Solved Possible infection?

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

  • fixlist.txt
    10.1 KB · Views: 112
Thank you for all. I will do this this evening. For now, can you briefly tell me what it is about and what you found? Thanks.
 
I also gave it a look from my Phone now. Can I safely substitute the "user" with my real folder name? I wrote user earlier in the logs just to hide my name.

Of course I'll select the only full words option so that "users" doesn't change too
 
I didn't see much there.
In order for the fixlist to work we must have a real paths, so if you changed anything in your logs you must adjust fixlist accordingly
 
Alright. I will change the user part accordingly.
Just to understand and avoid issues

1 this fix is more of a thing to correct some registry errors, leftover files or similar things right? Not actual malware, from what I see.

2 what is going on with "\steamapps\common\starbound"? It is a game, technically, and one I still play.

Sorry for all the questions
 
Hello Broni,
Here is the fixlog. All appears to have worked fine.

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-06-2021
Ran by user (29-06-2021 23:28:10) Run:1
Running from C:\Users\user\Desktop
Loaded Profiles: user & crist
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKU\S-1-5-21-1774472352-47920936-928243050-1001\...\Run: [Spotify] => C:\Users\user\AppData\Roaming\Spotify\Spotify.exe [25591712 2019-07-04] (Spotify AB -> Spotify Ltd) <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
2020-01-20 23:50 - 2020-01-20 23:50 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_1
2020-02-01 12:34 - 2020-02-01 12:34 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_10
2020-02-02 13:08 - 2020-02-02 13:08 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_11
2020-02-02 23:28 - 2020-02-02 23:28 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_12
2020-02-04 23:08 - 2020-02-04 23:08 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_13
2020-02-05 23:05 - 2020-02-05 23:05 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_14
2020-02-07 14:01 - 2020-02-07 14:01 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_15
2020-02-29 13:51 - 2020-02-29 13:51 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_16
2020-03-01 10:54 - 2020-03-01 10:54 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_17
2020-02-13 13:01 - 2020-02-13 13:01 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_18
2020-03-03 22:59 - 2020-03-03 22:59 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_19
2020-01-22 00:51 - 2020-01-22 00:51 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_2
2020-03-04 23:56 - 2020-03-04 23:56 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_20
2020-03-05 21:35 - 2020-03-05 21:35 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_21
2020-03-06 19:38 - 2020-03-06 19:38 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_22
2020-03-07 11:26 - 2020-03-07 11:26 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_23
2020-03-08 19:52 - 2020-03-08 19:52 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_24
2020-03-09 19:48 - 2020-03-09 19:48 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_25
2020-03-09 21:30 - 2020-03-09 21:30 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_26
2020-03-10 23:02 - 2020-03-10 23:02 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_27
2020-03-31 02:43 - 2020-03-31 02:43 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_28
2020-03-31 14:25 - 2020-03-31 14:25 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_29
2020-01-23 16:47 - 2020-01-23 16:47 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_3
2020-04-01 15:33 - 2020-04-01 15:33 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_30
2020-04-02 14:14 - 2020-04-02 14:14 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_31
2020-04-03 17:46 - 2020-04-03 17:46 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_32
2020-04-04 13:12 - 2020-04-04 13:12 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_33
2020-04-05 09:51 - 2020-04-05 09:51 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_34
2020-04-07 23:01 - 2020-04-07 23:01 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_35
2020-04-09 22:49 - 2020-04-09 22:49 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_36
2020-04-10 00:33 - 2020-04-10 00:33 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_37
