Operating System
Windows 10
Infection date and initial symptoms
About a month or two. Unable to install new programs, open task manager or open cmd.
Current issues and symptoms
Still unable to install or run new programs, task manager, cmd prompt. Games already installed run fine. Antivirus all blocked.
System logs
Yes, I've uploaded the FRST.txt logs

Carmbean

New Member
Recently my desktop computer became infected and will not run or install any new programs or anti-virus, the task manager, or the CMD prompt. I was able to run FRST only from a USB in the troubleshooting boot up and have no addition.txt. I am not very computer savvy and do not want to uninstall anything that will cause my computer to fail to boot. Is there some way that I can turn this log into a safe fixlist? Also how can I create an addition.txt from the troubleshoot cmd prompt? (held shift and rebooted) I haven't been able to run FRST any other way.
 

Attachments

TwinHeadedEagle

Moderator
Verified
Staff member
Hello,


Download
Malwarebytes Anti-Rootkit to your desktop.
  • Double-click the icon to start the tool.
  • It will ask you where to extract it, then it will start.
    • If it didn't start, locate mbar folder on your Desktop and double click on mbar.cmd


  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder and paste the content of the following files in your next reply:
    • "mbar-log-{date} (xx-xx-xx).txt"
    • "system-log.txt"
 

Carmbean

New Member
I am unable to install malwarebytes anti-rootkit. When trying to run any installer I get a blue loading circle next to my mouse for about 15-20 minutes and then an error saying that the program timed out and nothing further happens. I tried downloading the installer from another computer and running it from a USB as well.
 

TwinHeadedEagle

Moderator
Verified
Staff member
Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>> Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt on your USB flashdrive.


>> Exit out of Recovery Environment and post me the log please.



Try to boot Windows normally...
 

Attachments

  • Like
Reactions: oldschool

Carmbean

New Member
Windows booted normally. Task manager still fails to open, but CMD prompt is now running! Don't want to try installing a program without instructions however so unsure if that is fixed.
 

Attachments

Carmbean

New Member
Still unable to run programs through desktop mode. Tried using CMD prompt as well and got the error "access is denied". Attaching logs from another run through on troubleshooting mode.
 

Attachments

  • Like
Reactions: oldschool

Carmbean

New Member
I don't know if this information helps but there are 12 folders that have denied access and the computer freezes when I try and open them. None of these programs were downloaded on purpose.

In Program Files:
-AVAST software
-Bitdefender Agent
-Bullguard LTD
-ESET
-MalwareBytes

in Program Files x86:
-360
-AVG
-Avira
-Baidu Security
-Checkpoint
-CT Data
-Panda Security
 

Carmbean

New Member
Precisely. Don't know when they showed up, this is my roommates computer but he doesn't recognise any of the programs.
 

Carmbean

New Member
Any ideas on the next step? I don't mean to be a pester I am just completely lost at this point I've never dealt with a computer this infected that has no antivirus to run
 

TwinHeadedEagle

Moderator
Verified
Staff member
Can you try to change permission on one of those folders to see if that will work?

 

Carmbean

New Member
Nothing I am trying is working. Are you sure nothing can be done with the frst.txt and addition.txt I posted above from safe mode?