Windows security won't run a full scan, after installing VLC media player

I downloaded VLC media player and now my windows virus checker won't complete a full scan, it freezes. I tried running EST online scanner and that won't run either.

 

Could I be infected?

 

 

 

Greetings and back to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Please allow me some time to review what you have posted.

Greetings.

Your computer is infected.

Please do this.
 
===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
C:\Program Files (x86)\Google\GoogleUpdater
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [136] 
Task: {E17C3A99-6A79-42CF-B42E-405522563514} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem124.0.6315.0{F4A04241-A040-4AA7-B981-C5E81C5F758D} => C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
S2 GoogleUpdaterInternalService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
S2 GoogleUpdaterService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION 
Task: {DBB41A61-3A88-459A-8E70-11159E07BBF8} - System32\Tasks\Lenovo\Vantage\Schedule\NotificationCenter => C:\Program Files (x86)\Lenovo\VantageService\4.0.49.0\ScheduleEventAction.exe  NotificationCenter (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
FirewallRules: [{1C999503-4ECD-4680-BE71-CA42265B1EE3}] => (Allow) C:\Users\domin\AppData\Roaming\Zoom\bin\Zoom.exe => No File 
FirewallRules: [{9BAFE9CA-93A0-49F1-8DB9-83A4CCDE6FF2}] => (Allow) C:\Users\domin\AppData\Roaming\Zoom\bin\airhost.exe => No File 
FirewallRules: [{942D2A6F-0ED2-4944-95E0-B498E95AE314}] => (Allow) C:\Users\domin\AppData\Roaming\Zoom\bin\airhost.exe => No File 
FirewallRules: [{2E21D2EC-2C0C-4565-A7B5-383F5AC96A3D}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe => No File 
Task: {DBB41A61-3A88-459A-8E70-11159E07BBF8} - System32\Tasks\Lenovo\Vantage\Schedule\NotificationCenter => C:\Program Files (x86)\Lenovo\VantageService\4.0.49.0\ScheduleEventAction.exe  NotificationCenter (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

===================================================

Rebuilding Windows Indexing

--------------------

Note: This process may take a long time to complete.

• Click Start type Indexing Options
  then hit Enter
• Click Advanced
• To the right of Delete and Rebuild select Rebuild
• Click OK
• When completed you will see Indexing complete

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Index rebuilt successfully?

Edited by Oh My!, 02 March 2024 - 08:11 PM.
Revo removed

I don't think Google Drive has been affected nor is there any evidence the malware was designed to spread to other devices. However, it would be a good idea to monitor the other areas for a week or so to look for any abnormalities.

Can you run a Windows Defender scan now?

• I've run a windows 11 virus & threat protection full scan, which took just over half an hour and found nothing. (is that the same as windows defender?)
• I've also run a Malwarebytes scan, clear
• I'm able to run ESET now, it wouldn't let me before, not finished yet.

What did I have, did it come via VLC media player and what damage could it have done?

 

Could it have captured any data or passwords from my system?

Since you've mentioned windows defender, been looking in windows defender firewall outbound rules and saw a reference to drobox, which I don't use on this machine, so I've disabled it. How can I check these rules are all ok?

@{C27EB4BA.dropboxOEM_23.4.5.0_x64_xbfuok16fey96?ms-resource://C27EB4BA.DROPBOXOEM/RESOURCES/OEMAPPNAME}

Yes, it is the same as Windows Defender.

If you downloaded VLC from a known, trusted site I don't think that is what caused your issue. If you are not sure about the download you can send me a Personal Message with the download link. If you deleted the installation file and it is in the Recycle Bin you can right click on the entry, select Restore, and restore the file to the original location. Then please zip and upload the file here
 

S2 GoogleUpdaterInternalService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION
S2 GoogleUpdaterService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-22] (Google LLC -> Google LLC) <==== ATTENTION
Description: The Windows Search Service is being stopped because there is a problem with the indexer: Recovery phase failed.
Windows Resource Protection found corrupt files and successfully repaired them.

The first 2 lines are malware related. The 3rd line is related to the Windows Search Service. The database was corrupted. The last line is just a system corruption which is common and may or may not be related to malware. Probably not.

Regarding Windows Firewall. The Firewall portion of the Addition.txt report is Whitelisted. That means entries previously determined to be valid, and therefore of no concern, aren't listed in the report. The rule you provided is not contained in the Addition.txt report meaning that has already been identified as being valid and of no concern (Whitelisted). It is simply part of the clutter inevitable in a computer system that neither helps nor hurts a computer. I have examined the Firewall rules that are listed, determined none of them are suspicious, and removed the ones ending in => No File. Those are orphaned entries I removed because they are visible clutter.

If you are still concerned, there is a way to completely reset Firewall Rules but apart from your peace of mind I don't see a reason to do that.

hi Gary, thank you so much for your help!

 

I deleted VLC and emptied the recycle bin, but I did get from the main sight.

 

SO you think it came from, or was in, Google updater?

 

Why would an infection change my indexing?

 

Do you know which infection it was?

 

Is there any more tests I need to do, or am I clean?

You are quite welcome.

VLC was not involved.

The GoogleUpdater malware has become more frequent lately. I have been attempting to identify a commonality with other topics I have handled but so far no luck. I don't have a malware name for you.

The malware did not change the indexing. It is quite an extensive data base and the need to rebuild it is not unheard of.

One of our previous steps resulted in the computer identifying and repairing corrupted files. That is common and it is possible some of your computer symptoms were related to that. I don't think so, but possible.

I usually finish up with an ESET Online Scan but you have already done that.

I think we are good but are there any remaining questions or concerns you might have before I post some tool/log clean up instructions and other information for you to consider going forward?

Hi Gary

 

Correct me if I'm wrong, you know I was infected because something (no name) infected googles updater file and my PC wouldn't run windows defender?

 

From my perspective there are five main things that worry me:

 

1) I think I'm quite careful, so would like to know how I got infected?

2) What access to accounts and passwords, or my keystrokes, could this infection have, and do I need to change all my passwords?

3) How long have I been infected?

4) do I need to change my security software, different/ add more, so this doesn't happen again 

5) I installed 2 packages (wingetUI & Pinokio) that automatically download updates and software, it makes me nervous that this new code (downloaded via these programs) isn't being scanned prior to install using "virus total", something I do before installing anything. Are these programs safe?

 

 

I noticed my google drive modification times on folders and files were all quite recent, even on folders I hadn't accessed for ages. is this linked and could there be a data breach?

 

Thanks for your help,

 

Reggie.

Ive logged onto the other account on this machine and tried to run a microsoft defender scan and it froze. I then tried to run an Eset scan and it wouldnt let me. I think i may still be infected.

 

I then moved back to my main account and it wouldn't let me rum ESET, the shortcut had been disabled.

 

What should i do?

 

this is the FRST64 loggs from my other account on the same machine.

 

I don't use the "Mandy" account very often, should I delete it, or fix then delete?

 

Do I need to re run a Farbar on my main account?

 

Are you able to run a Defender scan while logged into your Administrator (main) account?

yes.

 

There are only 2 accounts on this machine, the administrator one that I'm using, and another one, which other family use occasionally.

 

I disabled the internet and then tried to run a full system defender scan again, which it did and it finished without detecting anything.

 

I then tried running an eset, whilst temporarily enabling the internet whilst it downloaded the updates, and it's still running ok.

Edited by reggiereg, Yesterday, 01:12 PM.

Provide an update when completed.