Paranoia about potential infection

Hello!

 

A couple of years ago I messed up and went to a phishing link on my Android like a dummy. Since then I have been doing a great job at keeping my phone and computer separate, so as to stop any potential issues spreading to my computer. Well, on the 14th of February I accidentally (like a dummy) plugged my phone into my computer. I did some research, and am freaking out because AutoPlay was enabled. I haven't had any noticeable issues with my computer since then. I went to Microsoft support, and they said that it was possible that malware had spread to my computer. They recommended I come to this website. 

 

I did a full system scan with Microsoft Safety Scanner, and also tried BitDefender, both stating I have no issues.

 

Like mentioned in the title, I just want to be 100% sure that my computer is not infected. I don't really use my phone for much, but I -need- my computer to be clean, for obvious reasons.

 

Here are my two FRST logs: 

 

 

OMG THE SCREEN WASN'T CHANGING WHEN I TRIED TO POST I AM SO SORRY!!!!!!!!! I CAN'T FIGURE OUT HOW TO DELETE IT!

Hi anoplex27,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution, before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Please give me some time to examine your logs and I will get back to you as soon as possible.

Dennis

Hi Dennis!!!

 

So I haven't backed up any data. I don't know how it works; I'm confused. If there is viruses in the data, wouldn't it just re-spread to a clean machine? Is there a process I can take to back up stuff on my external hard drive without including the virus?

 

Thank you for your help!!!!!!!!

We will create restore points during the process, so it is unlikely that anything will be lost.

However if you have any important documents etc. it would be a good idea to back these up anyway, as part of your regular maintenance.

You can always check them with your antivirus, to be sure they are ok.

I'll report back on my findings later.

I have checked your logs and there is some clean-up to be done. Later we will run malware scans, as a double check.
Firstly here are some observations.
1) There appear to be some redundant Webroot SecureAnywhere entries in the Security Center, which will be best removed to avoid conflict. I believe that Webroot was responsible for a number of unusual policy lines remaining, that can also be removed.
2) Please  note that Adobe Shockwave Player is no longer supported and is a security risk.
I therefore suggest that you consider uninstalling.
3) In view of the number of orphan entries, we will reset the firewall to tidy it up and revert to default settings.
As a result you may have to allow some genuine connections again.
-------------------------------------------------------------------------------------------------
Could you please run this FRST script next.
As a part of this I have included the The Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
We will also run the System File Checker, as some errors were recorded in the logs.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
CreateRestorePoint:
CloseProcesses:
2016-04-20 14:31 - 2017-04-19 21:42 - 018102328 _____ (Webroot Software, Inc.) C:\Program Files (x86)\Common Files\wruninstall.exe
AV: Webroot SecureAnywhere (Enabled - Up to date) {EA22F846-E33A-0128-9418-185509C86920}
AV: Webroot SecureAnywhere (Enabled - Up to date) {DF901FA1-F926-253B-C464-B01C79DCAD48}
AS: Webroot SecureAnywhere (Enabled - Up to date) {64F1FE45-DF1C-2AB5-FED4-8B6E025BE7F5}
HKLM\...\Policies\Explorer: [NoViewOnDrive] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKLM\...\Policies\Explorer: [NoShellSearchButton] 0
HKLM\...\Policies\Explorer: [NoFind] 0
HKLM\...\Policies\Explorer: [NoFile] 0
HKLM\...\Policies\Explorer: [HideClock] 0
HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0
HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKLM\...\Policies\Explorer: [NoSetFolders] 0
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoLogoff] 0
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoSaveSettings] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-3830546042-808051129-609537927-1002\...\Policies\Explorer: [NoStartMenuSubFolders] 0
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\MRT: Restriction <==== ATTENTION
HKU\S-1-5-21-3830546042-808051129-609537927-1002\Software\Classes\exefile: "%1" %* <==== ATTENTION
HKU\S-1-5-21-3830546042-808051129-609537927-1002\Software\Classes\.exe: exefile => "%1" %* <==== ATTENTION
Task: {158CCDEC-D19B-4717-9A31-87EC839C204F} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem124.0.6315.0{03EFD1B2-FC83-4F91-A217-AFED7DC8C2AF} => C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-21] (Google LLC -> Google LLC) <==== ATTENTION
S2 GoogleUpdaterInternalService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-21] (Google LLC -> Google LLC) <==== ATTENTION
S2 GoogleUpdaterService124.0.6315.0; C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0\updater.exe [4698400 2024-02-21] (Google LLC -> Google LLC) <==== ATTENTION
C:\Program Files (x86)\Google\GoogleUpdater\124.0.6315.0
FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender Security App\bdtbext [2024-01-30] [Legacy] [not signed]
FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [Legacy] [not signed]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1225195.dll [2016-09-20] (Adobe Systems, Inc.) [File not signed]
CHR HKLM-x32\...\Chrome\Extension: [dofoafnmdocgkdphpkdooahjkhpmakjd]
2024-02-16 00:03 - 2018-01-02 01:55 - 000000000 ____D C:\Program Files (x86)\Smart File Advisor
AlternateDataStreams: C:\Users\letho\Downloads\EpicInstaller-15.17.1.msi:MBAM.Zone.Identifier [191]
AlternateDataStreams: C:\Users\letho\Downloads\lghub_installer.exe:MBAM.Zone.Identifier [154]
AlternateDataStreams: C:\Users\Public\AppData:CSM [472]
SearchScopes: HKU\S-1-5-21-3830546042-808051129-609537927-1002 -> {A343ADB0-308D-43B3-B9C4-4D4BBF60CE85} URL = hxxps://search.yahoo.com/search?p={searchTerms}&intl=us&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
Task: {a61ebcaf-6d02-4dca-98a7-a3a7afa6a858} - no filepath. <==== ATTENTION
Task: {CB70AE50-E2F4-4983-B969-F36A769F30D5} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {B9FCEBDD-7F90-4E83-8A55-C5601DB73B45} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe  (No File)
Task: {FC583D07-7344-465C-89EA-724CA8389E60} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe  /send (No File)
Task: {B9D9F895-C2CA-42C4-BBDE-C0AACB77C5F7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe  /f (No File)
Task: {2E6EBB3E-4B4D-4D59-A975-5C66A64ACDE3} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe  do-task "E7CF176E110C211B" (No File)
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{46406D82-6EC0-47CC-8A75-1F33C6DEDBBE}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.35.442\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{540C17A8-04F2-4B66-95D7-B2FEF9A19B54}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.35.422\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{62634D95-960B-4834-8E71-A70408AD8FD9}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.34.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{84EB3779-151B-4C71-AEF0-A0FEE9481401}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.35.342\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{86508D42-E5D7-4D10-9C6F-D427AEEB85B5}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.34.11\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{91A41FCC-BC02-42D8-A36E-0D27FF9BFFC8}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.33.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{A804CF1A-91E5-4F0C-9E8C-DB39E74056DD}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.33.23\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> "C:\Users\letho\AppData\Local\Microsoft\Teams\current\Teams.exe" --toast => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{E9E7529D-7F09-410B-AF2A-CC154473B19C}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.35.452\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{EA724FD3-844D-43A9-A8C9-A5BC35FC20E4}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.33.17\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3830546042-808051129-609537927-1002_Classes\CLSID\{EF076C91-DC9E-43E3-84ED-3D219E065A4F}\InprocServer32 -> C:\Users\letho\AppData\Local\Google\Update\1.3.35.302\psuser_64.dll => No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} =>  -> No File
S3 EasyAntiCheat; "C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe" [X]
S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [X]
S2 HPSupportSolutionsFrameworkService; "C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe" [X]
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [X]
U3 aswbdisk; no ImagePath
S4 nvvhci; \SystemRoot\System32\drivers\nvvhci.sys [X]
cmd: netsh winsock reset catalog
cmd: netsh int ip reset C:\resettcpip.txt
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: Bitsadmin /Reset /Allusers
cmd: ipconfig /flushdns
Removeproxy:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::