2020-04-10 00:37 - 2020-04-10 00:37 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_38
2020-01-27 20:06 - 2020-01-27 20:06 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_4
2020-01-28 22:23 - 2020-01-28 22:23 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_5
2020-01-29 22:40 - 2020-01-29 22:40 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_6
2020-01-30 20:31 - 2020-01-30 20:31 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_7
2020-01-31 15:03 - 2020-01-31 15:03 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_8
2020-01-31 23:00 - 2020-01-31 23:00 - 000000000 _____ () C:\Users\user\AppData\Roaming\scthost_9
2019-11-14 21:39 - 2019-11-14 21:39 - 000000000 _____ () C:\Users\user\AppData\Local\D2154C.tmp
2019-11-14 21:36 - 2019-11-14 21:36 - 000000000 _____ () C:\Users\user\AppData\Local\D246E9.tmp
2019-11-14 21:33 - 2019-11-14 21:33 - 000000000 _____ () C:\Users\user\AppData\Local\D25B3B.tmp
2019-11-14 21:35 - 2019-11-14 21:35 - 000000000 _____ () C:\Users\user\AppData\Local\D26285.tmp
2019-11-23 23:51 - 2019-11-23 23:51 - 000000000 _____ () C:\Users\user\AppData\Local\D269C8.tmp
2019-11-16 17:45 - 2019-11-16 17:45 - 000000000 _____ () C:\Users\user\AppData\Local\D28508.tmp
2019-11-18 21:37 - 2019-11-18 21:37 - 000000000 _____ () C:\Users\user\AppData\Local\D286EB.tmp
2019-11-12 21:50 - 2019-11-12 21:50 - 000000000 _____ () C:\Users\user\AppData\Local\D2A7B6.tmp
2019-11-11 22:46 - 2019-11-11 22:46 - 000000000 _____ () C:\Users\user\AppData\Local\D2AF99.tmp
2020-03-25 02:00 - 2017-03-07 15:33 - 000000036 _____ () C:\Users\user\AppData\Local\installLang.ini
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => -> No File
FirewallRules: [{C71240A1-D237-4D20-B732-635837D7EED0}] => (Allow) D:\Games\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{6CE93BE9-1099-4DF5-867A-AB9F2542FF1D}] => (Allow) D:\Games\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{332FA1CA-6C8F-4CE3-A651-53AAB2EA8684}] => (Allow) D:\Games\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{480AD70A-8253-46E9-B4FF-0B3FF735E097}] => (Allow) D:\Games\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{EB732AB6-6A6C-4494-AD6A-D2EFFDD0675B}] => (Allow) D:\Games\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{738FF297-CB54-4DD0-A763-B1A298E594CE}] => (Allow) D:\Games\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{9EE76169-A041-4DCA-B093-30CD45FB47C8}] => (Allow) D:\Games\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{E0BA6642-AA79-4527-B766-E98AEB978056}] => (Allow) D:\Games\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{C36FD347-8D80-47A3-A62D-2A9D80B35568}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{9AB0B396-AED2-4565-8C7E-47822D400693}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{B7C90865-C4CB-4987-A7EF-40838BC9FDBE}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{8B463FA0-1599-4CA5-92A1-5E9C00105E65}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{12D8C88C-CFC3-4915-91A7-DCFD4F6C8FC1}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{30EA94B2-A94B-49E2-8377-C3E3FD77D0F2}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{AEBCE3AB-ECEC-4523-8B85-9CDD9F71B895}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{2A584B31-80A5-41A0-B6A8-314D5E741F38}] => (Allow) J:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{8C36C2E0-A64F-4974-B30A-09D4C1CB7969}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{CBB871DE-38F1-497C-9EC0-AD2ECC7A7DA4}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\starbound.exe => No File
FirewallRules: [{670CF1CF-2320-402B-8B9E-9A987F6C490E}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{6B323D56-6B86-4A5F-8F8D-7A2F4EC4B058}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\starbound_server.exe => No File
FirewallRules: [{AB146833-4A6A-47B7-A9F4-4CA50EE11E98}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{AD264557-BD61-41C6-8101-F827ACEF2D64}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win64\mod_uploader.exe => No File
FirewallRules: [{E5635A44-F2D3-4B2F-AB3D-8317D4DC1ECE}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{32F97002-538F-409E-BEA4-0E3428C74601}] => (Allow) D:\SteamLibrary\steamapps\common\Starbound\win32\starbound.exe => No File
FirewallRules: [{1921522A-92AF-43E1-8DF8-F43705034DB9}] => (Allow) C:\WINDOWS\SysWOW64\svctcom.exe => No File

