Could you help me rule out any infection on my PC

Hi

Every morning when I log in to windows I first get a black screen w cursor for a while then it flashes the desktop for a second then I see that Malwarebytes Realtime protection is turned off and there is a blue box with a wait symbol on it then it goes back to the black screen with cursor again for a while and finally I get access to the desktop I see the warning about the MWB rt protection but when I open MWB it seems to be turned on.
Usually if I restart my computer even turn of  and on it does not happens window just acts normal.
 
 
Asle

Edited by hamluis, 01 June 2024 - 08:25 AM.
Merged dupe - Hamluis.

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

• Download Farbar Recover Scan Tool for 64 bit systems and note where the file is saved (Desktop, Downloads, etc.) <<< Important
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of each report in separate reply windows

• FRST.txt
• Addition.txt

FRST.txt:

Addition.txt part 1:
 

Addition.txt part 2:
 

I had to split Addition.txt into 2 parts because the forum said it was too big to post.

Asle

• Download Revo Uninstaller Free Portable and save it to your Desktop
• Right click on the folder and select Extract All..., then click Extract
• Double click on the RevoUninstaller-Portable folder
• Right click on RevoUPort and select Run as administrator
• Click OK on the License Agreement
• From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)

Avira Secure Browser

• If the program's uninstaller appears work through the steps to remove the program(s)
• Be sure the Advanced option is selected then click Scan
• For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
• Once done click Finish
• Reboot your computer

