Jump to content

Underperforming pc

kotnik

By kotnik
in Resolved Malware Removal Logs

 Share

Recommended Posts

Porthos

Porthos

Posted
Posted (edited)

@kotnik

Please do the following so that we may take a closer look at your system.

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • The tool will also download and run a file named FRSTEnglish. Please allow it to do so.
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

     

Thank you

Edited by Porthos
Link to post
Share on other sites
Porthos

Porthos

Posted
Posted
9 minutes ago, kotnik said:

I ran a DISM scan and after SFC /SCANNOW and theres no error anymore image.png.b4f45500f9e8b019a9cb4f42908b0a0e.png

 

Looks like you took care of it.

12 minutes ago, kotnik said:

why do I need to reinstall windows?

The ISO was only if you needed to go farther in that guide to repair Windows.

Next is to find out why the epic game launcher is crashing.

Quote

Application errors:
==================
Error: (12/15/2023 11:28:29 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x33ac
Faulting application start time: 0x0x1da2fa607767784
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: b213c09a-84fa-40de-a449-faac01037d9d
Faulting package full name:
Faulting package-relative application ID:

Error: (12/15/2023 11:27:59 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x2af4
Faulting application start time: 0x0x1da2fa5f505f57e
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: fecd95fa-5a67-44ce-b2c4-e42835c7df69
Faulting package full name:
Faulting package-relative application ID:

Error: (12/15/2023 02:39:06 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x2bd0
Faulting application start time: 0x0x1da2f5c1320a796
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 22a5a41a-c451-415c-8c68-0e2628f70124
Faulting package full name:
Faulting package-relative application ID:

Error: (12/15/2023 02:35:43 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x44d0
Faulting application start time: 0x0x1da2f5b9a27ca8b
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 605346a9-5f5a-45be-bb09-ad78fabe966e
Faulting package full name:
Faulting package-relative application ID:

Error: (12/15/2023 02:17:47 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: WindowsPackageManagerServer.exe, version: 1.17.2203.10001, time stamp: 0x622a8641
Faulting module name: WindowsPackageManager.dll, version: 1.17.2203.10001, time stamp: 0x622a8613
Exception code: 0xc0000005
Fault offset: 0x0000000000089bf3
Faulting process id: 0x0x25b0
Faulting application start time: 0x0x1da2f5918369297
Faulting application path: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.17.10691.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe
Faulting module path: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.17.10691.0_x64__8wekyb3d8bbwe\WindowsPackageManager.dll
Report Id: 889aa12d-e0e3-4609-beb8-ca1b643f905b
Faulting package full name: Microsoft.DesktopAppInstaller_1.17.10691.0_x64__8wekyb3d8bbwe
Faulting package-relative application ID: winget

Error: (12/14/2023 09:54:31 PM) (Source: NVIDIA OpenGL Driver) (EventID: 1) (User: )
Description: Event-ID 1

Error: (12/14/2023 08:59:51 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x1878
Faulting application start time: 0x0x1da2ec81987358a
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 1b243b8e-ff79-4f74-bc1a-83d113c10b92
Faulting package full name:
Faulting package-relative application ID:

Error: (12/14/2023 08:59:12 PM) (Source: Application Error) (EventID: 1000) (User: JAKA)
Description: Faulting application name: EpicGamesLauncher.exe, version: 15.19.0.0, time stamp: 0x657719d8
Faulting module name: ntdll.dll, version: 10.0.22621.2506, time stamp: 0xbced4b82
Exception code: 0xc0000005
Fault offset: 0x0000000000033aca
Faulting process id: 0x0x4fb4
Faulting application start time: 0x0x1da2ec802174fe4
Faulting application path: C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: c9aa9d75-fe8e-4666-aa7e-5890c22092fb
Faulting package full name:
Faulting package-relative application ID:

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @kotnik

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

[ 1 ]

Please make the following system changes.

  • Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed.
  • Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed.
  • Disable-Fast-Startup
  • Show-Hidden-Folders-Files-Extensions

[ 2 ]

Malwarebytes AdwCleaner

Let's do a special run of Malwarebytes AdwCleaner to help prepare the computer to be able to run other scanning software that may be blocked

Please read all the information below before starting so that you have a good understanding of the process.
Take your time and be careful. Make sure you select all of the listed items below - before- pressing the scan button.
 
  • Please download Malwarebytes AdwCleaner and save the file to your Desktop or Downloads folder.
  • Here is another link to download if the link above does not work:  Malwarebytes AdwCleaner alternative link
  • Locate the program where you downloaded it. Double-click to start AdwCleaner.  Do not rush. There are a few choices to set as listed below.
  • Malwarebytes AdwCleaner guide
  • Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.
  • Accept the End User License Agreement.
  • Wait until the database is updated. Do Not click on anything yet.
 
When AdwCleaner starts, on the left side panel of the window, click on Settings and enable these repair actions on the Application tab
Clicking their button to the far-right will enable the ON status
 
  • Delete IFEO keys
  • Delete tracing keys
  • Delete Prefetch files
  • Reset Proxy
  • Reset Chrome policies
  • Reset IE Policies
  • Reset Winsock
  • Reset Hosts file (If you're not having any issues accessing security or other websites you can uncheck this item)

 

image.png.a06f1c3da463f5f1a4d071a910ff71

 

ONLY after you have set the selections above ....only after that .....
Now On the left side of the AdwCleaner window, click on the Dashboard panel and then click the Scan button to perform a computer scan.
 
image.png.7a0c726e4d63978cfe4d95bca514c7
 
  • DO NOT uninstall or remove the Preinstalled software if found. Uncheck any items listed for Preinstalled
  • When finished, if items are found please click Quarantine to finish the cleaning process.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Attach that log to your next reply. You can also open the Log Files panel to locate.
  • This can take several minutes to complete, please be patient.
  • When the AdwCleaner scan is completed it will display all of the items it has found. Click on the Quarantine button To remove what it found.
  • AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.
  • Click on the Continue button to finish the removal process.
  • If No Detections are found, Click the Basic Repair button to have it reset the checked items above.


[ 3 ] 

Malwarebytes for Windows

  • If you already have Malwarebytes installed then open Malwarebytes and click on the small gear icon, then click on the "Check for updates" button on the General tab.
  • After any updates, click the middle Scan button from the main page. It will automatically run a Threat Scan.
  • If you don't have Malwarebytes installed yet, please download it from here or alternative link and install it.
  • Once installed then open Malwarebytes and select Scan and let it run.
  • Once the scan is completed, make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let us know in your next reply that the scanner would not run.

 

View Reports and History in Malwarebytes for Windows v4
https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows

Malwarebytes for Windows v4 guide
https://support.malwarebytes.com/hc/en-us/articles/360038984693-Malwarebytes-for-Windows-v4-guide

 

RESTART THE COMPUTER Before running Step 4

[ 4 ]

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Please rename FRST.EXE or FRST64.EXE to FRSTEnglish.exe
  • After renaming the file right-click over FRSTEnglish.exe and select "Run as administrator"
  • When the tool opens click Yes to the disclaimer
  • Make sure there is a check mark in the Addition.txt check box
  • Press the Scan button.
  • It will make a log FRST.txt and Addition.txt in the same directory the tool is run from. Please attach both logs to your next reply.

 

 

Thank you

 

Example image of where to click to attach files when posting your reply

image.thumb.png.e208c182ff570799c53bcf57

 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

  • NOTICE: This script was written specifically for this user, for use on this particular machine.
  • Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\jakak\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

  1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
  2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
                Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
  3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

[ 1 ]

Please download HWiNFO the Professional System Information and Diagnostics program.
HWiNFO Portable for Windows

Unzip the program to its own folder such as: C:\HWiNFO
Go to the new folder and locate the file C:\HWiNFO\HWiNFO64.exe and double-click to run it.
Click the RUN button.
Ignore the update, click close.
Click on Save Report and choose HTML and click Next, then Finish
By default, it will create a new report named COMPUTER.HTM in the same folder as the program. C:\HWiNFO
Please zip that file and attach it to your next reply

 

[ 2 ]

Create an Autoruns Log:

NOTE: Please leave Autoruns running for 30 minutes before assuming it has completed.

  • Please download Sysinternals Autoruns from here:   https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
  • Save Autoruns.zip to your computer. Then locate it and extract it to a new folder where you can find and run it.
  • Once it starts you may not be able to easily stop the scan but you can try to press the Escape key on your keyboard.
  • Once scanning is stopped, click on the Options menu at the top of the program and select Scan Options... 
  • Then place a check mark on the following items Verify Code Signatures, Check VirusTotal.com, and Submit Unknown Images
  • Then click the Rescan button. Agree to the VirusTotal EULA
  • Once the new scan has been completed, please click on the File button at the top of the program and select Save, or use the Save icon, and save the Autoruns.arn file to your desktop and close Autoruns.
  • Right-click on the Autoruns.arn file (it will typically be the name of your computer) on your desktop or where you save it, and hover your mouse over Send To and select Compressed (zipped) Folder
  • Attach the Autoruns.zip folder (your computer name.zip) you just created to your next reply.

 

 

image.png

 

Thank you

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Well, "something" is wrong.

Let me have you run the following, please

 

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

  • The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
  • Close all open applications and locate the downloaded file and double-click to run it
  • The program will take a moment to launch and bring up the License and Update screen
  • Place a check mark to agree to the terms and then click on the Continue button
  • Click the underlined link Select objects for scanning
  • On the top left click the Scanning objects that should automatically check all objects
  • Click the small wrench and make sure there is a check on Automatically apply actions to threats
  • Then click the large button on bottom right Start scanning
  • Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
  • The log is saved in the folder named Doctor Web in the top of your user profile folders
  • Please attach that log on your next reply

 

 

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.