Jump to content

PC Hijacked


Recommended Posts

Hello,

Cleaned and updated system is freezing at least once per session.

Files, websites, and games have all been appearing, disapearing, and edited maliciously.

lastactivityview logs showed that my PC was booted up from a complete shutdown after I went to sleep.

(the computer was stored securely in a locked room with me while I was sleeping.)

Stable and trusted Firefox add-ons have been breaking regularly, freezes, etc.


Please and thank you

WalwareBytesReport.txt Addition.txt FRST.txt

Edited by AdvancedSetup
Corrected font issue
Link to post
Share on other sites

  • Root Admin

Well, no matter how much you think Firefox is okay, it's obviously not okay.

 

Application errors:
==================
Error: (05/28/2022 01:20:40 PM) (Source: Firefox Default Browser Agent) (EventID: 12007) (User: )
Description: Event-ID 12007

Error: (05/28/2022 01:20:40 PM) (Source: Firefox Default Browser Agent) (EventID: 0) (User: )
Description: Event-ID 0

 

System errors:
=============
Error: (05/28/2022 01:18:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Remote Access Connection Manager service depends on the DNS Client service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

 

 

Date: 2022-05-28 13:29:20
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.367.567.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.19200.6
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

 

 

Maybe your settings for Simplewall are messed up?

https://www.henrypp.org/product/simplewall

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites

Alright, I'm working with the latest stable release of Firefox offered online and it should be as clean of an install as I can manage.

Simplewall catches most everything but I'll try to give permissions in time to core services like Windows Defender scans when I choose to run one of those tasks. 

I'm using Simplewall as a last line of defense blocker between my system and the internet after the Windows firewall.

It's likely it resulted in some errors when a service couldn't access my network connection.

Windows O&O Shutup10++ keeps my system quiet so I'm not constantly bombarded with Simplewall network access requests.

With SW I was trying to catch anything out of the ordinary that would indicate a point of failure or access for the bad guys but then I started thinking it might be a DNS exfiltration problem just couldn't find anything showing this to be the case.  Though there are a few DNS servers in the logs that aren't 1.1.1.1 and OpenVPN's choice of.. what is it? 8.8.8.8 I believe.

Here is the completed updated Fixlog.txt with the results of the fix-

Thank you for your help this far

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

Overall the log looks good. Please run the following for me.

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
  • The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

Thank you

 

Link to post
Share on other sites

If nothing looks to be wrong but I am still having issues what steps can be taken to remove a boot-sector or bios virus?

(The two nastiest and somewhat least likely culprits)

I have tried most of these steps in some form or fashion previously and still suffer from the same issues.

Link to post
Share on other sites

Is it me or did you just get a typo without editing your post?


Over at the Techspot forum I'm running into similar issues where admins who have had impeccable
records of both grammar and form are posting sloppy replies and breaking form from the help they've offered literally hundreds of times.

So far none of the malware removal forums have been able to turn up anything on this.

I'm starting to figure it's a bad piece of underlying software; bios, boot loader, or some-such.

While those tailored exploits are uncommon I've run out of options other than maybe a DNS exfiltration type of situation.  DNSLookupView doesn't make anything immediately apparent but it could be likely with all the disinformation and recycled content I'm getting from otherwise reputable sites.

 

Link to post
Share on other sites

  • Root Admin

No, it was just a typo on my part. Did not use a canned message. I do hundreds of posts and logs every week and I'm up till the wee hours of the morning. I don't catch every typo or grammar error made, sorry.

Visit Dell Support and check if there is a new BIOS/UEFI update or not.

 

Do a CLEAN install of Windows 10

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

 

Do a Factory Reset on your Router if you own it

 

Please ensure that you have the user manual for your router. Then perform a factory reset.

How To Reset Your Router
https://setuprouter.com/networking/how-to-reset-your-router/

 

Depending on one's preferences and the Router's capabilities please consider the following.

  • Disable acceptance of ICMP Pings
  • Change the Default Router password using a Strong Password
  • Use a Strong WiFi password on WPA2  using AES encryption or Enable WPA3 if it is an option.
  • Disable Remote Management
  • Create separate WiFi networks for groups of devices with similar purposes to prevent an entire network of devices from being compromised if a malicious actor is able to gain unauthorized access to one device or network. Example: Keep IoT devices on one network and mobile devices on another.
  • Change the network name (SSID).  Do not use your; Name, Postal address, or other personal information.  Make it unique or whimsical and known to your family/group.
  • Is the Router Firmware up-to-date?  Updating the firmware mitigates exploitable vulnerabilities.
  • Specifically set Firewall rules to BLOCK;   TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555
  • Document passwords created and store them in a safe but accessible location.

 

I am not aware of any infection that can affect the BIOS/UEFI that is not corrected by updating UEFI with a factory firmware image.

All other infections can be found but sometimes take time, but none of them produce the effects you say you're having. So, a CLEAN install of Windows and a Factory reset of the router along with a BIOS/UEFI firmware update would remove anything known to infect a computer.

 

Link to post
Share on other sites

Thank you for the advice.

I do check to make sure I have updated to the most recent BIOS offered by Dell.  I'd just checked to make sure everything was most recent before seeking help from the forum.

The idea I'm working with would seemingly involve zero trust from my network, even with using my school's private wi-fi and a well known VPN service.

Trying to find out where Dell offers installation media CDs.

I've done these steps before in the past after reaching this point.

No matter how many times I try a clean install of Windows 10 these problems presist.  Though it is good to know how to do properly.

Thank you for your help

Link to post
Share on other sites

  • Root Admin

Well, I'm sorry but at this point, I don't have any further advice. I've been doing computer support for 30 years and all I can say is that the above steps would fix any issue.

Now, if you're saying you get an infection after a period of time then that's probably just not following good safe computing practices, which one can certainly improve upon.

 

Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.