What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help! Husband's computer keeps crashing after getting Kovter

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

I'm working as quickly as I can because my husband's computer will suddenly freeze (no internet, no mouse).  Absolutely cannot enable his Windows Defender.  He has Malwarebytes and it did detect Kovter.  It was quarantined and then deleted.  But after that, his computer has been a mess!  Please help if you can!

 

📎aswMBR.txt

 

📎FRST.txt

 

📎Addition.txt

 

I hope I am able to send this before the computer crashes.  I am working in Safe Mode with networking.  Thank you in advance.  You have helped me several times in the past! 

 

Post #2
I'm going to jump in here and try to help but I have no idea why his computer is crashing.

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:

SearchScopes: HKLM -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CustomCLSID: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Drew\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\amd64\FileCoAuthLib64.dll => No File
CustomCLSID: HKU\S-1-5-21-90104672-2584935845-2132657902-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Drew\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\amd64\FileCoAuthLib64.dll => No File
Task: {AC455FEC-78F3-4A78-AAAC-70D4A5C0D11E} - \Microsoft\Windows\Setup\EOSNotify -> No File <==== ATTENTION
Emptytemp:
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.



******

[external image: zcMPezJ.png]AdwCleaner
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
    🖼Click to load external image (V7SD4El.png)
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    [external image: RQKuhw1.png]RogueKiller
    • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
    • Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
    • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
    • Wait for the scan to complete
    • On completion, the results will be displayed
    • Check every single entry (threat found), and click on the Remove Selected button
    • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
    • This will open the report in Notepad. Copy/paste its content in your next reply

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
  • created by Arua

    Please post:
    Fixlog.txt
    RogueKiller log
    AdwCleaner log
Post #3

Hi,

Here are the scans you requested.  I had to do the ADWcleaner in safe mode with networking.  I had to download the Rogue Killer on my computer, transfer it to a thumb drive and then transfer the exe file to my husband's computer.  Based on the fact that I have been able to get onto this website, copy and paste the 3 logs and am still typing, THAT is a VERY GOOD SIGN.  My husband's Malwarebytes Premium will not turn on Real-Time Protection.  I am going to send this and then check it.  I'm still afraid this computer will crash….  Please advise.  Thanks!

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 17.01.2018 01
Ran by [removed] (19-01-2018 14:39:00) Run:1
Running from C:\Users\[removed]\Downloads
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKLM -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Toolbar: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CustomCLSID: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Drew\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\amd64\FileCoAuthLib64.dll => No File
CustomCLSID: HKU\S-1-5-21-90104672-2584935845-2132657902-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Drew\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\amd64\FileCoAuthLib64.dll => No File
Task: {AC455FEC-78F3-4A78-AAAC-70D4A5C0D11E} - \Microsoft\Windows\Setup\EOSNotify -> No File <==== ATTENTION
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8E518829-DFD6-458C-BFE5-5B3D899C4FB0}" => removed successfully
HKLM\Software\Classes\CLSID\{8E518829-DFD6-458C-BFE5-5B3D899C4FB0} => key not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0}" => not found
"HKLM\Software\Wow6432Node\Classes\CLSID\{8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0}" => not found
SearchScopes: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> {8E518829-DFD6-458C-BFE5-5B3D899C4FB0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => removed successfully
HKLM\Software\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found
Toolbar: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File => Error: No automatic fix found for this entry.
CustomCLSID: HKU\S-1-5-21-90104672-2584935845-2132657902-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01172018191257344_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Drew\AppData\Local\Microsoft\OneDrive\17.3.6998.0830\amd64\FileCoAuthLib64.dll => No File => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-90104672-2584935845-2132657902-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AC455FEC-78F3-4A78-AAAC-70D4A5C0D11E} => could not remove key. ErrorCode1: 0x00000002
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC455FEC-78F3-4A78-AAAC-70D4A5C0D11E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\EOSNotify" => removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 12582912 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14482276 B
Java, Flash, Steam htmlcache => 388653 B
Windows/system/drivers => 239043528 B
Edge => 0 B
Chrome => 584702888 B
Firefox => 397483739 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 2544586 B
NetworkService => 1935640 B
Drew => 501391653 B

RecycleBin => 0 B
EmptyTemp: => 1.6 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 14:42:23 ====

# AdwCleaner 7.0.7.0 - Logfile created on Fri Jan 19 20:10:52 2018
# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 8.1 (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\ProgramData\Viewpoint
Deleted: C:\ProgramData\Application Data\Viewpoint
Deleted: C:\Program Files (x86)\Viewpoint
Deleted: C:\Users\All Users\Viewpoint

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKLM\SOFTWARE\MetaStream
Deleted: [Key] - HKLM\SOFTWARE\Viewpoint
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Deleted: [Key] - HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Deleted: [Key] - HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com\VMP

***** [ Firefox (and derivatives) ] *****

Plugin deleted: Honey - Honey Science Corporation

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

 

