Policy Restrictions & Failed Windows 11 Boot. Possible rootkit?

My computer failed to boot upon startup when powered on a few days ago, and no amount of restarting, Windows troubleshooting, or Safe mode booting would get Windows running. It was only upon disabling Secure Boot in the BIOS that Windows would finally boot properly. I have since re-enabled Secure Boot, but am unsure if any malware weaseled its way down to a low level during this endeavor. An Avast One scan told me that "Malware or other threats could be running in your PC memory". A rootkit scan through MalwareBytes didn't throw any red flags. Farbar highlighted the following items for a fixlist:

 

Greetings and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Please run a new FRST Scan and copy/paste both reports in your reply, using multiple posts if the content is too long.

Greetings,

===================================================

Do You Still Need Help?

It has been 3 days since my last post.

• Do you still need help with this?
• If you have not replied within 48 hours I will assume you have abandoned the Topic and it will be closed.

Hi Gary,

 

Apologies for my slow response. I should be able to respond daily at this point if needed. I factory reset my laptop, which resolved all of my higher-level issues (safe boot not functioning, etc.) The logs from FRST no longer have any "ATTENTION" lines. Does this mean the device is clean? I've tried to attach the files, but can't figure out how to do so on the reply tool of this forum. The "My Media" tab will only show the previous logs that I linked in the original post.

Thank you for your patience,

Isaac

Hi Isaac.

Copy and paste the contents of each report in your reply, using multiple posts if the content is too long. I'll take a look to make sure all is well.

Please run this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
Powershell:  Get-Process -Id (Get-NetTCPConnection -LocalPort 32683).OwningProcess
Powershell:  Get-Process -Id (Get-NetTCPConnection -LocalPort 26822).OwningProcess
ExportKey: HKLM\SOFTWARE\Policies\Mozilla\Firefox
ExportKey: HKLM\SOFTWARE\Policies\Microsoft\Edge
HKU\S-1-5-21-3731549638-1745586254-840529321-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\imver\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File 
HKU\S-1-5-21-3731549638-1745586254-840529321-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\imver\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
HKU\S-1-5-21-3731549638-1745586254-840529321-1001\...\RunOnce: [Uninstall 24.020.0128.0003] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\imver\AppData\Local\Microsoft\OneDrive\24.020.0128.0003" [0 2024-02-29] () <==== ATTENTION [zero byte File/Folder] 
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

The FRST forced restart of my laptop failed, and it remained shut off. Pressing the power button would lead to the power lighting up for a second, before turning off again, with the screen remaining off. On the third attempt, I was directed to Windows diagnostic for a failed boot. A fourth restart successfully booted me into Windows. These are the contents of the fixlog:

 

Please do this.

===================================================

Startup Repair

----------

• Click Start, type Change advanced, then select Change advanced startup options
• Click Restart now
• When the system reboots select Troubleshoot
• Select Advanced Options
• Select Startup Repair
• If you are notified the repair can't be completed let me know
• When completed check your startup process

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
cmd: type "C:\Windows\System32\LogFiles\Srt\SrtTrail.txt"
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Startup Repair run successfully?
• Fixlog

Since your issue is not malware related I may end up referring you to a more appropriate forum. Before doing that, please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
StartBatch:
wevtutil epl System %userprofile%\Desktop\SystemLog.evtx
wevtutil epl Application %userprofile%\Desktop\ApplicationLog.evtx
EndBatch:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Please zip and upload the SystemLog.evtx and ApplicationLog.evtx files located on your Desktop to GoFile, WeTransfer, or the file hosting site of your choice. Send me a Personal Message with the download link.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Download links via Personal Message

Thank you for the reports and additional information.

Please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
cmd: systeminfo
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================
Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog

I've censored my email because I don't particularly want to expose it to the internet. Here's the remainder of the fixlog:

 

Thank you for your diligence.
 

Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.

Unfortunately we didn't get the information I was looking for.

Please do this.

===================================================

Checking Windows Virtualization Status

--------------------

• Windows Key + R at the same time
• Type taskmgr and hit Enter
• Click on the Performance tab (3rd icon down under 3 horizontal bars near upper left hand corner of screen)
• Select CPU
• Under the graph check to see if Virtualization is Enabled
• Report the setting in your reply

===================================================

Things I would like to see in your next reply.

• Virtualization Enabled?

Virtualization is enabled.