Brand new laptop Infected

New laptop has is shutting down and has security log files dated from a year ago.  I received some help for Windows 11 forum and ran speccy and minitool box, the advisor helping me suggested I come here.

 

 

 

 

 

No sure if this has any relevance, but my kids desktop that was on my home network was infected with multiple trojans Windows defender was able to quarantine some but not all.  I have taken that computer offline and will destroy the hard drive is it possible that my home network has something or someone malicious on it? 

Greetings and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Please allow me some time to review what you have posted.

Greetings.

There is no evidence of malicious software on your system. However, there are a few other issues we can take a look at.

• What driver were you having problems with?
• At some point did you have an external drive drive attached?
• Did you intend to run Norton as your security program or was it simply that it was included with the computer when you purchased it?

Please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CreateRestorePoint:
CloseProcesses:
Zip: C:\Windows\Minidump
CustomCLSID: HKU\S-1-5-21-1158046985-802832744-925710807-1001_Classes\CLSID\{DD49F9F5-1103-4AD1-9657-1D5856227307}\InprocServer32 -> C:\Users\gcgre\AppData\Local\Mozilla Firefox\notificationserver.dll => No File 
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File 
HKU\S-1-5-18\...\Run: [Norton Download ManagerFORCE_UPGRADE_22_23_5] => C:\PROGRA~3\Norton\{0C55C~1\NORTON~1.EXE /m /noui /instversion "22.23.5" (No File) 
Task: {8E0F270D-94BA-4B3C-BAFB-58F34EE44A97} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe  --automatic (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
Task: {6D5FC19A-3BCA-4C32-B032-BAA3F35BC4B6} - System32\Tasks\Mozilla\Firefox Default Browser Agent AFDF8DD2B82F8BB8 => C:\Users\gcgre\AppData\Local\Mozilla Firefox\default-browser-agent.exe  do-task "AFDF8DD2B82F8BB8" (No File) 
Task: {10799326-57C1-48FB-8EF3-26C55B0CE48A} - System32\Tasks\OneDC_Updater => C:\Users\gcgre\Documents\temp\OneDC_Updater\OneDC_Updater.exe  OneDragonCenter (No File) 
Powershell:  Get-Process -Id (Get-NetTCPConnection -LocalPort 32683).OwningProcess
Powershell:  Get-Process -Id (Get-NetTCPConnection -LocalPort 26822).OwningProcess
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create a zipped folder on the Desktop with today's date, example: 07.30.2023_13.24.50.zip. Please upload the file here.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Responses
• Fixlog
• Uploaded zip file

Hi there,

Yes the Norton came with the system, should i disable it and run the windows?  The hard drive attached is just a multi usb / HDMI  port.

 

Is it possible to have event logs dated before i purchased the computer?  The driver I was having problems with was Nahimic3, that is how I discovered all the security logs dated a year ago.  

 

thank you for taking the time to look at this!

Greetings.

You are most welcome. 

C:\Windows\Minidump -> copied successfully to C:\Users\gcgre\OneDrive\Desktop\04.07.2024_16.02.05.zip
The tool will create a zipped folder on the Desktop with today's date, example: 07.30.2023_13.24.50.zip. Please upload the file here

Would it be possible for you to upload the zip file?

I have not heard of that kind of backdating but I would like to look at it.

I would prefer to uninstall Norton for now. You can reinstall it later if you wish.

Please do this.

===================================================

FullEventLogView by Nirsoft

--------------------

• Download FullEventLogView by Nirsoft and save it to your Desktop
• Right click on the folder, select Extract All... and extract the folder onto your Desktop
• Open the fulleventlogview-x64 folder, right click on FullEventLogView (Application), then select Run as administrator
• Monitor the lower left hand corner of the screen until the Loading... no longer appears and an item(s) total is listed
• Click Edit, then Select All
• Click File, then Save Selected Items
• Save the file onto your Desktop as NirsoftEV.txt
• Please zip and upload the file here

===================================================

Uninstalling Programs Using Revo Uninstaller Free Portable

--------------------

• Download Revo Uninstaller Free Portable and save it to your Desktop
• Right click on the folder and select Extract All..., then click Extract
• Double click on the RevoUninstaller-Portable folder
• Right click on RevoUPort and select Run as administrator
• Click OK on the License Agreement
• From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)

 Norton 360 for Gamers

• If the program's uninstaller appears work through the steps to remove the program(s)
• Be sure the Advanced option is selected then click Scan
• For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
• Once done click Finish
• Reboot your computer

===================================================

Farbar Recovery Scan Tool SearchAll

--------------------

• Right click on FRST and select Run as administrator
• Copy/paste the following in the Search: box

SearchAll: Norton;Symantec

• Click Search Files
• When completed click OK and a Search.txt document will open on your desktop
• Zip and upload the file here

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CloseProcesses:
cmd: msinfo32 /nfo SystemSummary.nfo /categories +systemsummary
StartPowershell:
Set-MpPreference -OnAccessProtectionEnabled $True
Set-MpPreference -RealTimeProtectionEnabled $True
Set-MpPreference -AMRunningMode $Normal
Get-MpPreference
EndPowershell:
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• A SystemSummary file will be created on your Desktop. Please zip and upload the file here.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Uploaded Minidump zip file
• Nirsoft report
• Norton uninstalled?
• Search.txt
• Fixlog
• Uploaded SystemSummary report

Edited by Oh My!, Yesterday, 06:53 PM.

Hi Gary,

 

I the files have been zipped and sent to the link you provided.  The Nirsoft dump was interesting the guest account was enabled by an administrator for insecure logons, and before I updated anything there was multiple remote login requests,

Is that normal? 

Also Norton stalled out while unstalling for over a hour, there is still some files....

 

Again Thank you for taking all this time to assist me, much appreciated.

 

Is it normal to be running from from the one drive? IE Running from "C:\Users\gcgre\OneDrive\Desktop" I dont really use it so is it safe to delete?