggar]

Thank you for the log report. Let us please get 2 other diagnostic reports.

Kindly also run this diagnostic report.  It may just be that your system is missing a important key Windows service entry.

This next is just a report to check on some Windows services  

Download   Farbar's Service Scanner utility

and Save to your Desktop.

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked:

• Internet Services
  Windows Firewall
  System Restore
  Security Center/Action Center
  Windows Update
  Windows Defender
  Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file. 

[   2    ]

I would recommend getting a readout report as to update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

 

• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[tabeutoi]

FSS.txtSecurityCheck.txt

[Maurice Naggar]

Thank you.  Please rake appropriate action about this app

-------------------------- [ IMAndCollaborate ] ---------------------------
Microsoft Teams v.1.4.00.22976    Warning! Download Update

>

Then,  I would suggest that you do this next scan. This is a known respected tool. It will scan for viruses as well as for potentially unwanted applications.   ( P U A  or  P U P ).

I would suggest a free scan with the ESET Online Scanner.  This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

• When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

Press Continue when all done. You should click to off the offer for “periodic scanning”.

Please make sure you attach the log report.     

[tabeutoi]

scan log.txt

[Maurice Naggar]

It found & removed 1 file

DriverPack-17-Online_undefined__quc515da9vgl08m.exe    Win32/DriverPack.B potentially unwanted application,a variant of Win32/Yandex.K potentially unwanted application  

Be very aware that "so-called" driver getter / updaters are mostly of questionable nature. Be very careful where you get stuff. If you have any other similar "app" please consider to uninstall it. We here on this forum mainly suggest Patchmypc as one good source.

Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

Hardware drivers generally you should only get from the hardware manufacturer support site. Similar same principle for application programs.

>

Which type of scan did you pick ?  A 36 minute runtime is fairly very fast.  Did you only pick a "quick scan" ?

And, how is the system at this point?

[Maurice Naggar]

One additional suggestion  ( highly suggested).  

One other action:  Malwarebytes for Windows  can detect and remove most malware with no further actions required for free.
Since it does not appear that this machine has it, go and install Malwarebytes for Windows.
See https://support.malwarebytes.com/hc/en-us/articles/360038479134-Download-and-install-Malwarebytes-for-Windows

After the setup has completed, run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[tabeutoi]

hi, I clicked on "full scan".

The computer is still anormally loading for petty browsing activities despite an nvidia RTX 2060, a high end processor and large amount of RAM (I also tried with another low end laptop computer and browsing is way better.. so it's not the network but really the computer). 

I have thought of installing a fresh windows iso from a usb key (Since I've just bought the PC 2 days ago, I don't have anything on it to keep), but could it be that the PC is infected deeper like in the BIOS or something ?

Thank youscan report.txt

[tabeutoi]

Ok, i think I am gonna install a fresh W11 on my computer,  so If I do not answer it means that worked, or that somthing went bad during the reset

[Maurice Naggar]

The Malwarebytes for Windows scan found a fairly large amount of adwares and P U P.  Most of them on Chrome browser.  I would suggest to use the EDGE browser instead of Chrome. or else, instead of Chrome, installing the BRAVE browser.

if you decide to reinstall Windows,  follow the advice from Greg Carmack:   same principles apply to Windows 11 as 10

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

 

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you