MIL's Windows 10 Lenovo

Working on my mother-in-law's Windows 10 laptop and she tells me she was browsing geneology websites and a Windows alert popped up saying her 'ip address was stolen' or otherwise compromised. Attempting to scan with aswMBR caused Windows to crash and restart (BSOD) twice, so I don't have a log for that tool. Below are the Farber scans:

Hi Juliet,

Thank you for this. Please note, I have not restarted the router because the machine is on the wi-fi at our home - a different location from where the problem was first experienced.

Steps taken:

1. Farber Fix with Script
2. Deleted a bunch of Chrome extensions I didn't recongnize
3. AdwCleaner Clean & Repair
4. Rogue Killer Scan and Remove Selected

Logs:

Fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version: 01.03.2019
Ran by [removed] (03-03-2019 11:45:38) Run:1
Running from C:\Users\[removed]\Desktop\malware
[removed]
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-21-376875994-652332962-2549592875-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com
SearchScopes: HKU\S-1-5-21-376875994-652332962-2549592875-1001 -> DefaultScope {8EABC879-30E0-4056-9218-0C9A0F547076} URL =
SearchScopes: HKU\S-1-5-21-376875994-652332962-2549592875-1001 -> {8EABC879-30E0-4056-9218-0C9A0F547076} URL =
BHO: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar64.dll => No File
BHO-x32: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar.dll => No File
Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll No File
Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll No File
CHR NewTab: Profile 1 -> Not-active:"chrome-extension://objfoicfgjgjfakppndfbbojnkepdjda/newtab/index.html", Active:"chrome-extension://edekcajjadmmopanlboipbaklofinhnb/web_page_home.html", Not-active:"chrome-extension://feailhokcofhemellplnfeclaobeifbe/web_page_home.html", Not-active:"chrome-extension://kcnahncmjobdbpabldpbldbfcieeoloj/newtabproduct.html", Not-active:"chrome-extension://llhncbhopcadbofiicpbjfpmkelpdmdm/newtab/emailtab.html", Active:"chrome-extension://ceopoaldcnmhechacafgagdkklcogkgd/newtabproduct.html"
CHR HKLM-x32\…\Chrome\Extension: [ngkhgikojglcgnckopipfdajaifmmnnc] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [okfhiodnpcnnnpgbjbhfebjnbagmfhab] - C:\ProgramData\WRData\pkg\lpchrome.crx 

AdwCleaner[S00]

# ——————————-
# Malwarebytes AdwCleaner 7.2.7.0
# ——————————-
# Build:    01-30-2019
# Database: 2019-02-28.3 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# ——————————-
# Mode: Scan
# ——————————-
# Start:    03-03-2019
# Duration: 00:00:31
# OS:       Windows 10 Home
# Scanned:  31852
# Detected: 16


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Legacy             C:\Users\Myrick\AppData\Local\Downloaded Installers
PUP.Optional.Legacy             C:\Users\Public\Documents\Downloaded Installers
PUP.Optional.SlimCleanerPlus    C:\Program Files\SlimService
PUP.Optional.SlimCleanerPlus    C:\Users\Myrick\AppData\Local\slimware utilities inc

***** [ Files ] *****

PUP.Optional.DriverUpdate       C:\Users\Myrick\Downloads\DRIVERUPDATE-SETUP.EXE
PUP.Optional.Legacy             C:\Windows\System32\drivers\swdumon.sys

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Adware.Heuristic            C:\Windows\Tasks\SLIMCLEANER PLUS (SCHEDULED SCAN - MYRICK).JOB
PUP.Adware.Heuristic            C:\Windows\System32\Tasks\SLIMCLEANER PLUS (SCHEDULED SCAN - MYRICK)

***** [ Registry ] *****

PUP.Adware.Heuristic            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A5A34309-CA1B-424E-A014-830374ADC2B8}
PUP.Adware.Heuristic            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A5A34309-CA1B-424E-A014-830374ADC2B8}
PUP.Adware.Heuristic            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SlimCleaner Plus (Scheduled Scan - Myrick)
PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|SlimCleaner Plus
PUP.Optional.Legacy             HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8C2A08C5-FE74-412B-9160-B008E6D3A4C1}
PUP.Optional.SlimCleanerPlus    HKLM\Software\Wow6432Node\SLIMWARE UTILITIES, INC.
PUP.Optional.SlimCleanerPlus    HKCU\Software\SlimWare Utilities Inc
PUP.Optional.SlimCleanerPlus    HKLM\Software\Wow6432Node\SlimWare Utilities Inc

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

AdwCleaner[C00]

# ——————————-
# Malwarebytes AdwCleaner 7.2.7.0
# ——————————-
# Build:    01-30-2019
# Database: 2019-02-28.3 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# ——————————-
# Mode: Clean
# ——————————-
# Start:    03-03-2019
# Duration: 00:00:08
# OS:       Windows 10 Home
# Cleaned:  16
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\Users\Myrick\AppData\Local\Downloaded Installers
Deleted       C:\Users\Public\Documents\Downloaded Installers
Deleted       C:\Program Files\SlimService
Deleted       C:\Users\Myrick\AppData\Local\slimware utilities inc