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1625 B] - [2018/1/19 20:9:56]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Safe mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 01/19/2018 15:51:28 (Duration : 00:21:06)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 5 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F8220B0D-7904-4EBC-83A5-9A02C1417863} : v2.20|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe|Name=Microsoft SkyDrive| [x] -> Deleted

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

¤¤¤ Web browsers : 2 ¤¤¤
[PUP.Gen2][Firefox:Addon] w10tln2v.default : Honey [jid1-93CWPmRbVPjRQA@jetpack] -> Deleted
[PUM.HomePage][Firefox:Config] w10tln2v.default : user_pref("browser.startup.homepage", "http://www.foxnews.com/|http://www.google.com/");-> Replaced (about:home)

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

Post #4
Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 6 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.
Don't close the tool or delete it, leave it open and running.
  • rkill.exe
  • rkill.com
  • rkill.scr
  • rkill.pif
  • WiNlOgOn.exe
  • uSeRiNiT.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

Follow the instructions in the thread below. Make sure to download the MBAR version linked in it. Let me know if you're not able to launch it and run a scan.
This is a rootkit scan.

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes/

Run the scan, delete everything it finds, and then copy/paste the content of the mbar-log-DATE-(TIME).txt log that is located in the MBAR folder here after.
Post #7 last edited

Hi!  Sorry for the delay in responding. My 93 year old mother is in the hospital now with the flu (and doing much better thankfully)!  Anyway, I started off trying to run everything in Normal mode and the computer froze.  So went into Safe Mode with Networking and did the rkill.exe.  Then tried downloading the MBAR rootkit scan and computer froze again.  So I downloaded the exe file on my computer, transferred to a thumb drive and rebooted my husband's computer into Safe Mode with Networking (so I would be able to update).  This time was successful in running the scan which oddly found nothing.  Then rebooted to Normal mode and ran rkill.exe and the MBAR rootkit scan again.  This time it worked and again found nothing.  But I started to realize 1) the computer did not freeze and crash and 2) Malwarebytes was longer sending a little pop up saying the computer was not defended in Real Time!  AND here I am typing away and no freezing, no blue screen of death!  I ran a Malwarebytes scan and it completed successfully and again, found nothing.  How in the world could this be fixed without the scans finding anything??  Crazy but I'll take it!  lol  Here are 2 logs (the first was the scan done in Safe Mode with Networking and the second is the scan done in Normal mode).  Am very interested in hearing what you think!  I am cautiously optimistic!  My husband will be thrilled when he gets home from work!  Thank you ever so much!!  :notworthy:

 

Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.01.23.10
  rootkit: v2018.01.23.01

Windows 8.1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 11.0.9600.18894
Drew :: DREW-PC [administrator]

1/23/2018 2:49:29 PM
mbar-log-2018-01-23 (14-49-29).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 193472
Time elapsed: 8 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

 

Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.01.23.10
  rootkit: v2018.01.23.01

Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.18894
Drew :: DREW-PC [administrator]

1/23/2018 3:02:26 PM
mbar-log-2018-01-23 (15-02-26).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 194584
Time elapsed: 9 minute(s), 55 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

Post #8

Well, I spoke too soon.  Things are NOT fixed.  For a while, things were definitely running way better and Malwarebytes Real-Time Protection was enabled.  Then the computer froze again.  And now the little Malwarebytes pop up box is back saying Real-Time Protection is turned off.  I cannot understand this.  If I reboot to Safe Mode without Networking, the computer works all day long, never freezes.  When in Safe Mode with Networking, it will work for much longer periods of time than when normally booted up.  If I just start the computer normally, it will work for variable lengths of time but the first thing that happens is usually the mouse stops functioning, then the internet stops functioning (the symbol in lower right task bar shows no internet), then eventually the computer shows the blue screen of death saying the computer ran into a problem and had to restart with the :( symbol.  It also says DPC_WATCHDOG_VIOLATION.  I'm going to send this before this all happens to me.   FYI, we have a router and an extender, either of which can be accessed to connect to internet.  Either one works just fine on my computer which is directly upstairs from my husband's computer.  I am very curious about what could possibly be going on here.  Also very frustrated.  Anxiously awaiting your thoughts…. :wall:

Post #9
My opinion, your about to get hit with hardware issues, I don't think this is malware related.
I think the key word is DPC_WATCHDOG_VIOLATION

I went online looking into this and your not alone. Unfortunately this is not an area where I can help.

