Possible malware infection

[Haohesiduh]

Hello,

Over the last few days I have noticed that applications in my PC crash, hang, or even take a few minutes to open. This has not happened before. I am not aware of any reason (CPU workload and temperature seems fine, also RAM usage is normal) so I suspect an infection. Attached are all logs requested.
Malwarebytes scan did find two detections (as you can see). I do admit to installing those keygens but I have since stopped using them for reasons of safety and morality. I have also ran AdwCleaner which found and cleaned something but I did not notice a difference in symptoms. 

Thank you in advance

AdwCleaner[C00].txt MBAM scan.txt AdwCleaner[C00].txt Addition.txt FRST.txt

[AdvancedSetup]

Hello @Haohesiduh

Please try cleaning Google Chrome

Then run the following. I'll check back on you later tonight or tomorrow.

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

Thank you

 

[Haohesiduh]

Thank you very much for your promt reply.

Done all steps you instructed. Attaching the Microsoft security scanner log.
I do remeber now having a few problems with Malwarebytes over the last few days - Mainly getting an "An error has occurred and Malwarebytes will not install on your computer" after restart and yesterday when trying to scan for the first time I got "Malwarebytes encountered an error while running a Scan". Could it be the problem itself or part of the infection? Would it be helpful to try a clean install of Malwarebytes?

msert.log

[Haohesiduh]

It might be anecdotal, but I just quitted Malwarebytes and everything seems to work well, as was just a few days ago. So maybe it's another sign to try and do a clean installation of Malwarebytes?

[AdvancedSetup]

We can do a clean removal and reinstall of Malwarebytes but best to scan with another scanner too since Microsoft found a few issues.

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

 

 

Then, if you want to do a clean reinstall of Malwarebytes

Please do the following?

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click the CLEAN button and follow the onscreen instructions to reinstall Malwarebytes
• NOTE: Please have patience as it can take a while to remove and reinstall. The computer will restart to complete

After the restart please do the following

• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[Haohesiduh]

Thank you for your support.mbst-grab-results.zip

Eset only found PUP and not malware. I did clean and reinstall Malwarebytes.

Do you see anything in Malwarebytes log that show any possible problem which might cause it to slow down the system?

eset scan.txt

[AdvancedSetup]

Please go ahead and uninstall Bonjour from the Control Panel

Temporarily stop the real-time protection from ESET Antivirus and run the following fix.

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[Haohesiduh]

Hi,

I uninstalled Bonjour, disabled ESET and ran the fixlist.

Attached is the fixlog.

If you don't find anything, in your opinion, could it be a faulty hardware (such as a faulty RAM stick)? I did run the windows memory diagnostic before I contacted you which you didn't find any problem.

I also included a screenshot of the Windows Reliability history which could possibly give you more information, and also show the problem.

Fixlog.txt

[AdvancedSetup]

Yes, I get that the computer is having issues. That shows in the logs. But, it does not appear to be due to an infection.

We've done quite a bit of cleaning with that last fixlist. Please keep an eye on the computer and see if the computer works better now or not and let me know.

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you