Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

# I lost ie 11 in windows 10???? And, captcha when using chrome???

12 replies to this topic

### #1 sutransu1

sutransu1

• Members
• 22 posts
• ONLINE
•
• Local time:12:31 PM

Posted 09 February 2018 - 12:30 AM

Windows lost IE 11, but I do not know the reason. And when using GG Chrome, will I get captcha, which it says by virus? Thanks!~!!

m

### #2 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 09 February 2018 - 06:11 AM

to the Bleeping Computer Virus, Trojans, Spyware, and Malware Removal Logs Forum.  My name is Phil.  May I address you by your first name?

I will be assisting you with your computer issues.  I will endeavor to respond within a reasonable time.   Forum policy requires that I post within 48 hours after your last post, but I do endeavor to post within 24 hours of your last post.

I would ask that you please copy and paste the contents of all requested log files directly into your replies, in the future.  It makes it faster for me to analyze the various scan and fix logs.   Please do not use "code" or "quote" boxes.  Thank you for your anticipated cooperation.

I will need some time to review your FRST logs.  That could take a day or two, but I do hope to be able to respond later today.

PLEASE DO NOT RUN ANY ADDITIONAL SCANS OR ANTI-MALWARE REMOVAL TOOLS UNTIL YOU HAVE RECEIVED A RESPONSE FROM ME.
Doing so would complicate the situation and it would cause further delays in resolving your issues.  It could also potentially result in harm to your computer because my "fix" will be based on the FRST scan logs you have already submitted.

Thank you and have a great day.

Regards,
-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #3 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 09 February 2018 - 08:15 AM

sutransu1:

Before we start dealing with the problems you are experiencing, I would ask that you to take note of the following points:

• I am a Bleeping Computer volunteer, so I ask you to be patient. I know it is frustrating when your computer is not working properly, but malware removal takes time.
• Please also remember that I can only dedicate a limited number of hours a day to helping people. We may live in different time zones, which may cause delays in responding.
• If I have not responded to you within 48 hours, please send me a personal message. Likewise, I expect you to respond within 48 hours, and sooner is better because we can fix your computer faster.
• If I have not heard from you in three days, I will "bump" your post. After five days of no response, I will consider that you no longer need my assistance and this thread will be closed.
• Logs can take a while to research, so please be patient.
• Some issues just cannot be solved so you must be prepared for this.
• Please print or copy and save the instructions.
• Back up all your data and important files on another (external) drive before starting to run malware removal tools. Malware removal can cause unpredictable and unintended issues.
• You should try to limit your browsing with this computer until you are given the "All Clear." Some malware applications steal passwords.
• Please do not install or uninstall any applications, unless directed. Don't run any scripts or tools on your own because unsupervised usage may cause more harm than good.
• Please use only the tools you have been instructed to use.
• If you are using CD/DVD emulation software, this should be uninstalled or disabled as it can interfere with the removal of some malware. It can be turned off with Defogger and then turned back on when you get the "All Clear."
• Please copy and paste the requested log files inside your post(s), unless otherwise instructed. Please do not use code or quote boxes.
• There are no silly questions. Ask for clarification, if you have any questions or concerns.
• Bleeping Computer does not support any piracy. Evidence of illegal OS, software, cracks/keygens, etc., will be revealed by scan logs, and if found, further assistance may be suspended. Uninstall such software before proceeding!
• Any P2P software such as uTorrent, BitTorrent, Kazaa, etc. must be uninstalled or completely disabled. P2P software is a major security risk to your computer and may have been the route the malware used to infect your computer.
• Failure to follow these guidelines may result in assistance being withdrawn and your thread being closed.
• I am volunteering my time to help you, and I will need you to help me. Together, we can, hopefully, disinfect your computer and get if functioning properly again. That is my only aim.

.

OK, let's get started ...

.

In going over your logs I noticed that you are using qBittorrent as a portable application.

HKU\S-1-5-21-3275285716-222955862-3038949730-1001\...\Run: [qBittorrent] => D:\PM\qBittorrentPortable\App\qBittorrent\qbittorrent.exe [17831424 2017-12-18] ()

Please consider the following advice to reduce the possibility of being infected when surfing the web.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, your computer will get infected again.
I would recommend that you stop using qBittorrent, however that choice is up to you.
If you wish to keep it, please do not use it until your computer is cleaned.

.

The file "VideoDownloaderUltimate.exe" is adware. Please see this link and this link for more information. I would recommend that you uninstall this program, using the Control Panel, Uninstall a Program. Please let me know what you decide to do with this program. Personally, I would not have this program on my computer.

.

Do you know what this Chrome extension is? Did you install it?

CHR Extension: (AVIM - B? Gõ Ti?ng Vi?t) - C:\Users\iSu\AppData\Local\Google\Chrome\User Data\Default\Extensions\opgbbffpdglhkpglnlkiclakjlpiedoh [2018-02-03]

.

Please run a FRST fix for me.

NOTICE: This FRST "fixlist" script was written specifically for this user, for use on this individual computer. Running this on another computer may cause damage to your operating system.

Start::
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
S4 IsAppService; C:\Program Files (x86)\Iskysoft\IAF\2.4.3.231\IsAppService.exe [X]
S3 WsDrvInst; "C:\Program Files (x86)\iSkysoft\Phone Transfer\DriverInstall.exe" [X]
2018-01-28 17:15 - 2018-01-28 17:15 - 000000000 _____ C:\Users\Public\Documents\temp.exe
EmptyTemp:
End::

• Please highlight the entire contents of the code box above, from the "Start::" line to the "End::" line, including both of those lines, right click, and select "Copy", which will copy the "fix" script into the Windows clipboard.
• Right click FRST64.exe, and select "Run as Administrator".
• Press Fix button once and wait.
• Please reboot the computer, if requested.
• A log file called "fixlog.txt" will be saved in the same folder as the FRST program is located.

.

Thank you and have a great day.

Regards,
-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #4 sutransu1

sutransu1
• Topic Starter

• Members
• 22 posts
• ONLINE
•
• Local time:12:31 PM

Posted 10 February 2018 - 05:50 AM

I know exactly what an extension of chrome is, and it's harmless. Thanks for the help and advice.

#### Attached Files

Edited by sutransu1, 10 February 2018 - 05:51 AM.

### #5 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 10 February 2018 - 01:02 PM

sutransu1:

Thank you for your reply and for running the FRST "fixlist" script for me.

I would ask that you please copy and paste the contents of all requested log files directly into your replies, in the future. It makes it faster for me to analyze the various scan and fix logs. Please do not use "code" or "quote" boxes. Thank you for your anticipated cooperation.

Please do not attach files to your posts, unless specifically requested to do so. Thank you.

.

The FRST "fixlist" script executed properly.

Thank you for explaining that you installed the Chrome extension, with which I was unfamiliar. Thank you also for letting me know that you uninstalled VideoDownloaderUltimate. Good decision!

Since FRST cannot detect all malware, we need to run some standard anti-malware scans to ensure that your computer is not infected.

.

ESET Online Scanner using Internet Explorer:

Note: You will need to disable your currently installed Anti-Virus, how to do so can be found here.

• Double click the icon.
• Click the Start button.
• Accept any security warnings from your browser.
• Then select: "Enable detection of potentially unwanted applications" - Yes.
• Check the following items.

Enable detection of potentially unwanted applications
Remove found threats
Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology

• Click Change next to Current scan targets:
• Place a check mark in any additional drive you wish to scan then click OK.
• Click Start.
• If no threats are found simply click Uninstall application on close and hit Finish.
• If threats are found click List of found threats.
• Click Export to text file.
• Save the file on your Desktop as ESET.txt.
• Click Back.
• Check Uninstall application on close and Delete quarantined files.
• Click Finish.
• Close the ESET Online Scanner window.
• Copy and paste the contents of ESET.txt into your reply, if any threats were detected.

Don't forget to re-enable your antivirus when finished!

.

Please run a Malwarebytes Anti-Malware scan for me. I see that you have that program installed on your computer.

• Please go to "Settings", "Protection", and turn on "Scan for rootkits", if it is not "On."
• Ensure that under "Potential Threat Protection", both switches are set to "Always Detect PUPs/PUMs (recommended).
• Then scroll to the bottom of that page and ensure that "Automatic Quarantine" is turned "On."
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If an update of the definitions is available, it will be downloaded and installed before the scan commences.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

.

• Vista/Windows 7/8/10 users right-click and select Run As Administrator
• The tool will start to update the database, please wait for it to complete the update.
• Click on I Agree button.
• Click on the Scan button.
• AdwCleaner will begin its scan ... please be patient as the scan may take some time to complete.
• After the scan has finished, click on the Logfile button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, then make sure that you uncheck it before running the "Clean" process.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
• After the scan has finished ...
• Uncheck any PUP and adware applications that you want to keep.

If you are unsure about one or more of the detected programs, then please copy and paste the scan log, with your questions, and I will provide you with advice about those files.
The Scan logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Do not follow the remaining "Clean" instructions until directed to do so by me, if you have any questions about one or more of the detections.
If you have no questions about any of the detections, then please proceed to the "Clean" steps below.

• Then click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[C#].txt) will open automatically (where the largest value of # represents the most recent report).
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

.

PLEASE copy and paste all three requested logs into your next reply. Please note that if ESET does not detect any malware, there will be no log produced for you to copy and paste. Just let me know that there were no detections, if that happens.

Thank you and have a great day.

Regards,
-Phil

Edited by garioch7, 10 February 2018 - 01:03 PM.
Formatting Error

Member of the Unified Network of Instructors and Trusted Eliminators

### #6 sutransu1

sutransu1
• Topic Starter

• Members
• 22 posts
• ONLINE
•
• Local time:12:31 PM

Posted 11 February 2018 - 03:17 AM

When I run esetsmartinstaller_enu.exe (to step 2 out of 4). It says "Can not get update. Is proxy configured".  And it does not continue work, it just stop?

### #7 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 11 February 2018 - 07:07 AM

sutransu1:

Thank you for your post. I would like to get the online ESET scan working for you. Your default browser is Google Chrome. Is that the browser you are using to try and run the ESET scan?

If you tried using Google Chome, can you try to run the ESET scan using Internet Explorer?

If that does not work, please follow the following steps to see if you can get ESET to update and scan.

.

Let's check to see if Windows has a proxy enabled.

• Press the Windows logo key + R together.
• Next, type: inetcpl.cpl in the Run box and then press "Enter".
• Click the Connections tab and then click the LAN settings button.
• Verify if "Use a proxy..." is checked, if so, UNcheck it and click OK/OK to exit.

If the "Use a proxy" box was checked, and you unchecked it, please try to run an ESET scan again. If it still reports that error, please proceed to the next step; otherwise if the ESET scan runs, please skip Step .

.

Checkmark the following checkboxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Devices

Click Go and and then copy and paste the contents of "MTB.txt" into your next reply.  A copy of "MTB.txt" will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

Please try to run the ESET scan again. Please let me know whether it ran successfully. If it didn't, please let me know what error message you received.

.

Thank you and have a great day.

Regards,
-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #8 sutransu1

sutransu1
• Topic Starter

• Members
• 22 posts
• ONLINE
•
• Local time:12:31 PM

Posted 12 February 2018 - 06:34 AM

As the title has said. I'm lost ie 11, right now??!!!

I also do not understand scan online with chrome or IE???

I scan online from the link you provided me with a software called "esetsmartinstaller_enu.exe" (Download with IDM).

MiniToolBox by Farbar  Version: 17-06-2016
Ran by iSu (administrator) on 13-02-2018 at 01:23:10
Running from "C:\Users\iSu\Desktop"
Microsoft Windows 10 Pro  (X64)
Model: System Product Name Manufacturer: System manufacturer
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================
95.79.255.155:17706
========================= IP Configuration: ================================

Intel(R) Ethernet Connection (2) I219-V = Ethernet (Connected)
Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)
TAP-Windows Adapter V9 = Ethernet 2 (Media disconnected)

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
set interface interface="Ethernet (Kernel Debugger)" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Bluetooth Network Connection" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet 2" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled

popd
# End of IPv4 configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : DESKTOP-VSUKJR3
Primary Dns Suffix  . . . . . . . :
Node Type . . . . . . . . . . . . : Mixed
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : lan

Connection-specific DNS Suffix  . : lan
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-V
Physical Address. . . . . . . . . : 2C-4D-54-4E-0A-6F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.32(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 10 Tháng Hai 2018 10:47:15 CH
Lease Expires . . . . . . . . . . : 13 Tháng Hai 2018 6:58:59 CH
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 53235028
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-22-06-27-CA-2C-4D-54-4E-0A-6F
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
NetBIOS over Tcpip. . . . . . . . : Enabled

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-4A-61-34-76
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 00-1A-7D-DA-71-13
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 2:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:2ce7:1621:f151:64f8(Preferred)
Default Gateway . . . . . . . . . : ::
DHCPv6 IAID . . . . . . . . . . . : 150994944
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-22-06-27-CA-2C-4D-54-4E-0A-6F
NetBIOS over Tcpip. . . . . . . . : Disabled

113.171.241.30
113.171.241.49
113.171.241.40
113.171.241.39
113.171.241.50
113.171.241.20
113.171.241.44
113.171.241.34
113.171.241.59
113.171.241.55
113.171.241.24
113.171.241.29
113.171.241.25
113.171.241.54
113.171.241.45
113.171.241.35

Pinging google.com [113.171.241.103] with 32 bytes of data:
Reply from 113.171.241.103: bytes=32 time=3ms TTL=60
Reply from 113.171.241.103: bytes=32 time<1ms TTL=60

Ping statistics for 113.171.241.103:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 3ms, Average = 1ms

Name:    yahoo.com
2001:4998:c:e33::53
2001:4998:44:204::100d
98.138.252.38
206.190.39.42
98.139.180.180

Pinging yahoo.com [98.139.180.180] with 32 bytes of data:
Reply from 98.139.180.180: bytes=32 time=273ms TTL=46
Reply from 98.139.180.180: bytes=32 time=268ms TTL=46

Ping statistics for 98.139.180.180:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 268ms, Maximum = 273ms, Average = 270ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
5...2c 4d 54 4e 0a 6f ......Intel(R) Ethernet Connection (2) I219-V
4...00 ff 4a 61 34 76 ......TAP-Windows Adapter V9
12...00 1a 7d da 71 13 ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.32     25
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination      Gateway
13    331 2001:0:9d38:90d7:2ce7:1621:f151:64f8/128
5    281 fe80::213a:ca52:12b4:a43e/128
13    331 fe80::2ce7:1621:f151:64f8/128
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [54784] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [63488] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [24064] (Microsoft Corporation)
Catalog5 07 C:\WINDOWS\SysWOW64\wshbth.dll [50688] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [122128] (Apple Inc.)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 13 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67072] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [79872] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31232] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [63488] (Microsoft Corporation)
x64-Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [133392] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 13 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (02/13/2018 01:21:49 AM) (Source: SideBySide) (User: )
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.214_none_5d78081fa7df188e.manifest.

Error: (02/13/2018 01:12:38 AM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Start Time: 01d3a4245907502a

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Faulting package full name:

Faulting package-relative application ID:

Error: (02/13/2018 12:10:03 AM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1550

Start Time: 01d3a41ab5ae81c1

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Report Id: 28d41c54-075b-457d-a334-f7879c68da04

Faulting package full name:

Faulting package-relative application ID:

Error: (02/12/2018 11:00:37 PM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1cc8

Start Time: 01d3a41633c703ce

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Report Id: c1bd5a3d-57c6-4b19-b20c-4d20566d74d4

Faulting package full name:

Faulting package-relative application ID:

Error: (02/12/2018 06:35:01 PM) (Source: SideBySide) (User: )
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.214_none_5d78081fa7df188e.manifest.

Error: (02/12/2018 06:08:40 PM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 2fe8

Start Time: 01d3a3ed6883323b

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Faulting package full name:

Faulting package-relative application ID:

Error: (02/11/2018 10:21:00 PM) (Source: Application Error) (User: )
Description: Faulting application name: bf1.exe, version: 1.0.52.60404, time stamp: 0x5a627f46
Faulting module name: bf1.exe, version: 1.0.52.60404, time stamp: 0x5a627f46
Exception code: 0x80000003
Fault offset: 0x0000000004b530f5
Faulting process id: 0x281c
Faulting application start time: 0xbf1.exe0
Faulting application path: bf1.exe1
Faulting module path: bf1.exe2
Report Id: bf1.exe3
Faulting package full name: bf1.exe4
Faulting package-relative application ID: bf1.exe5

Error: (02/11/2018 09:16:39 PM) (Source: Application Hang) (User: )
Description: The program mpc-hc.exe version 1.7.13.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 2950

Start Time: 01d3a342d403fb94

Termination Time: 10

Application Path: C:\Program Files (x86)\MPC-HC\mpc-hc.exe

Report Id: fefec8f9-0a45-48ab-99a1-eb2575b74ea2

Faulting package full name:

Faulting package-relative application ID:

Error: (02/11/2018 07:20:04 PM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1da4

Start Time: 01d3a32540819d1e

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Report Id: ddfaf6bd-2b47-4730-8f89-13c075eb9b32

Faulting package full name:

Faulting package-relative application ID:

Error: (02/11/2018 04:31:16 PM) (Source: Application Hang) (User: )
Description: The program bf1.exe version 1.0.52.60404 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 710

Start Time: 01d3a30f6d848ec7

Termination Time: 4294967295

Application Path: D:\Game\Origin Games\Battlefield 1\bf1.exe

Report Id: bb1f5bef-6344-4aaa-8b21-24d23f412bfd

Faulting package full name:

Faulting package-relative application ID:

System errors:
=============
Error: (02/13/2018 12:23:31 AM) (Source: DCOM) (User: DESKTOP-VSUKJR3)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}DESKTOP-VSUKJR3iSuS-1-5-21-3275285716-222955862-3038949730-1001LocalHost (Using LRPC)UnavailableUnavailable

Error: (02/11/2018 06:53:18 PM) (Source: Service Control Manager) (User: )
Description: The eapihdrv service failed to start due to the following error:

Error: (02/11/2018 06:53:18 PM) (Source: Application Popup) (User: )
Description: \??\C:\Users\iSu\AppData\Local\Temp\ehdrv.sys

Error: (02/11/2018 06:53:18 PM) (Source: Service Control Manager) (User: )
Description: The eapihdrv service failed to start due to the following error:

Error: (02/11/2018 06:53:18 PM) (Source: Application Popup) (User: )
Description: \??\C:\Users\iSu\AppData\Local\Temp\ehdrv.sys

Error: (02/11/2018 06:53:18 PM) (Source: Service Control Manager) (User: )
Description: The eapihdrv service failed to start due to the following error:

Error: (02/11/2018 06:53:18 PM) (Source: Application Popup) (User: )
Description: \??\C:\Users\iSu\AppData\Local\Temp\ehdrv.sys

Error: (02/11/2018 06:53:18 PM) (Source: Service Control Manager) (User: )
Description: The eapihdrv service failed to start due to the following error:

Error: (02/11/2018 06:53:18 PM) (Source: Application Popup) (User: )
Description: \??\C:\Users\iSu\AppData\Local\Temp\ehdrv.sys

Error: (02/11/2018 06:53:17 PM) (Source: Service Control Manager) (User: )
Description: The eapihdrv service failed to start due to the following error:

Microsoft Office Sessions:
=========================
Error: (02/13/2018 01:21:49 AM) (Source: SideBySide)(User: )

Error: (02/13/2018 01:12:38 AM) (Source: Application Hang)(User: )

Error: (02/13/2018 12:10:03 AM) (Source: Application Hang)(User: )
Description: bf1.exe1.0.52.60404155001d3a41ab5ae81c14294967295D:\Game\Origin Games\Battlefield 1\bf1.exe28d41c54-075b-457d-a334-f7879c68da04

Error: (02/12/2018 11:00:37 PM) (Source: Application Hang)(User: )
Description: bf1.exe1.0.52.604041cc801d3a41633c703ce4294967295D:\Game\Origin Games\Battlefield 1\bf1.exec1bd5a3d-57c6-4b19-b20c-4d20566d74d4

Error: (02/12/2018 06:35:01 PM) (Source: SideBySide)(User: )

Error: (02/12/2018 06:08:40 PM) (Source: Application Hang)(User: )

Error: (02/11/2018 10:21:00 PM) (Source: Application Error)(User: )
Description: bf1.exe1.0.52.604045a627f46bf1.exe1.0.52.604045a627f46800000030000000004b530f5281c01d3a3480f32c07fD:\Game\Origin Games\Battlefield 1\bf1.exeD:\Game\Origin Games\Battlefield 1\bf1.exec8cf335b-a810-4c02-84fe-c2cdea9ab7bf

Error: (02/11/2018 09:16:39 PM) (Source: Application Hang)(User: )
Description: mpc-hc.exe1.7.13.0295001d3a342d403fb9410C:\Program Files (x86)\MPC-HC\mpc-hc.exefefec8f9-0a45-48ab-99a1-eb2575b74ea2

Error: (02/11/2018 07:20:04 PM) (Source: Application Hang)(User: )
Description: bf1.exe1.0.52.604041da401d3a32540819d1e4294967295D:\Game\Origin Games\Battlefield 1\bf1.exeddfaf6bd-2b47-4730-8f89-13c075eb9b32

Error: (02/11/2018 04:31:16 PM) (Source: Application Hang)(User: )
Description: bf1.exe1.0.52.6040471001d3a30f6d848ec74294967295D:\Game\Origin Games\Battlefield 1\bf1.exebb1f5bef-6344-4aaa-8b21-24d23f412bfd

CodeIntegrity Errors:
===================================
Date: 2018-02-12 23:17:20.433
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 23:17:20.431
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 20:43:25.560
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 20:43:25.558
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:54:20.487
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:54:20.485
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:29:50.477
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume7\Program Files\NVIDIA Corporation\Ansel\Tools\NvCameraWhitelisting64.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:28:15.942
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume7\Program Files\NVIDIA Corporation\Ansel\Tools\NvCameraWhitelisting64.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:28:15.337
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume7\Program Files\NVIDIA Corporation\Ansel\Tools\NvCameraWhitelisting64.dll that did not meet the Microsoft signing level requirements.

Date: 2018-02-12 19:26:03.831
Description: Code Integrity determined that a process (\Device\HarddiskVolume7\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume7\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.

========================= Devices: ================================

**** End of log ****


Edited by sutransu1, 12 February 2018 - 01:24 PM.

### #9 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 12 February 2018 - 01:56 PM

sutransu1:

Thank you for your post.  In future, please do not use code or quote boxes for posting scan logs.  Please COPY and PASTE them directly into your post.  It is more difficult for me to read and analyze the smaller type.  Thank you for your anticipated cooperation.

• Please copy and paste the requested log files inside your post(s), unless otherwise instructed. Please do not use code or quote boxes

.

Did you run the ESET scan?

I scan online from the link you provided me with a software called "esetsmartinstaller_enu.exe" (Download with IDM).

Were any threats detected?  If so, please follow the instructions and copy and paste the contents of the ESET scan log directly into your next reply.  If ESET did not detect any malware, there will be no log produced.

.

Did you run the Malwarebytes and AdwCleaner scans as requested?  If so, please copy and paste the contents of those scan logs directly into your next reply.

Please see this post for instructions.

Thank you and have a great day.

Regards,

-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #10 sutransu1

sutransu1
• Topic Starter

• Members
• 22 posts
• ONLINE
•
• Local time:12:31 PM

Posted 12 February 2018 - 11:48 PM

I have followed the requirements and finished getting the infection, except that it detected "nicehash miner 2" as malware, which I think is wrong positive.

My system seems to be working fine, right now. Thank you very much.

### #11 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 13 February 2018 - 01:26 PM

sutransu1:

Thank you for your post.  If your computer is working fine now, then we should clean up the tools that we used to disinfect it.

.

We will now remove the tools we used during this fix using Delfix.

• Ensure Remove disinfection tools is checked.
• Also place a checkmark next to:
• Create registry backup
• Purge system restore
• Click the Run button.

.

. . . Some Final Advice . . .

The most common cause of an infected machine is the Trojan Horse, or programs which appear to be legitimate but which contain malicious payloads, or which are simply malicious in and of themselves. No antivirus, firewall, host-based intrusion prevention system (HIPS), or other security software can fully protect you against this kind of attack. The best way to project yourself is not to run email attachments from untrusted sources, and avoid software downloaded from the internet wherever possible. Remember, when you run an application, you are giving that application permission to do to your machine anything you can do to the machine, including create, modify, or destroy files or other data. In the Windows (and most other systems' such as Unix) security model, applications don't have privileges, users do.

The second most common cause of infection is out of date software. Leaving your system unpatched leaves holes through which attackers can execute code on your behalf without your consent. This goes for far more than common targets such as Windows and Internet Explorer. Most recent threats target other third party software, such as Adobe's Adobe Reader, Shockwave Player, or Flash Player, or Oracle's Java browser plugins. You can check your system for out of date software manually, or by using automated tools such as Secunia's Personal Software Inspector. This goes doubly for security applications such as antivirus and other antimalware products based on definition lists, where out-of-date lists mean no detection of newer malware.

Finally, occasionally you will be forced to run some potentially infected binary, or attackers will use a hole which is unpatched by software vendors, so a last line of defense is needed. That means turning on a firewall (Windows Firewall included with Windows Vista or later is fine) and leaving it on, and using and keeping up-to-date an antivirus solution such as Bitdefender. Antiviral solutions don't even have to cost money; later versions of Windows Defender provide perfectly acceptable protection for free. If for some reason you don't like Windows Defender, there are other free products available as well:

• Avira (shows nag screen to purchase full product when updating, home use only)
• Bitdefender Free (home use only)

That should be fine for the majority of users. However, if you absolutely want additional protection, consider one or more of the following products:

If you want more information on methods malware uses to infect your computer, consider browsing our How did I get infected? topic.

.

It has been a pleasure assisting you and I hope that you will avoid any further infections in the future. Your most important protection step is to ALWAYS HAVE MORE THAN ONE RECENT BACKUP OF YOUR ENTIRE SYSTEM on an external drive that is only connected to your computer long enough to backup or restore. I do system images weekly. With the free backup software out there (Easeus ToDo Backup Home, Macrium Reflect, etc.), and the very reasonable prices for external USB hard drives, there is no reason to not have a backup.

On behalf of the Bleeping Computer Community, thank you for choosing BC to assist you with your computer issues, stay safe out there in cyberspace, and have a great day.

Regards,
-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #12 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 16 February 2018 - 12:15 PM

Are you still there?  Do you still require assistance?  It has been three days since I last posted to you.

According to Forum policy, topics must be concluded after five days of non-response from the Topic Starter.

If I have not heard from you in another two days, I will conclude your topic.  You can always reopen it by sending a Personal Message to me or to a Moderator.

Thank you and have a great day.

Regards,
-Phil

Member of the Unified Network of Instructors and Trusted Eliminators

### #13 garioch7

garioch7

RCMP Veteran

• Malware Response Instructor
• 3,041 posts
• OFFLINE
•
• Gender:Male
• Location:Port Hood, Nova Scotia, Canada
• Local time:02:31 AM

Posted 18 February 2018 - 06:36 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Member of the Unified Network of Instructors and Trusted Eliminators

#### 0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users