• Click on the Fix button just once and wait.
• If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.

 

Alright sounds good! I have a separate external hard drive that I use to store important stuff on. I don't know if the stuff is infected though. But like you said we can just scan it later.

 

I have uninstalled Adobe Shockwave Player.

 

My computer seems to be running fine!

 

Here is the log:

 

You are very welcome.
That all looks good.
Let's now run a couple of scans as extra checks. The first with AdwCleaner is very quick, but ESET can take a fair while to complete.
Please download AdwCleaner.

• Close all open programs and browsers
• Right click on the icon and select Run as administrator
• Click Scan Now
• When the scan has finished AdwCleaner shows you all detected PUPs and adware.
• If any are found, select them and click Quarantine. (I would suggest that you do not select Pre-installed applications for now, or any other items you wish to keep.)
• AdwCleaner prompts you to save and close your work before continuing. Click Continue.
• After cleaning, you are prompted to restart your device. Click Restart now to complete the cleanup process.

Once your computer has restarted ...

•     If it doesn't open automatically, please start AdwCleaner.
•     Click on View Log File button (This log can also be found in the Log Files tab).
•     A Notepad file will open containing the results.
•     Click Skip Basic Repair (if the option appears)
•     Please post the contents of the file in your next reply.

-------------------------------------------------------------------------

• Download ESET Online Scanner from here and save it to your Desktop.
• Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
• Select your desired language from the drop-down menu and click Get started.
• Click Yes if a User Account window appears.
• In the Terms of use screen, click Accept if you agree to the Terms of use.
• Click Get started in the welcome screen.
• Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
• Click Computer scan, in the Welcome back screen.
• Choose Full scan on the next screen.
• Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
• Please note that this process can take several hours to complete.
• At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
• On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
• ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
• You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
• On the next screen, you can leave feedback about the program if you wish.
• There is an option to delete the application's data on closing, but we can but we can do this later.
• If you left feedback, click Submit and Close. If not, click Close.
• Copy and paste the contents of the ESETScan.txt file in your next reply.

Dennis, the ESET Scan took a while! Here are my two!

 

The tools did the remaining clean-up for us, so we should be nearly all set now.
Please advise if you have any further questions, before I post some tool/log clean up instructions and information for your future reference.

Dennis,

 

I am troubled by this Windows Defender section of the FRST log, it found a severe virus that hasn't been found by these scans we performed, at least to my limited knowledge. I just went to find its location, and it isn't there, so is that something that we got rid of somehow?

 

Also, is Windows Defender now going to be working correctly?

 

Edited by anoplex27, 02 March 2024 - 02:45 AM.

Windows Defender should have quarantined the file, but I also removed the "C:\Program Files (x86)\Smart File Advisor" folder in the FRST fix, just to be sure.
WD was shown as "Disabled - Up to date" , in the FRST log and "Bitdefender Antivirus (Enabled - Up to date)"
We can double check Windows Defender's current status by running this FRST script.

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
Powershell: Get-MpComputerStatus
End::

• Click on the Fix button just once and wait.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.

Edited by dennis_l, 02 March 2024 - 08:41 AM.

Dennis,

 

Here is the Fixlog.