Solved Microsoft Certified Technicians... computer will reboot after 10 mins

[EMSmith]

Hello,

I'm hoping, please, that you can help me. The pc was infected by a virus stating that we needed to call a number to get it resolved. The person using the pc at the time was working with Verizon, who told him to call the number. The person asked for several hundred dollars to resolve his problem. Needless to say, the pc was hacked. He did get suspicious and hang up and disconnect the pc, but it was too late. The original error is attached. To resolve it, I ran Malwarebytes, Adware, Tsskill, Rkill, Zemana, and Emsisoft. While they found some files, none were highly suspicious. The suspicious files were either removed or quarantined. The machine does reboot after 10 minutes, and after doing it so many times, it now has chkdsk errors. It also doesn't reliably go into the user profile (one of two on the pc) unless I am in safe mode. I am now desperate.

Thank you!!!

 

[TwinHeadedEagle]

Hello,


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
  
  
  
  
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[EMSmith]

Hi,

Will do, thank you! Will it run in safe mode?

 

[EMSmith]

Hi,

I ran it in safe mode. The files are attached. I did see a difference running one of the utilities in safe mode vs native Win 7, but I couldn't get there now.

THANK YOU so much!

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.



Please reboot to normal mode and let me know if it is fixed.

 

[EMSmith]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.



Please reboot to normal mode and let me know if it is fixed.

Hi!

You are AMAZING!!!!

I did run it, the log is attached. Right now, so far so good! I can't believe it. Defender was off when I rebooted it, which is odd, because I turned it on again yesterday. Wow!!! I will keep you posted if anything changes, but I am sooo grateful! What was it ultimately, please?

THANK YOU!!!

 

[TwinHeadedEagle]

It was an malicious executable in your Startup folder, starting this rogue application.

 

[EMSmith]

Thank you so much! I did check startup but couldn't find it. At this point, it ran for 4 hours, then locked up during a Defender complete scan. Hard reboot, left it running again, locked up again. It is definitely giving me access to the user profile and apps, it just dies after a few hours. If you have any other ideas, I would be very appreciative. You really are amazing.

 

[TwinHeadedEagle]

Why would you do complete scan? That is time intensive and in 99% of cases isn't finding anything.

Please run FRST one more time and generate both Scan reports.

 

[EMSmith]

The machine runs for a few hours and then hangs, requiring a hard boot. It didn't do this prior to being infected. I did find a problem with the prefetch files, and resolved it. I thought a complete scan might help. You are right it didn't find anything. Same problem. I've attached the files. Thank you again!

 

[TwinHeadedEagle]

Let's try this:

Check Disk

• Press the
  
  on your keyboard. Type cmd and right click >> Run as Administrator.
• Copy/Enter the command below and press Enter:

• chkdsk C: /r

• You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
• All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.

Check Disk report:

• Press the
  
  + R on your keyboard at the same time. Type eventvwr and click OK.
• In the left panel, expand Windows Logs and then click on Application.
• Now, on the right side, click on Filter Current Log.
• Under Event Sources, check only Wininit and click OK.
• Now you'll be presented with one or multiple Wininit logs.
• Click on an entry corresponding to the date and time of the disk check.
• On the top main menu, click Action > Copy > Copy Details as Text.
• Paste the contents into your next reply.

 

[EMSmith]

Let's try this:

Check Disk

• Press the
  
  on your keyboard. Type cmd and right click >> Run as Administrator.
• Copy/Enter the command below and press Enter:

• chkdsk C: /r

• You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
• All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.

Check Disk report:

• Press the
  
  + R on your keyboard at the same time. Type eventvwr and click OK.
• In the left panel, expand Windows Logs and then click on Application.
• Now, on the right side, click on Filter Current Log.
• Under Event Sources, check only Wininit and click OK.
• Now you'll be presented with one or multiple Wininit logs.
• Click on an entry corresponding to the date and time of the disk check.
• On the top main menu, click Action > Copy > Copy Details as Text.
• Paste the contents into your next reply.

Good Morning,

Thanks again! Here's the text.


Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 5/14/2017 9:09:01 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: PAUL-PC
Description:


Checking file system on C:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
347136 file records processed.

File verification completed.
834 large file records processed.

0 bad file records processed.

2 EA records processed.

60 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
396500 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
347136 file SDs/SIDs processed.

Cleaning up 44 unused index entries from index $SII of file 0x9.
Cleaning up 44 unused index entries from index $SDH of file 0x9.
Cleaning up 44 unused security descriptors.
Security descriptor verification completed.
24683 data files processed.

CHKDSK is verifying Usn Journal...
36626112 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

488383999 KB total disk space.
107857500 KB in 194000 files.
108948 KB in 24684 indexes.
0 KB in bad sectors.
404255 KB in use by the system.
4096 KB occupied by the log file.
380013296 KB available on disk.

4096 bytes in each allocation unit.
122095999 total allocation units on disk.
95003324 allocation units available on disk.

Internal Info:
00 4c 05 00 47 56 03 00 c1 ff 05 00 00 00 00 00 .L..GV..........
54 05 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 T...<...........
0d 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2017-05-14T13:09:01.000000000Z" />
<EventRecordID>208933</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>PAUL-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
347136 file records processed.

File verification completed.
834 large file records processed.

0 bad file records processed.

2 EA records processed.

60 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...
396500 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...
347136 file SDs/SIDs processed.

Cleaning up 44 unused index entries from index $SII of file 0x9.
Cleaning up 44 unused index entries from index $SDH of file 0x9.
Cleaning up 44 unused security descriptors.
Security descriptor verification completed.
24683 data files processed.

CHKDSK is verifying Usn Journal...
36626112 USN bytes processed.

Usn Journal verification completed.
Windows has checked the file system and found no problems.

488383999 KB total disk space.
107857500 KB in 194000 files.
108948 KB in 24684 indexes.
0 KB in bad sectors.
404255 KB in use by the system.
4096 KB occupied by the log file.
380013296 KB available on disk.

4096 bytes in each allocation unit.
122095999 total allocation units on disk.
95003324 allocation units available on disk.

Internal Info:
00 4c 05 00 47 56 03 00 c1 ff 05 00 00 00 00 00 .L..GV..........
54 05 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 T...&lt;...........
0d 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

 

[EMSmith]

By the way, that was the second Chkdsk today. It had locked up overnight and the system ran one this morning. THANK YOU!

 

[TwinHeadedEagle]

It seems that you have some hardware problem:

Error: (05/13/2017 02:24:23 PM) (Source: iaStor) (EventID: 9) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Error: (05/13/2017 02:23:03 PM) (Source: iaStor) (EventID: 9) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

Usually this message is being posted due to hardware problems with either the controller or, more likely, a device that is attached to the controller in question. The hardware problems can be associated with poor cabling, incorrect termination or transfer rate settings, lazy or slow device responses to relinquish the SCSI bus, a faulty device, or, in very rare cases, a poorly written device driver.

I estimate that your computer is nearly a 10 years old, so it might be having some issues. You can try to check hard disk cables and to remove dust from the case.

 

[EMSmith]

Thanks so much again. I did make sure it was clean, and I will check the cabling. Really am so grateful for your help.