Trouble completing scan and removing viruses !

[Lexony34]

Hello everybody👋,

First of all, here are the specs of my laptop if it can help solve my problem:

• 💻HP laptop intel core i3 10th (1005G1) - 500Gb Nvme SSD - 8Gb DDR4 Ram - Win10

I have a problem with my laptop for 5 days, it heats intensely and has become a little slower than usual when I perform light tasks. The first instinct I had was to open Task Manager to see what was consuming so many resources on the laptop. And i saw this... "Capture02".

I did research and tried everything I found but without success. I first tried Reset the laptop through windows in the recovery settings and after the validation process it displays this... "Capture0"

Then by continuing the search for solutions I found  -Malwarebytes Premium (Trial)-,   I downloaded it then installed And Launched The first analysis of the laptop... But several minutes later, it's as if it was blocked and loaded indefinitely, without ever finishing the analysis... "Capture01 ; Capture03" 

So I canceled it, then restarted it again; it found pup viruses but Freeze and does not complete the scan. I tried to interrupt him to quarantine them but he couldn't. "Capture04; Capture05" The only solution left to me is to reinstall windows Properly from a bootable usb losing all my data, because I also tried to reinstall windows through the setup but failed. I really hope that you can help me solve my problem without losing all my data if possible.

Thanks in advance🙏.

 

 

[1PW]

Hello @Lexony34 and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent.

Thank you.

[Lexony34]

Good morning 1PW,

I followed advice and execute your recommendations; here is the diagnostic file. Although having succeeded, during the log collection, the laptop disconnected itself from the wifi then it reconnected again without my action, Which stopped the analysis.   But luckily by trying again, he was able to finish. I used drag and drop.

Thank you.

 

mbst-grab-results.zip

[Maurice Naggar]

Hello  @Lexony34

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

If possibly you have a browser issue, can you try using a different web browser?
But in any event, always SAVE the downloads I guide you to. Then after download is complete, you go to the file using File Explorer.
and only then, launch it from there.

Let's do one special run  with Malwarebytes Adwcleaner. 

 

It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button.

 

First download & save it

guide & download link

 

Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. There are a few first choices to set as I have listed below.

 

Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.

 

When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window

by clicking their button to the far-right for ON status

Delete IFEO keys
Delete tracing keys
Delete Prefetch files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock
Reset HOSTS file

 

 

 

ONLY after you have set the selections above ....only after that .....

Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

 

 

This can take several minutes.

When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.

 

AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.

Click on the “Continue” button to finish the removal process.

 

 

Guide article

 

Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt

There is much more to do even after this.

[Maurice Naggar]

NOTE: Keep the main focus on my preceding reply above. I see from your reports, that there is this application that is listed as installed. What do you know about this ? 

Windows Manager (HKLM-x32\...\{C845414C-903C-4218-9DE7-132AB97FDF62}) (Version: 1.0.0 - AW Manager)

 

[Lexony34]

Good morning Maurice Naggar,

Thank you for answering me so quickly;

I followed all the steps contained in your previous answer. First concerning the "Windows Manager" I don't really know because I have never installed it. Everything went well. 

I used Drag and Drop 

 

Thank you 

AdwCleaner[C00].txt

[Maurice Naggar]

Hello @Lexony34 That is a good & beneficial run of AdwCleaner. Thanks.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first
https://definitionupdates.microsoft.com/download/DefinitionUpdates/safetyscanner/amd64/MSERT.exe

Upon completion of the save, Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.

This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

[Lexony34]

Good evening Maurice Naggar,

Sorry it took me much longer than expected and in the end it didn't pass the scan. Indeed, during the first analysis being equipped with an SSD; The application started quickly and was well on its way to completing successfully. Unfortunately, the scan got stuck on a file (Freeze) and didn't move from there.

During this first analysis the Wifi was activated, so I decided to relaunch a new analysis but this time with the wifi off. In conclusion, it still does not manage to complete the analysis by remaining stuck on an .exe file.

"C:\Windows\sysWOW64\userinit.exe"

I really don't know why he behaves like this.

 

Thank you so much

[Maurice Naggar]

Just how many runs of MSERT.exe was this?  I only asked for just one run. Anyhow, I must have a copy of the log file

Find MSERT.log and then ATTACH in a reply.

[Lexony34]

2 No more. The last execution is still in progress, however; is blocked on the exe file which I told you about in the previous answer. I was able to find a log document. 

 

msert.log

[Maurice Naggar]

We do not need any other run of MSERT. Please put it aside. We will be doing other tasks. Please run the following custom script. Read all of this before you start. Please Close all open work.

Once the script-run has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program :  is FRSTENGLISH.exe

Please download the attached fixlist.txt file and save it to C:\Users\hp\Downloads

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will reset the Winsock. It will attempt to clear all Cache and history on web browsers. Depending on the speed of your computer this fix may take 40-50 minutes or more.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

Edited March 17, 2023 by Maurice Naggar

[Lexony34]

I executed all your requests, and the software to start the process as expected. After a few moments later, a message appeared inviting you to restart the laptop; which I of course accepted. By restarting he puts a message. (picture)

When I do, restart; it comes back to this blue screen.

I'm writing this message from my phone. 

[Maurice Naggar]

Could you click on the button "Advanced Options"  and then pick to restart in "Safe Mode WITH NETWORKING"

then after you get there, run this report 

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop to your reply..

[Lexony34]

When I select safe mode with network, it restarts But without safe mode and return to the blue screen. 

[Maurice Naggar]

Can you manage to get to the spot of the last screen ---with all the selection choice --- then tap the number 4 to select 

Enable SAFE mode

If you just get to Safe mode ....you could do some potential research / maybe some adjustment

[Lexony34]

I just executed the manipulation, but the laptop makes a semblance of booting in safe mode and then returns to the blue screen. 

[Maurice Naggar]

On that "blue screen" if you see ( either now, or on another occasion) if you see a STOP code line with some detail, please write it down and relay to me. The text of a "STOP code" can often provide some meaning of why the Windows aborted.

Please see about powering off the computer ( using power button) then waiting for like a minute, then powering on.
If system aborts again, please take this action
select / press the 6 number key to select "Enable Safe mode with Command Prompt"

If you can reach that, let me know.

[Lexony34]

When I started Windows in safe mode with the command prompt the result was the same, i.e. back to the blue screen. However, there was no command line but rather a pop-up window that appeared and disappeared immediately.

I was able to take a picture. (Picture)

Do I have to record a video by following the steps so that you can see the behavior or reaction of the laptop ?

[Maurice Naggar]

We do not need to have any videos. Sorry for all the troubles.

Please study this article as a guide to make a special USB-drive and to run the Farbar FRST64 report in a special way.
"Run Farbar Recovery Scan Tool - FRST from Recovery Mode on Windows 10"
https://forums.malwarebytes.com/topic/272765-run-farbar-recovery-scan-tool-frst-from-recovery-mode-on-windows-10/

Your Windows is Windows 10 64-bit
So when making the USB with the Media Creation Tool  ( later on when 'building' the USB) you just want the 64-bit.
You need to have the use of another Windows pc ( with internet connection ) to make / build the USB-thumb-pen-flash drive
You need a USB pen-flash-thumb drive with a capacity minimum of 8 GB. If you have such a USB keep in mind that it will be over-written so it should be a new one or else one that can be re-purposed.

The main goal of this exercise is to boot the pc from the special USB, then to get into the Windows Recovery Environment, and from there to make a special run with FRST64
and then later, to post back with attachments of FRST.txt & Addition.txt

[Lexony34]

Good evening Maurice,
I hope you are well, concerning the problems that have arisen I am not worried because your presence reassures me to go through with the repair. Already sorry for the time taken to answer, I had a big day.
I followed and carried out each step carefully and the operation was a success.

Unfortunately I can't find an Addition.txt file on the usb

FRST.txt

[Maurice Naggar]

Thanks. Is the system still on the Windows Recovery Environment, that is to say showing a command line that says

X:\Sources

on the monitor-display

[Lexony34]

Using the same method, I found a .txt file in the FRST folder of the computer's ssd.

Fixlog.txt

[Maurice Naggar]

Thanks. Is the system still on the Windows Recovery Environment, that is to say showing a command line that says

X:\Sources

on the monitor-display

[Lexony34]

Yes it was, because after the operations I turned off lthe laptop

[Maurice Naggar]

I wished you would have left it as is, showing that Command prompt. We will need to use the Windows Recovery Environment to then navigate to the C drive to attempt a very very special attempt to try a System Restore operation.

That is to say, to do the special bootup from the special USB.....with the exception of NOT running FRST64.

We just want to be at the X:\sources command prompt

Kindly get it there and let me know. Do not bother about "powering off the laptop". We need obvisouly the power in order to do stuff.

A system restore is a last potential hope because there was no luck to get to SaFe mode or to a Safe Mode with Command prompt.

The reports you sent today show that there are some potential old System Restore points we can use to do a restore.