***** [ Files ] *****

Deleted       C:\Users\Myrick\Downloads\DRIVERUPDATE-SETUP.EXE
Deleted       C:\Windows\System32\drivers\swdumon.sys

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted       C:\Windows\Tasks\SLIMCLEANER PLUS (SCHEDULED SCAN - MYRICK).JOB
Deleted       C:\Windows\System32\Tasks\SLIMCLEANER PLUS (SCHEDULED SCAN - MYRICK)

***** [ Registry ] *****

Deleted       HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A5A34309-CA1B-424E-A014-830374ADC2B8}
Deleted       HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A5A34309-CA1B-424E-A014-830374ADC2B8}
Deleted       HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SlimCleaner Plus (Scheduled Scan - Myrick)
Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|SlimCleaner Plus
Deleted       HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8C2A08C5-FE74-412B-9160-B008E6D3A4C1}
Deleted       HKLM\Software\Wow6432Node\SLIMWARE UTILITIES, INC.
Deleted       HKCU\Software\SlimWare Utilities Inc
Deleted       HKLM\Software\Wow6432Node\SlimWare Utilities Inc

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2733 octets] - [03/03/2019 12:06:23]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

RogueKiller as_CC99.tmp

RogueKiller Anti-Malware V13.1.6.0 (x64) [Feb 25 2019] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 10 (10.0.15063) 64 bits
Started in : Normal mode
User : Myrick [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Signatures : 20190204_072850, Driver : Loaded
Mode : Standard Scan, Delete – Date : 2019/03/03 12:36:24 (Duration : 00:17:31)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUP.Slimware (Potentially Malicious)] SWDUMon – %SystemRoot%\system32\DRIVERS\SWDUMon.sys -> Stopped
[PUP.Slimware (Potentially Malicious)] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SWDUMon – [%SystemRoot%\system32\DRIVERS\SWDUMon.sys] -> Deleted
[Tr.Gen0 (Malicious)] a.txt – %localappdata%\Temp\a.txt -> Deleted
[PUM.HomePage (Potentially Malicious)] homepage – http://www.google.com/ -> Deleted
[PUM.HomePage (Potentially Malicious)] session.startup_urls – https://www.google.com/ -> Deleted

Thank you again,

David

Hi Juliet,

I'll be sure to let her know how to reboot the router when I hand this back to her. Thank you again for your help with this.

Here is the latest set of logs:

malwarebytes_scan_log

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/4/19
Scan Time: 5:29 AM
Log File: 6b01b1f0-3e68-11e9-beec-54ee754ced30.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.538
Update Package Version: 1.0.9530
License: Trial

-System Information-
OS: Windows 10 (Build 15063.674)
CPU: x64
File System: NTFS
User: Lenovo-PCMyrick\Myrick

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 292174
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 3 min, 17 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Forensics_190304-055511

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]
OS: Windows 10 (Version 10.0, Build 15063, 64-bit Edition)

Forensics log

Date	Component	Action	Details	
3/4/2019 5:53:42 AM	User LENOVO-PCMYRICK\MYRICK	Infection quarantined	High risk Malware "JS:Trojan.Cryxos.1726 (B)" in "This computer is BLOCKED.html".	
3/4/2019 5:52:35 AM	Scanner	Scan finished	Found 1 object , user to decide on further actions.	
3/4/2019 5:49:58 AM	Scanner	Detection	High risk Malware "JS:Trojan.Cryxos.1726 (B)" in "This computer is BLOCKED.html -> (INFECTED_JS)"	
3/4/2019 5:46:49 AM	User LENOVO-PCMYRICK\Myrick	Scan started	Malware Scan	
3/4/2019 5:46:30 AM	User LENOVO-PCMYRICK\Myrick	Setting modified	"Detect PUPs" has been changed to "Enabled".	
3/4/2019 5:45:59 AM	User	Update	Finished successfully, all files are up-to-date (30 sec.).	
3/4/2019 5:44:40 AM	User LENOVO-PCMYRICK\Myrick	Setting modified	"Recommended readings & news" has been changed to "Enabled".	
3/4/2019 5:44:40 AM	User	Update	Downloaded and installed 42 files (12409 kb) (33 sec.).	
3/4/2019 5:44:17 AM	User LENOVO-PCMYRICK\Myrick	Setting modified	"Recommended readings & news" has been changed to "Disabled".	
3/4/2019 5:44:08 AM	Core	Notification	"Recommended Reading:What is the difference between phishing, spear phishing and whaling attacks?".	
3/4/2019 5:44:04 AM	User	Update	Failed with error "Server returned error" (1 sec.).