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
AlternateDataStreams: C:\ProgramData\TEMP:02DD996C [182] 
AlternateDataStreams: C:\ProgramData\TEMP:036B81D9 [167] 
AlternateDataStreams: C:\ProgramData\TEMP:1349D788 [164] 
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134] 
AlternateDataStreams: C:\ProgramData\TEMP:3310F70A [177] 
AlternateDataStreams: C:\ProgramData\TEMP:39CB2031 [177] 
AlternateDataStreams: C:\ProgramData\TEMP:4018444F [164] 
AlternateDataStreams: C:\ProgramData\TEMP:437B1C75 [181] 
AlternateDataStreams: C:\ProgramData\TEMP:4B6A9FDA [163] 
AlternateDataStreams: C:\ProgramData\TEMP:5C92988B [191] 
AlternateDataStreams: C:\ProgramData\TEMP:698AE49B [153] 
AlternateDataStreams: C:\ProgramData\TEMP:6E6A4F42 [175] 
AlternateDataStreams: C:\ProgramData\TEMP:7687A3E3 [171] 
AlternateDataStreams: C:\ProgramData\TEMP:7FA0D639 [188] 
AlternateDataStreams: C:\ProgramData\TEMP:9D0A16E4 [184] 
AlternateDataStreams: C:\ProgramData\TEMP:A76508EA [140] 
AlternateDataStreams: C:\ProgramData\TEMP:B9C6EB6C [164] 
AlternateDataStreams: C:\ProgramData\TEMP:D64467B5 [182] 
AlternateDataStreams: C:\ProgramData\TEMP:DDA730F9 [174] 
AlternateDataStreams: C:\ProgramData\TEMP:E02CCF03 [133] 
AlternateDataStreams: C:\ProgramData\TEMP:EC9FFAA4 [178] 
Task: {0633C6A0-508E-4F14-B39D-0DA5DD69476E} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION 
Task: {1FF2C01F-7977-45DA-83E4-973D5BAB4361} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION 
Task: {2A0A948B-E83E-426B-BD0F-49BC246CC91A} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION 
Task: {2B83740C-E6D2-46BB-A77F-668853AE6AD2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION 
Task: {3D3621FE-F6C8-42F5-8891-53B5AD70A115} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION 
Task: {40713C61-5B6E-4984-A23F-DDBCF45E9183} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION 
Task: {45BB8ABA-F94E-40A9-BF52-27EAE00801D4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION 
Task: {4F94FE26-7B37-46CF-ADDD-80811E8EF8EE} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION 
Task: {6A878BAC-CCB1-418A-A609-1C8003B042B7} - \Opera scheduled assistant Autoupdate 1581095807 -> No File <==== ATTENTION 
Task: {7B993A01-224E-4E8D-A8C8-79FA047BF835} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION 
Task: {A2C3CB38-7A63-4057-BBDA-4D2E1C99B2E7} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION 
Task: {B70F4035-565E-4DE8-BAD1-395B471C9B96} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION 
Task: {C4810677-57CD-4C94-B79D-6D12DC1C11AC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION 
Task: {DDC73F60-E7FF-448B-9730-63A41B461957} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION 
Task: {FDF23329-92BB-4EEC-BA6B-E7F776357EC0} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION 
Task: {79D0DEBE-50B7-46C7-BED9-C2CFC83D576F} - System32\Tasks\BlueStacksHelper_nxt => C:\Program Files\BlueStacks_nxt\BlueStacksHelper.exe -sr (No File) 
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => %SystemRoot%\System32\AutoWorkplace.exe join (No File) 
HKU\S-1-5-21-2754925619-3189606673-1568942857-1001\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe [2849816 2024-05-31] (Brave Software, Inc. -> Brave Software, Inc.)
HKU\S-1-5-21-2754925619-3189606673-1568942857-1001\...\Run: [GalaxyClient] => [X] 
HKU\S-1-5-21-2754925619-3189606673-1568942857-1001\...\Run: [] => [X] 
HKLM-x32\...\Run: [WSVCUUpdateHelper.exe] => C:\Program Files (x86)\Wondershare\Video Converter Free\WSVCUUpdateHelper.exe (No File) 
HKU\S-1-5-21-2754925619-3189606673-1568942857-1001\...\ChromeHTML: -> <==== ATTENTION 
HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (No File) 
S3 CryptoTabBrowserElevationService; "C:\Program Files (x86)\CryptoTab Browser\Application\122.0.6261.70\elevation_service.exe" [X] 
S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Video Converter Free\Transfer\DriverInstall.exe" [X] 
S1 CsNdisLWF; System32\Drivers\CsNdisLWF.sys [X] 
S3 SIUSBXP; \??\C:\Windows\system32\drivers\SiUSBXp.sys [X] 
CustomCLSID: HKU\S-1-5-21-2754925619-3189606673-1568942857-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Asle\AppData\Local\Citrix\GoToMeeting\7155\G2MOutlookAddin64.dll => No File 
ContextMenuHandlers2: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> No File 
ContextMenuHandlers3: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> No File 
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => -> No File 
Shortcut: C:\Users\Asle\Desktop\G\Minecraft\MC Servers\Spigot 1.16.2.lnk -> E:\Games\Minecraft\Servers\Spigot1163\run.bat (No File) 
cmd: netsh winsock reset catalog
cmd: netsh int ip reset resetlog.txt
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
• Note: The Emptytemp: command will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.

• Right click on FRST and select Run as administrator
• Copy/paste the following in the Search: box

SearchAll: Avira;Avast

• Click Search Files button
• When completed click OK and a Search.txt document will open on your desktop
• Zip and upload the file here

• Avira uninstalled
• Fixlog
• Uploaded Search file

Edited by Oh My!, 02 June 2024 - 01:42 PM.

Hi 

Avira secure browser is just an internet browser based on chrome.
I had Avira virus protection installed before and have already uninstalled it.

If you still want me to uninstall it I will.

Asle

OK I will.

I love your signature line BTW.

Asle

Just to make sure
When you said reboot your computer, is it enough to use the restart option in windows or do I have to turn the computer off and then on again?

I have used the restart I just want to confirm before going on,so I don't do something wrong.

Asle

No, that is not normal.

I modified the Fixlist and removed the Emptytemp: command which is usually the culprit. Please try the new version.

Fixlog.txt: