Bizarre issues, possible malware; MBAM not launching

[Cheef]

This is sort of a doozy so you may have to bear with me here. I appreciate any and all help. Please excuse the wall of text; I think all of this context is important.

My current PC is 6 years old (purchased March 2018). In May 2020 I bought new RAM and replaced my GPU (now a 980ti given by a family member; so it's old, but in great condition & still works fine). So it's *possible* my problems are hardware related, but I'm now very convinced it's some sort of malware.

About 2 weeks ago I realized late one evening that my PC was lagging pretty noticeably. I opened up MSI Afterburner and found my GPU was suddenly running at 70 degrees C (and climbing pretty rapidly) with 80%+ (spiking to nearly 100%) GPU utilization. Problem is... I was just looking at Google Chrome. I shut down my computer and figured it wouldn't happen the next day, but I was wrong. My PC was fine, then after approximately 10 hours, my GPU started heating up again, same issue. I installed Firefox and it happened on Firefox also. I updated my GPU drivers and nothing changed. A few days later, I reverted the recent Windows update (as this started shortly after the recent mid-April Windows update); no dice. My last resort was updating my board BIOS, which also didn't fix the problem.

Over the last 2 weeks, the problem has also gotten worse. Soon the GPU was acting weird almost from the moment I booted the computer; usually I have to reboot/restart the computer for literally ~2 hours just to get to a state where the GPU doesn't act weirdly, but again this only lasts for about ~10 hours. (Today I am lucky; I only had to reboot a few times.) I also noticed that if I have Task Manager open, the problem completely disappears, though TM will then suddenly and weirdly close itself after just a few minutes, thus making the problem re-emerge. After doing it several times in a row, TM will close out almost instantly upon opening, instead of lasting just a few minutes.

For a while I assumed my card was just showing very early signs of failure, as it's around 8 years old, but I've treated it very well. Naturally, with the discovery of Task Manager weirdly closing, I grew concerned it may be some sort of malware I've unintentionally downloaded or installed at some point in the last 2-3 weeks. (I don't know how I could have gotten this.) I'm a bit strapped for money, to put it mildly, and I'm rather desperate (I'm not in a monetary/time position to replace my computer), so I tried installing Malwarebytes to run a scan for malware and see if that was what was causing the GPU usage/temp spikes.

I tried installing it. Numerous times while trying to open the install file, I was prompted with the following window:

Running as administrator didn't help. I had to re-download the install file several times before getting it to work. During the pre-install prompts I was repeatedly shown a "Are you sure you want to close the install?" type window, which was weird because I obviously wasn't trying to close it. It seemingly installed normally, but at the end the window would close out before I could hit the "finish install" or "close window" button. The "Malwarebytes" shortcut was then on my desktop, but the image was the generic and not the MBAM logo:

When I try running it, even as Administrator, I am given this prompt:

I downloaded and ran the Support Tool, which funnily enough downloaded and runs fine. I select the option to Repair and then "Malwarebytes won't open;" it works for about 15 minutes, then says that Malwarebytes is "repaired" and should "work properly." The shortcut is removed, and Malwarebytes is nowhere to be seen on my computer. I try reinstalling it, but the same thing happens gain and again. I've gone through this whole process ("Installing" and "Repairing") probably 10 times by this point.

I'm at my wit's end and, like I said, I'm pretty sure this is some sort of malware messing with my computer. Again, I'd really appreciate any and all help to try and solve this (if that's even possible), and I apologize again for the wall of text.

[Porthos]

@Cheef Do not repair this time. Follow the instructions below to gather logs and post them here.

Please do the following so that we may take a closer look at your system.

 

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and then do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine 
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

 

Thank you

[Cheef]

Hi, thanks for the super quick response. I rebooted my computer after turning off fast restart. The GPU temp/usage is back to spiking and behaving weirdly; here are two screenshots of MSI Afterburner so you know what I'm talking about. The temperature/usage will temporarily fall back down to normal levels if I "click off" the browser, but it still sometimes spikes when a browser window is not on top. Not sure if this helps at all, but I figure context could be useful.

 

 

Here are the logs. It took about 20 minutes to get; not sure if that's normal or just a symptom of my computer acting up.

mbst-grab-results.zip

[Porthos]

@Cheef You are infected.

Be patient for the next expert to take your case.

[Cheef]

Kicking myself that it took me this long to realize. Thank you very much for your help. Hope my situation is fixable. Have a great rest of your day & week.

[JSntgRvr]

1. Download AV block remover, extract its contents to its own folder. https://www.safezone.cc/resources/av-block-remover-avbr.224/download
2. If the file is detected as a threat, allow it to run.
3. Run AVbr.exe. Put a check mark on drive C:.
4. If running AVbr.exe cause error or don't start at all you have to rename it to any name and try to run from the different place (you can rename its folder as well).
5. If it is still not run or closing shortly after the start, please run it in Safe Mode with Networking.

Follow the instructions. After rebooting a log AV_block_remove_date-time.log  is produced in the extracted folder's AV_block_remover sub-folder. Please attach this file to your reply.

[JSntgRvr]

Turn off all your virus protection, including Malwarebytes if active, while running this application.

[Cheef]

Hello, thanks for the quick response (again). I had to copy the downloaded file then run it as admin just to get it to actually run.

Here is the .log you need. I also note now that the Malwarebytes shortcut is now appearing properly on my desktop unlike before (see OP):

 

AV_block_remove_2024.04.29-16.40.log

 

Seems the GPU is working fine for now -- no overheating or weird usage % yet.

[JSntgRvr]

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Please rename FRST.EXE or FRST64.EXE to FRSTEnglish.exe
• After renaming the file right-click over FRSTEnglish.exe and select "Run as administrator"
• When the tool opens click Yes to the disclaimer if this is the first time using the tool
• Make sure there is a check mark in the Addition.txt check box
• Press the Scan button.
• It will make a log FRST.txt and Addition.txt in the same directory the tool is run from. Please attach both logs to your next reply.

[Cheef]

Here you go:

FRST.txtAddition.txt

GPU still looking steady, which is the first time that's happened on a single reboot since this all started about 2 weeks ago.

[JSntgRvr]

:Welcome:  
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary.  

Let's begin... 

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

[Cheef]

I rebooted after running FRST and my GPU has been fine since. Normal temps (~48C idle), normal GPU utilization (0-1%), etc.

Fixlog.txt

cureit.log

[JSntgRvr]

Windows Resource Protection found corrupt files and successfully repaired them.
There are no infected objects detected
I must conclude that your computer is now clear. 

 Congratulations.

Use this application to remove tools used and their quarantined items:
 
Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

• Put a check mark next to these items:

- Delete tools

- Delete Restore Points

- Create Restore Point

- Delete now

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and delete itself.

A few final recommendations:
 
The following information will help you to keep your computer and data safer as well as improve your overall privacy

• Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
  https://www.howtogeek.com/780233/best-password-manager/
• Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
• Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
• Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
• Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/
• Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

Cybersecurity basics & protection
 
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity
 
Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/
 
Please review the following to help you better protect your computer and privacy
 
Tips to help protect from infection
 
Hopefully, we've been able to assist you with correcting your system issues.
 
Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal.

Regards.🙂

 

 

[Cheef]

Ran the program just now and will implement your recommended changes later today when I get the chance. Everything seems good now and is working properly.

I really appreciate all the help you've given me. You've saved me lots of frustration and probably $1,000 that I don't have. Have a great rest of your week.

[Cheef]

Oh, and again: thank you! 🙂