*****************

"HKU\S-1-5-21-1774472352-47920936-928243050-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Spotify" => removed successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.2.6 => removed successfully
C:\Users\user\AppData\Roaming\scthost_1 => moved successfully
C:\Users\user\AppData\Roaming\scthost_10 => moved successfully
C:\Users\user\AppData\Roaming\scthost_11 => moved successfully
C:\Users\user\AppData\Roaming\scthost_12 => moved successfully
C:\Users\user\AppData\Roaming\scthost_13 => moved successfully
C:\Users\user\AppData\Roaming\scthost_14 => moved successfully
C:\Users\user\AppData\Roaming\scthost_15 => moved successfully
C:\Users\user\AppData\Roaming\scthost_16 => moved successfully
C:\Users\user\AppData\Roaming\scthost_17 => moved successfully
C:\Users\user\AppData\Roaming\scthost_18 => moved successfully
C:\Users\user\AppData\Roaming\scthost_19 => moved successfully
C:\Users\user\AppData\Roaming\scthost_2 => moved successfully
C:\Users\user\AppData\Roaming\scthost_20 => moved successfully
C:\Users\user\AppData\Roaming\scthost_21 => moved successfully
C:\Users\user\AppData\Roaming\scthost_22 => moved successfully
C:\Users\user\AppData\Roaming\scthost_23 => moved successfully
C:\Users\user\AppData\Roaming\scthost_24 => moved successfully
C:\Users\user\AppData\Roaming\scthost_25 => moved successfully
C:\Users\user\AppData\Roaming\scthost_26 => moved successfully
C:\Users\user\AppData\Roaming\scthost_27 => moved successfully
C:\Users\user\AppData\Roaming\scthost_28 => moved successfully
C:\Users\user\AppData\Roaming\scthost_29 => moved successfully
C:\Users\user\AppData\Roaming\scthost_3 => moved successfully
C:\Users\user\AppData\Roaming\scthost_30 => moved successfully
C:\Users\user\AppData\Roaming\scthost_31 => moved successfully
C:\Users\user\AppData\Roaming\scthost_32 => moved successfully
C:\Users\user\AppData\Roaming\scthost_33 => moved successfully
C:\Users\user\AppData\Roaming\scthost_34 => moved successfully
C:\Users\user\AppData\Roaming\scthost_35 => moved successfully
C:\Users\user\AppData\Roaming\scthost_36 => moved successfully
C:\Users\user\AppData\Roaming\scthost_37 => moved successfully
C:\Users\user\AppData\Roaming\scthost_38 => moved successfully
C:\Users\user\AppData\Roaming\scthost_4 => moved successfully
C:\Users\user\AppData\Roaming\scthost_5 => moved successfully
C:\Users\user\AppData\Roaming\scthost_6 => moved successfully
C:\Users\user\AppData\Roaming\scthost_7 => moved successfully
C:\Users\user\AppData\Roaming\scthost_8 => moved successfully
C:\Users\user\AppData\Roaming\scthost_9 => moved successfully
C:\Users\user\AppData\Local\D2154C.tmp => moved successfully
C:\Users\user\AppData\Local\D246E9.tmp => moved successfully
C:\Users\user\AppData\Local\D25B3B.tmp => moved successfully
C:\Users\user\AppData\Local\D26285.tmp => moved successfully
C:\Users\user\AppData\Local\D269C8.tmp => moved successfully
C:\Users\user\AppData\Local\D28508.tmp => moved successfully
C:\Users\user\AppData\Local\D286EB.tmp => moved successfully
C:\Users\user\AppData\Local\D2A7B6.tmp => moved successfully
C:\Users\user\AppData\Local\D2AF99.tmp => moved successfully
C:\Users\user\AppData\Local\installLang.ini => moved successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive1 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive2 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive3 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive4 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive5 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive6 => removed successfully
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => removed successfully
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxDTCM => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C71240A1-D237-4D20-B732-635837D7EED0}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6CE93BE9-1099-4DF5-867A-AB9F2542FF1D}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{332FA1CA-6C8F-4CE3-A651-53AAB2EA8684}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{480AD70A-8253-46E9-B4FF-0B3FF735E097}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{EB732AB6-6A6C-4494-AD6A-D2EFFDD0675B}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{738FF297-CB54-4DD0-A763-B1A298E594CE}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{9EE76169-A041-4DCA-B093-30CD45FB47C8}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E0BA6642-AA79-4527-B766-E98AEB978056}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C36FD347-8D80-47A3-A62D-2A9D80B35568}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{9AB0B396-AED2-4565-8C7E-47822D400693}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B7C90865-C4CB-4987-A7EF-40838BC9FDBE}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8B463FA0-1599-4CA5-92A1-5E9C00105E65}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{12D8C88C-CFC3-4915-91A7-DCFD4F6C8FC1}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{30EA94B2-A94B-49E2-8377-C3E3FD77D0F2}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{AEBCE3AB-ECEC-4523-8B85-9CDD9F71B895}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2A584B31-80A5-41A0-B6A8-314D5E741F38}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8C36C2E0-A64F-4974-B30A-09D4C1CB7969}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{CBB871DE-38F1-497C-9EC0-AD2ECC7A7DA4}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{670CF1CF-2320-402B-8B9E-9A987F6C490E}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6B323D56-6B86-4A5F-8F8D-7A2F4EC4B058}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{AB146833-4A6A-47B7-A9F4-4CA50EE11E98}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{AD264557-BD61-41C6-8101-F827ACEF2D64}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E5635A44-F2D3-4B2F-AB3D-8317D4DC1ECE}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{32F97002-538F-409E-BEA4-0E3428C74601}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{1921522A-92AF-43E1-8DF8-F43705034DB9}" => removed successfully


The system needed a reboot.

==== End of Fixlog 23:28:10 ====
 
Last scans...

redtarget.gif
Download Security Check from here or here and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


redtarget.gif
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.


redtarget.gif
Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


redtarget.gif
Download Sophos Free Virus Removal Tool and save it to your desktop.
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
 
Security Check results

Results of screen317's Security Check version 1.014 --- 12/23/15
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
Kaspersky Security Cloud
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java version 32-bit out of Date!
Google Chrome (91.0.4472.124)
Google Chrome (SetupMetrics...)
````````Process Check: objlist.exe by Laurent````````
Intel Intel(R) Online Connect Access LegacyCsLoaderService.exe
Intel Intel(R) Online Connect Access IntelTechnologyAccessService.exe
Intel Intel(R) Online Connect ioc.exe
Kaspersky Lab Kaspersky Password Manager 9.0.2 kpm_tray.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

FSS results

Farbar Service Scanner Version: 23-12-2020
Ran by user (administrator) on 30-06-2021 at 00:19:35
Running from "C:\Users\user\Desktop"
Microsoft Windows 10 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Windows Security:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv: "%systemroot%\system32\svchost.exe -k netsvcs -p".
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend: ""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2105.5-0\MsMpEng.exe"".


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\Drivers\afd.sys => File is digitally signed
C:\Windows\System32\Drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\SecurityHealthService.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
 
Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
[COLOR=#ff0000][B]This is a very crucial step so make sure you don't skip it.[/B][/COLOR]
Download [IMG]http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.pngDelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:
  • Activate UAC (optional; some users prefer to keep it off)
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore
  • Reset system settings
Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

6. Run Temporary File Cleaner (TFC) and AdwCleaner weekly (you need to redownload these tools since they were removed by DelFix).

7. (optional) If you want to keep all your programs up to date, download and install FileHippo App Manager.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

8. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

9. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

10. Please, let me know, how your computer is doing.
 
You must log in or register to reply here.

Similar threads

H
Legion 5 15ARH05H Type-C Video Output Stopped Working
Replies
0
Views
409
Hal19
H
Z
  • Locked
MSI's new monitors cause uproar on Reddit over firmware update limits
2
Replies
34
Views
683
Endymio
Endymio
Daniel Sims
WD faces class-action lawsuit over failing SanDisk portable SSDs
Replies
5
Views
555
MrLolendo
M

Latest posts

Back