FNKLM Posted March 5 ID:1621308 Share Posted March 5 Hello, I recently looked at my desktop and noticed that two folders had been copied to it. I keep my desktop empty and I have no memory of copying those folders there so its strange. In one of the folders was a copy of a third folder that is stored in a different place. So I think it is very unlikely that it was a accident. Have downloaded malwarebytes and am doing I fullscan with it. Would ask for your help do identify and remove the malware. Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621365 Share Posted March 5 Welcome 🙂 Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Right click FRST(64) and select Run as administrator. Make sure that under Optional Scans, there is a checkmark on Addition.txt. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also produce another log (Addition.txt ). Please attach this to your reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621369 Share Posted March 5 Thank you, Here are the requested logs. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621374 Share Posted March 5 Rename FRST64.exe to EnglishFRST.exe and try again. Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621378 Share Posted March 5 Never mind. There is no malware in your computer, just some orphan entries. Download the enclosed file Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Fixlist.txt Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621382 Share Posted March 5 Hi, I tried to run the fix me files and it resulted in blue screen crashes. It outputed some kind of fixlog Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621383 Share Posted March 5 It was incompleted. Please try again. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621388 Share Posted March 5 I tried three times, everytime a bluescreen crashed happened directly after I pressed the fix button. Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621390 Share Posted March 5 Lets check the image. Download the enclosed file Fixlist.txt Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621393 Share Posted March 5 Hello, here is the fixlog Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621396 Share Posted March 5 Windows Resource Protection found corrupt files and successfully repaired them. Lets try now the previous one: Download the enclosed file Fixlist.txt Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621399 Share Posted March 5 Did not work, the computer crashed again. The screen turned black with only the mouse pointer visible and not respondent at all. Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621401 Share Posted March 5 Please download Farbar Service Scanner and run it on the computer with the issue. Make sure all options are checked: Press "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please copy and paste the log to your reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621402 Share Posted March 5 (edited) Farbar Service Scanner Version: 30-04-2023 Ran by Windows (administrator) on 05-03-2024 at 17:58:13 Running from "C:\Users\Windows\Downloads" Microsoft Windows 11 Home (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => File is digitally signed C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed C:\Windows\System32\Drivers\netbt.sys => File is digitally signed C:\Windows\System32\Drivers\tdx.sys => File is digitally signed C:\Windows\System32\Drivers\afd.sys => File is digitally signed C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed C:\Windows\System32\dnsrslvr.dll => File is digitally signed C:\Windows\System32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed **** End of log **** FSS.txt Edited March 5 by FNKLM Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621407 Share Posted March 5 Did you select all options? Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621408 Share Posted March 5 As this: Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 5 Root Admin ID:1621411 Share Posted March 5 Scan with FSS Farbar Service Scanner https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/ Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621419 Share Posted March 5 Hello, no I did not search with all the options. But I corrected it now. Here it is Farbar Service Scanner Version: 30-04-2023 Ran by Windows (administrator) on 05-03-2024 at 19:13:55 Running from "C:\Users\Windows\Downloads" Microsoft Windows 11 Home (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Policy: ======================== Security Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => File is digitally signed C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed C:\Windows\System32\Drivers\netbt.sys => File is digitally signed C:\Windows\System32\Drivers\tdx.sys => File is digitally signed C:\Windows\System32\Drivers\afd.sys => File is digitally signed C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed C:\Windows\System32\dnsrslvr.dll => File is digitally signed C:\Windows\System32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\System32\mpssvc.dll => File is digitally signed C:\Windows\System32\bfe.dll => File is digitally signed C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed C:\Windows\System32\SDRSVC.dll => File is digitally signed C:\Windows\System32\vssvc.exe => File is digitally signed C:\Windows\System32\wscsvc.dll => File is digitally signed C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed C:\Windows\System32\wuaueng.dll => File is digitally signed C:\Windows\System32\qmgr.dll => File is digitally signed C:\Windows\System32\es.dll => File is digitally signed C:\Windows\System32\cryptsvc.dll => File is digitally signed C:\Windows\System32\usosvc.dll => File is digitally signed C:\Windows\System32\WaaSMedicSvc.dll => File is digitally signed C:\Windows\System32\dosvc.dll => File is digitally signed C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed C:\Windows\System32\ipnathlp.dll => File is digitally signed C:\Windows\System32\iphlpsvc.dll => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed **** End of log **** Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621423 Share Posted March 5 Download the enclosed file Fixlist.txt Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 5 Author ID:1621428 Share Posted March 5 Done, attached the log Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 5 ID:1621435 Share Posted March 5 (edited) Download the enclosed file Fixlist.txt Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Edited March 5 by JSntgRvr Wrong file Link to post Share on other sites More sharing options...
FNKLM Posted March 6 Author ID:1621507 Share Posted March 6 Hello again, here is the log. Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 6 ID:1621543 Share Posted March 6 Let's try the first Fixlist and see if the computer wont crash. There was a problem with the Volume Shadow Copy Service, which controls System Restore. Download the enclosed file Fixlist.txt Save it in the sameFRST64.exe is saved Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Link to post Share on other sites More sharing options...
FNKLM Posted March 6 Author ID:1621547 Share Posted March 6 Now it worked, no crash. Log attached. Fixlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted March 6 ID:1621550 Share Posted March 6 How is the computer doing? Link to post Share on other sites More sharing options...
Recommended Posts