I suspect I have a RAT or just plain paranoia.

Hello, 

 

I am new here and I've decided to ask for help here since I've taken my PC (Dell XPS8940) to GeekSquad and they keep telling me there's nothing wrong. However, I was seeing the WIFI and Bluetooth "activating themselves" on my PC, when I never have them on. Also I see logs related to Hyper V and remote operations, which I also NEVER use. GS has clean my PC but I still have the feeling something is off - Maybe I'm just being extra paranoid, but I've been seeing similar behavior on my Samsung phones, which really bothers me as I have a new router with firewall installed. So I can't imagine how something could have gotten through.

Anyway. I've disabled services that I don't use, and may make my PC more vulnerable (like Hyper-V and remote access related services), I've also disabled optional windows features like OpenSSH and WMIC that I don't use. I've run RogueKill, AdwCleaner and Malwarebytes already.

Here are the FARBAR logs after running all of the other software, updating windows and restarting - Hopefully you guys can see something I don't - Or if anything - at least I'll have peace of mind knowing there's no RAT or keylogger around. 

 

Hi Romy99,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution, before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.Please give me some time to examine your logs and I will get back to you as soon as possible.

Dennis

There are no obvious signs of malware showing in the logs, although I would like to check a few items.
Also we can do some clean-up and maintenance, including the Sytem File Checker to try and resolve some errors showing.
We will then run a malware scan and look at any remaining concerns.

Could you please run this FRST script next.
As a part of this I have included the The Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
CreateRestorePoint:
CloseProcesses:
File: C:\Users\NCC1701_02.02.24\AppData\LocalLow\aef28520725e2ea3ed157453470b6474f3b9b25cc0cf9e98a9d4135711df3e8d
Folder: C:\Users\NCC1701_02.02.24\AppData\Local\NEO
cmd: type C:\bootTel.dat
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker -> No File <==== ATTENTION
Task: {4C4A5CDD-4131-4C0E-8C5D-DFC0266123EC} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe  --automatic (No File)
S2 Killer Provider Data Helper Service; %SystemRoot%\System32\drivers\Intel\Killer\KillerProviderDataHelperService.exe [X]
S3 WMPNetworkSvc; "%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe" [X]
S3 workfolderssvc; %systemroot%\system32\workfolderssvc.dll [X]
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::

• Click on the Fix button just once and wait.
• If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.

Hi Dennis, Thanks for the quick reply. PC is running a tad "choppy" if that makes sense. It is not connected to internet, perhaps needs updates? Here are the results:

 Fix result of Farbar Recovery Scan Tool (x64) Version: 11.02.2024

Edited by Romy99, 17 February 2024 - 12:23 AM.

Could you please provide some more detail on the uneven running?
Also please clarify if you are able to connect to the internet. If you are then please run Windows Update .
Press the Windows logo key + I combination on your keyboard to open the Settings app.
Click on Update and Security.
Select Windows Update and then click the Check for Updates button.
Please advise if any updates were shown and if they installed ok.
-------------------------------------------------------------------------------------
Then please run the DISM command again, while the computer is online, as follows.

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
CreateRestorePoint:
File: C:\Users\NCC1701_02.02.24\AppData\Local\NEO\neo_compiler_cache\430154302be5ff03.cl_cache
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Reboot:
End::

• Click on the Fix button just once and wait.
• Please make sure you let the system restart normally.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also please advise if the computer is running any better now?

Ok, I've applied the fix and I checked for updates. Everything was up to date. 

Computer seems to be running more smoothly now, before it was freezing in between tasks, or it would click or type with a slight delay. Here are the latest scans after I ran the fix: 

I am pleased to hear that your computer is running better now.
Could you please copy and paste the contents of the Fixlog.txt file, that was created by FRST, after the last fix.
Then please run a full scan with ESET Online Scanner, as an extra check.

• Download ESET Online Scanner from here and save it to your Desktop.
• Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
• Select your desired language from the drop-down menu and click Get started.
• Click Yes if a User Account window appears.
• In the Terms of use screen, click Accept if you agree to the Terms of use.
• Click Get started in the welcome screen.
• Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
• Click Computer scan, in the Welcome back screen.
• Choose Full scan on the next screen.
• Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
• Please note that this process can take several hours to complete.
• At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
• On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
• ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
• You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
• On the next screen, you can leave feedback about the program if you wish.
• There is an option to delete the application's data on closing, but we can but we can do this later.
• If you left feedback, click Submit and Close. If not, click Close.
• Copy and paste the contents of the ESETScan.txt file in your next reply.

 

Please advise if you still need help?
It has been 3 days since my last post.
If you have not replied within the next 48 hours, I will assume that you no longer need help and this topic will be closed.

Sorry - was out of town for a conference. Just got back. Wasn't able to work on my PC since. I will try today or tomorrow and report back, THANK YOU AGAIN SO MUCH FOR ALL THE HELP!!!

No problem.

Thanks for letting me know.

Have you had a chance to do this yet?

Hello, I finally was able to get this done. Sorry for the delay and Thank you again for your help! 

Here are the results :

 

 

ESET Scan did not find any issues:

 

That all looks good and I believe that we are nearly all set now.
Please advise if you have any further questions, before I post some tool/log clean up instructions and information for your future reference.

I think I found the problem of why my PC seems to be lagging and acting almost as if it not had enough memory. 
When I took it to Geek Squad for them to fix it initially, they fixed corrupted files etc and they reinstall windows. Well, they installed the boot drive on my old HDD that I have in here for file instead of the SSD as I had it originally. So now the PC is using my old HDD to boot, load programs and save files.... My SSD is just sitting there seemingly doing nothing. 

 

If you can recommend and easy solution to transfer my bootable drive back to my SSD, that would be appreciated but probably the easiest thing to do at this point is to bring it back to Geek Squad and have them do it. I bought a cheap computer to run just my email and chrome, which is what I need for now. 

 

I ran Farbar one more time just in case: 

 Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26.02.2024 01