Reason to suspect malware

[funinthesun]

I might have gotten infected from an email I received that looked fishy but curiosity got to me and I clicked it and noticed it was some type of scam email and right after I noticed these issues starting to happen which involve bad fps and also slow browser and internet and at times my system feels sluggish. 

Addition.txt FRST.txt malwarebytes log.txt

[AdvancedSetup]

Hello @funinthesun

I don't see an obvious infection, but let's try another scanner

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[funinthesun]

umm I did the instructions as followed and it seems to close after seconds of opening it? 

[AdvancedSetup]

Okay, let's try another scanner then @funinthesun

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

 

[funinthesun]

Im back and I have some maybe bad or good news  just recently noticed edge and google use so much disk space and high power usage when I am using them first minute or so after I open so could that mean the browsers are corrupted? I'm currently downloading the tool ill get back to you when im finished.

[AdvancedSetup]

Please see the following topic on how to clean Google Chrome. We don't have the same one for Microsoft Edge, but the same idea as they both use the Chromium

 

[funinthesun]

Scan finished it was actually kind of fast like 20-24 minutes or so. The file doesn't say log just msert in all lowercase hope I didn't do something wrong probably not because I followed step by step but anyways here is the log.

msert.log

[AdvancedSetup]

Okay, that's good. It did not find an infection. I would restart the computer and then try running the ESET scanner again.

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[funinthesun]

Still cant run it just turns off. could I fix this because I already checked some post I seen on google and it says to disable realtime protection but it still doesnt work. What could be causing this?

[AdvancedSetup]

Please run the following fix @funinthesun

 

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[funinthesun]

Hello sorry for the late response I will run that fixlist right now but I was wondering if you could check these out. I was checking out my network and found some connections that dont sit right with me like connections  to CryptSvc Cryptographic Services from the little research I did this service does things like add and remove Trusted Root Certification Authority certificates. Wouldn't that make it connect to windows servers instead of these. This is an example of one of the ips. 

VirusTotal - URL - 779d9f2c912c317da346e891777bf556b1480f295f75d1917e74eba8acb4b854 This is a scan of the domain the ip is connected to.

WHOIS 2001:1900:230f:e00::1fe | Level 3 Communications Inc. | AbuseIPDB this is the ip itself.

WHOIS 2606:4700:4400::6812:2044 | CloudFlare Inc. | AbuseIPDB this is another one the dns record has some bad ratings. 

Hope im not overdoing it because yesterday at night I seen a video that popped up on my youtube recommended and its this guy saying how bad a virus can actually be and how deep they could infect and he did a little tutorial with wireshark and then said you can look at current connections with a cmd command and to turn any program running off and if you see connections it could be bad since programs are off like goole etc and I checked for myself and the thought of what he said had me paranoid and all night no sleep I stayed up to look over the ips with the netstat command and im not sure if what he said was actually real helpful advice so I wanna ask should I be worried about what the guy said or was he exaggerating.

[AdvancedSetup]

I'd need to see them in actual use on your system via logs.

Please run the fix and we'll move along normally to a conclusion

Thanks

 

[funinthesun]

fixlist went well here is the log for it.

Fixlog.txt

[AdvancedSetup]

I think you should be okay at this point, but let me have you run another Malwarebytes scan and post that log.

Then run the following Kaspersky scan

 

 

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 

Select the     Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed...   Thank you

 

 

[funinthesun]

When I click it it does nothing and when I try to download it from microsfot edge it gives me a security error saying its is not safe and I cant seem to find a way to allow it is this the same tool 

Free Virus Removal Tool | Free Virus Scanner and Cleaner | Kaspersky

[funinthesun]

here is the malwarebytes log 

malwarebytes log2.txt

[AdvancedSetup]

This is the DIRECT download link. There is no webpage to guess where to download etc. If you have to use another browser or download it from another computer and save it to a USB thumb drive.

http://devbuilds.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

Turn off Smart Screen, look at the options, MS Edge will let you download it if you click the down arrows and options.

 

[funinthesun]

I'm back and I just noticed it's because the direct download is http I think but I clicked the three dots and it's letting me keep it now, also so much happened while the last time I posted I downloaded the a fake version of roblox which is a game but I was able to catch to notice it because I always check the properties of games because they make fake versions of games sometimes and noticed it wasn't the actual roblox so I deleted it but anyways logs are coming right up.

[funinthesun]

All done scan went well beside some random screen flickers.

report.txt

[AdvancedSetup]

Great, glad to see nothing found.

How is the computer running now?

Are there still any signs of an infection or other issues I can assist you with?

 

[funinthesun]

so fps is pretty good now only one game is a little wobbly with fps which is fortnite but the rest of the games are fine and new thing that came up is the system process is acting a little weird it goes up allot on disk usage randomly at certain times even when idle but that's probably a win 11 issue. Other than that its pretty fine. 

[AdvancedSetup]

If you really truly want to fix it I'd suggest you back up all your personal data. Then do a CLEAN install of Windows 11 to include removing ALL current partitions.

How to make clean install of Windows 11
https://answers.microsoft.com/en-us/windows/forum/all/how-to-make-clean-install-of-windows-11/789f6891-7261-4c40-a632-6a44e53a3e30
 

[funinthesun]

Yea I was thinking about that too but as my last resort thanks for helping me make sure my system was clean of viruses. Ill see if the computer keeps on bugging tomorrow if so ill have to go to target to get 2 usbs to back up my stuff and for the iso file and can you maybe leave this post open in case I have any problems that might arise during or after the installation? Also does Malwarebytes still have that tool that can protect apps from being exploited because I purchased this game on steam with a know exploit but I heard that theirs these tools that you could use to add them to the tool to stop the exploits from happening because the game I want to play has a rce/rat exploit that hasn't been patched and probably never will get patched since its a old game and I know that sounds like trouble waiting to happen but the thing is I'm not going to play with others that could possibly use this exploit against me I'm only playing it for the story mode but I now one day I might load into a game with people on accident and ill probably get hacked worst case scenario.

[AdvancedSetup]

Malwarebytes does run an Anti-Exploit module. It is not meant though as a replacement for coding mistakes. One should check as often times games have patch updates too.

No, problem. Will leave the topic open for now.

Cheers

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please attach that file to your next reply. (not compulsory)

 

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes

 

[funinthesun]

Is it mandatory to run because I kind of feel like keeping the kvrt tool incase of a infection that gets passed Malwarebytes but if it is ill run the tool right now.