I'm suspecting infection

[Pemonner]

I've very recently formatted my computer because I experienced lag and some network issues, like being blocked by some services utilizing Cloudflare. The windows would also occasionally report weather conditions and etc from a different location than my city. But now it's a fresh win 11, so it seems fairly responsive and light to the touch, but I'm not sure if everything is still completely fine. I ran MSERT and it suspected one infection mid-scan, although afterwards it reported the system as clean. When I open task manager, the CPU usage is at around 50% and then drops down to 2-4%. Empty paranoia I should suppose, but the following does worry me, I've only had the fresh system for around 12 hours, yet there's already 8300 events in security logs of the event viewer consisting of for logons and special logons, timestamped even when I'm particularly using the computer and it's just sitting around. This in particular worries me because I am the sole user of the computer and the network, at least supposedly. I ran the Farbar and Malwarebytes scan.

FRST.txt Addition.txt mlwrbyte.txt

[AdvancedSetup]

Hello @Pemonner

The logs do not indicate any obvious signs of an infection, but it does show several repeated errors with the Asus Armoury Crate software.

 

System errors:
=============
Error: (10/24/2023 11:21:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ArmouryCrateControlInterface service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (10/24/2023 11:21:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the ArmouryCrateControlInterface service to connect.

Error: (10/24/2023 10:35:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ArmouryCrateControlInterface service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (10/24/2023 10:35:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the ArmouryCrateControlInterface service to connect.

Error: (10/24/2023 10:12:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ArmouryCrateControlInterface service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (10/24/2023 10:12:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the ArmouryCrateControlInterface service to connect.

Error: (10/24/2023 09:38:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ArmouryCrateControlInterface service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

 

 

You might try reinstalling the Asus software and see if that helps.

 

You might also try using a different DNS settings in Windows

 

 

Your current DNS Servers:  62.241.198.245 - 62.241.198.246

Please consider changing your default DNS server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

Pick just one of these 4 providers. And be aware that you need to modify 1 time for IPv4 & a 2nd pass for IPv6

• Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
• Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
• OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
• DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

 

 

We can go ahead and run an AV scanner to double-check as well

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

[Pemonner]

Hey, thank you immensely for helping!

The Asus Armoury Crate software is something that tags along even when resetting windows, I suppose it mainly provides some external sparkle like a keyboard backlight or a flashy way to inspect some statuses, I didn't have the actual App that supplies the graphical interface so I wonder if that was the reason for the timeouts. Uninstalling and reinstalling seems to have stopped errors regarding timeouts. The keyboard backlight is gone which is a shame, but if some Asus - Windows 11 compability issues (I think that originally the laptop had win 10) where causing system errors , bugs and instability, maybe I'm better off without it. Anyway, seems to be buggy software, so no hackers there I suppose.

I tinkered with the DNS settings so that the server should now be picked manually.

 

Also ran the MS safety scanner every now and then and the end results would always seem promising. I've yet to bloat the machine with all my favorite Apps so scanning was pretty fast. Is this computer good to go? I should use it for practical learning in a few days and I definitely wouldn't want be a man-in-the-middle or such ^^

 

 

msert.log

[AdvancedSetup]

The logs is clean. If you like we can run a generic clean up script to remove temp files, reset the network, firewall, etc. just let me know.

Thanks

 

[Pemonner]

If it seems to be all clear, then I should be fine. Thank you so much for the efficient help and a peace of mind! Live long and prosper.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you