Let me get you over to our tech guys and see if they can pin point a/the problems here.
If you will, please start a new topic here
https://forums.whatthetech.com/index.php?showforum=119

you can copy and paste the link to this one we have here to see if it might help.
Post #10 last edited

Hi again Juliet,

Paws, one of the tech guys at the Microsoft forum you recommended to me (above), suggested that I copy and paste the Rogue Killer logs (that I recently posted on his forum) here.  This is kind of a long story so let me try to recap as briefly as possible.  Problem:  computer mouse stops working after several minutes in Normal mode, followed a few minutes later by blue screen of death saying computer has a problem and needs to restart.  Other symptoms:  Malwarebytes Premium Real-Time Protection cannot be enabled.  This all started after two things which happened in the same relative time period:

1)  Windows Update; and 2)  Malwarebytes identified a trojan virus (Kovter) which was quarantined and deleted.  I performed all scans, etc as advised by you above.  Problem persisted.  You advised that it may be a hardware issue and referred me to your tech guys (which I did).  Now I have managed to isolate the culprit.  It is WLAN Autoconfig.  Makes sense.  The computer works all day long in safe mode (with no internet).  It works for a time in Safe Mode with Networking but then the same problems occur.  When I disabled WLAN Autoconfig, the computer worked all day long without freezing (but no internet, of course.)  The reason I am posting here again is because I ran Rogue Killer 4 separate times yesterday while trying to isolate the culprit in a clean boot.  Each time, Rogue Killer identified 2 malware items but I am not sure if they were the same 2 items each time.  I quarantined and deleted them each time.   I will now copy and paste the 4 Rogue Killer scans for you to take a look at, as recommended by "paws"….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.co…ad/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Safe mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 14:28:05 (Duration : 00:19:18)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

 

Next log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.co…ad/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 15:41:50 (Duration : 00:18:49)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1:  +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

 

Third Scan Log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.co…ad/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 16:07:16 (Duration : 00:19:10)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/-> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/-> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1:  +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

 

Last scan log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.co…ad/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 16:44:31 (Duration : 00:20:28)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK

Error reading LL2 MBR! ([32] The request is not supported. )

Post #11

OK
let's try to cover a few things

What you see found in the Roguekiller logs are actually OK, it's posting what was found to be your settings and at this time it's just re-settting those.
~~
WLAN Autoconfig, honestly you should be able to get on the internet and stay on the internet with this enabled.

Start > Run > Type in services.msc > Hit the Enter key.

Now check these services are up and running:

• COM+ Event System
• Computer Browser
• DHCP Client
• DNS Client
• Network Connections
• Network Location Awareness
• Remote Procedure Call (RPC)
• Server
• TCP/IP Netbios helper
• WLAN
• Workstation
if not running try to enable then reboot.

~~~
Start > Run >command
Type the following commands bolded below one at a time into your command prompt, hit "enter" after each one, run as admin then restart the machine.

netsh winsock reset catalog <=(reset winsock entries)
netsh int ip reset reset.log hit <=(reset TCP/IP stack)

reboot

 

~~~

https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

Please follow the above link on how to run sfc /scannow

 

~~~~

 

For MalwareBytes

Is this for the Premium version or for the free version that the trail has run out?

 

If it's for the paid for version and it's not working correctly,  you'll have to register and create a topic

https://forums.malwarebytes.com/forum/41-malwarebytes-3/

Post #12 last edited

Hi Juliet,

I tried to "refresh" the computer as advised by paws.  Was unable to do it.  Each time I tried, the hp Recovery Manager box popped up with the only real option of restoring the computer to factory settings.  I x'ed out of that twice and rebooted.  Tried to refresh.  Same thing happened.  So I got sick of it and went for the restore to factory settings (I did a full system restore weeks ago when this all started).  So now the computer works fine.  I downloaded Rogue Killer from your link above and this time got 6 items detected, one of which I think might be bad (rootkit in Windows Defender??)  I will post the log in 2 minutes if I can get my husband off his computer.  lol  I still feel like there is/was malware involved in all this.  So I would like to do a complete cleaning of his computer under your guidance please.  Rogue Killer log to follow….  PS  We have Malwarebytes Premium.  I downloaded that and reactivated license.  Ran a scan which came up clean…

 

RogueKiller V12.12.3.0 (x64) [Feb  5 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete – Date : 02/11/2018 13:06:39 (Duration : 00:14:27)

¤¤¤ Processes : 1 ¤¤¤
[Root.Wajam|Adw.Elex] MsMpEng.exe(5156) – C:\Program Files\Windows Defender\MsMpEng.exe[7] -> Killed [TermThr]

¤¤¤ Registry : 5 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2665773615-1849995911-3838813670-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2665773615-1849995911-3838813670-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([])  -> Replaced ()
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {F8220B0D-7904-4EBC-83A5-9A02C1417863} : v2.20|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe|Name=Microsoft SkyDrive| [x] -> Deleted

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][Firefox:Config] lxwkd7ra.default : user_pref("browser.startup.homepage", "www.foxnews.com"); -> Replaced (about:home)

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

Post #13
Let's reset browsers for security

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.Proceed with the reset once done.
  • Internet Explorer: How to reset Internet Explorer settings
  • Firefox: Reset Firefox
  • Chrome: Chrome - Reset browser settings
~~~~~~~~~~~~

What was found inside Windows Defender might be a false positive.

Let's run a quick scan with AdwCleaner

[external image: zcMPezJ.png]AdwCleaner
  • Download AdwCleaner and move it to your Desktop
  • Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI