Bundle chrome extension

Hello, recently I have been having issues with a chrome extension called bundle that opens and closes chrome randomly and it gets very annoying. I would love if someone could help me fix this in a timely manner. Thank you in advance

Hi there,

I am axe0 and I will be helping you with your computer problems.

Please follow these rules

• Refrain from making changes to your system, unless instructed to, so I know the exact state of your system. This includes installing or uninstalling programs, deleting files, modifying the registry, running scanners or tools of any kind.
• Follow the provided instructions in the order they are posted.
• If you have any problem with a tool or instructions, or have questions, please stop and ask me before moving on.
• Do not run any tool more than once, unless instructed to.
• Copy and paste log files inside your reply, unless otherwise instructed.
• Make sure to use Notepad for all logs, ensure Wordwrap is unchecked. In Notepad, click Format and uncheck Word wrap if it is checked
• Share as many details about your problem as possible, the more you share the easier it will be to solve your problem.
• I may not reply immediately because these logs can take some time to analyze. If it takes more than 48 hours you'll be notified. Feel free to PM me with a link to your thread if you haven't received a reply after 48 hours.
• Please try to reply within 24 up to 48 hours to ensure quick and efficient removal of malware. If there's no response from you within 3 days, I will bump your thread. If there hasn't been a response from you after 5 days then your thread will be closed.
• Stick with me until the end to ensure there are no remnants of malware left. When there is no malware present you will get a confirmation from me.

 

----------------------------------------------

FRST logs
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right-click FRST then click "Run as administrator".
• When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• When finished, it will produce a log called FRST.txt and Addition.txt in the same directory the tool was run from.
• Please copy and paste both logs in your next reply.

===============================================

In your next post
In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• Content of FRST.txt
• Content of Additiontxt

here is my FRST.txt results

Hi,

 

It appears that the headers for both FRST and Addition logs are missing.

 

I need the complete logs for analysis, please copy and paste the logs again with the headers included as well.

Hi miggybruh,

 

Thanks for your patience.

 

Have you set policies for Windows Update?

 

I noticed qBittorrent is installed.
- Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
- They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
- Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
- The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected. It is the source of the malware currently present on your computer.
I would recommend that you uninstall qBittorrent, however that choice is up to you. If you choose to remove this program, you can do so via Start > Control Panel > Add/Remove Programs.

----------------------------------------------

Uninstall Programs
The below listed programs have been identified as a Potential Unwanted Program, please uninstall them to ensure a better clean-up.

• Press the Windows Key + R.
• Type appwiz.cpl in the Run box and click OK.
• A list of programs installed will be "populated" (this may take a bit of time).
• If they exist, uninstall the following by clicking on the below entries and selecting "Remove":
  
• RestMinder

If you notice issues with uninstalling a program, please let me know.

 

----------------------------------------------

 

Run FRST Fix
Warning: This script was created for this specific system. Attempting to use the fix on another system may cause damage to the system
Warning: After running this script you will have to login again to any website like banking websites.

• Right-click FRST64.exe then click "Run as administrator".
• Select the entire content of the code below including "Start::" and "End::", right click and select "Copy"
• Click Fix button once and wait
• When finished, it will produce a log called Fixlog.txt in the same directory the tool was run from.
• Please copy and paste the log in your next reply.

Start::
CreateRestorePoint:
CloseProcesses:
emptytemp:
AlternateDataStreams: C:\WINDOWS\tracing:? [16]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log:F107EE40EF [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log_backup1:2DD1EC5C91 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log:CCC93B07B0 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log_backup1:AD433BF298 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log:72C8986B20 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log_backup1:97A90964FA [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log:C40F6B9209 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log_backup1:7CC29836A6 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log:AE3C879266 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log_backup1:AF8AA3CDC1 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log:DE1448F4D7 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log_backup1:D61270D3FD [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk:7661CCE9BF [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator 2022.lnk:0BBB729577 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2022.lnk:638138415C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro 2022.lnk:C56174E6CE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Streamlabs Desktop.lnk:578370639A [3442]
AlternateDataStreams: C:\Users\Miggy\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\Miggy\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
C:\ProgramData\DisplaySessionContainer*.log
C:\ProgramData\DisplaySessionContainer*.log_backup1
C:\Users\Miggy\AppData\Local\Programs\RestMinder
2022-07-15 22:20 - 2022-07-15 22:20 - 000000000 ____D C:\Users\Miggy\AppData\Local\chrome_tab
2022-07-11 15:32 - 2022-07-11 15:32 - 000013970 _____ C:\WINDOWS\system32\Tasks\chrome tab
C:\users\miggy\appdata\roaming\energy
C:\users\miggy\appdata\roaming\bloom
2021-10-13 22:03 - 2021-10-13 22:03 - 000006889 _____ () C:\Users\Miggy\AppData\Roaming\9a25f6f6-1ec0-461f-a765-037f99a8a9eb.tmp
Folder: C:\Users\Miggy\AppData\Local\Enverr
Folder: C:\Users\Miggy\AppData\LocalLow\Rayll
Task: {35A6F66D-DC69-4521-8F02-D46FEAA910DC} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => C:\Program Files\CUAssistant\culauncher.exe (No File)
S3 cpuz150; \??\C:\WINDOWS\temp\cpuz150\cpuz150_x64.sys [X]
S3 equ8_helper; \??\C:\WINDOWS\system32\DRIVERS\equ8_helper.sys [X]
S3 wtbt; \??\c:\program files (x86)\steam\steamapps\common\super people playtest\engine\binaries\thirdparty\wondertrust\wtdrv64.sys [X]
HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [Medal] => C:\Users\Miggy\AppData\Local\Medal\update.exe [1901144 2022-01-09] (Ferox Games B.V. -> )
HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [Energy] => C:\Users\Miggy\AppData\Roaming\Energy\Energy.exe --fTZuKpU (No File)
HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [NZXT.CAM] => C:\Program Files\NZXT CAM\NZXT CAM.exe --startup (No File)
Startup: C:\Users\Miggy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk [2021-10-17]
ShortcutTarget: IMVU.lnk -> C:\Users\Miggy\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File)
Task: {2C3DB3C3-1853-4F46-9049-ADE90B75A3FA} - System32\Tasks\chrome tab => cmd /c powershell -WindowStyle Hidden -E "CgAKAAoAJABqAGQAIAA9ACAAJABuAHUAbABsADsACgAKACQAZQBuAGMAUwB0AHIAQQBzAGMAPQBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAOwAKACQAagBwAD0AJABuAHUAbABsADsACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAZwBlAHQAVgBhAGwAdQBlAE4AZQB3ACgAWwBzAHQAcgBpAG (the data entry has 4955 more characters). <==== ATTENTION
cmd: nets advfirewall reset
cmd: type C:\Users\Miggy\AppData\Roaming\asof
End::

 

===============================================

In your next post
In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• How is your system running?
• Have you configured policies for Windows Update?
• Problems removing RestMinder?
• Content of fixlog.txt

Hello, My system is running great, nothing wrong with it as far as i can see. I have not configured policies for windows update. I had no problem removing restminder. here is conent of fixlog.txt Fix result of Farbar Recovery Scan Tool (x64) Version: 14-07-2022 Ran by Miggy (17-07-2022 17:51:00) Run:1 Running from C:\Users\Miggy\Downloads Loaded Profiles: Miggy Boot Mode: Normal ============================================== fixlist content: ***************** Start:: CreateRestorePoint: CloseProcesses: emptytemp: AlternateDataStreams: C:\WINDOWS\tracing:? [16] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log:F107EE40EF [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log_backup1:2DD1EC5C91 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log:CCC93B07B0 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log_backup1:AD433BF298 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log:72C8986B20 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log_backup1:97A90964FA [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log:C40F6B9209 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log_backup1:7CC29836A6 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log:AE3C879266 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log_backup1:AF8AA3CDC1 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log:DE1448F4D7 [3442] AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log_backup1:D61270D3FD [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk:7661CCE9BF [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator 2022.lnk:0BBB729577 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2022.lnk:638138415C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro 2022.lnk:C56174E6CE [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Streamlabs Desktop.lnk:578370639A [3442] AlternateDataStreams: C:\Users\Miggy\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394] AlternateDataStreams: C:\Users\Miggy\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394] C:\ProgramData\DisplaySessionContainer*.log C:\ProgramData\DisplaySessionContainer*.log_backup1 C:\Users\Miggy\AppData\Local\Programs\RestMinder 2022-07-15 22:20 - 2022-07-15 22:20 - 000000000 ____D C:\Users\Miggy\AppData\Local\chrome_tab 2022-07-11 15:32 - 2022-07-11 15:32 - 000013970 _____ C:\WINDOWS\system32\Tasks\chrome tab C:\users\miggy\appdata\roaming\energy C:\users\miggy\appdata\roaming\bloom 2021-10-13 22:03 - 2021-10-13 22:03 - 000006889 _____ () C:\Users\Miggy\AppData\Roaming\9a25f6f6-1ec0-461f-a765-037f99a8a9eb.tmp Folder: C:\Users\Miggy\AppData\Local\Enverr Folder: C:\Users\Miggy\AppData\LocalLow\Rayll Task: {35A6F66D-DC69-4521-8F02-D46FEAA910DC} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => C:\Program Files\CUAssistant\culauncher.exe (No File) S3 cpuz150; \??\C:\WINDOWS\temp\cpuz150\cpuz150_x64.sys [X] S3 equ8_helper; \??\C:\WINDOWS\system32\DRIVERS\equ8_helper.sys [X] S3 wtbt; \??\c:\program files (x86)\steam\steamapps\common\super people playtest\engine\binaries\thirdparty\wondertrust\wtdrv64.sys [X] HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [Medal] => C:\Users\Miggy\AppData\Local\Medal\update.exe [1901144 2022-01-09] (Ferox Games B.V. -> ) HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [Energy] => C:\Users\Miggy\AppData\Roaming\Energy\Energy.exe --fTZuKpU (No File) HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\...\Run: [NZXT.CAM] => C:\Program Files\NZXT CAM\NZXT CAM.exe --startup (No File) Startup: C:\Users\Miggy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk [2021-10-17] ShortcutTarget: IMVU.lnk -> C:\Users\Miggy\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File) Task: {2C3DB3C3-1853-4F46-9049-ADE90B75A3FA} - System32\Tasks\chrome tab => cmd /c powershell -WindowStyle Hidden -E "CgAKAAoAJABqAGQAIAA9ACAAJABuAHUAbABsADsACgAKACQAZQBuAGMAUwB0AHIAQQBzAGMAPQBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAOwAKACQAagBwAD0AJABuAHUAbABsADsACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAZwBlAHQAVgBhAGwAdQBlAE4AZQB3ACgAWwBzAHQAcgBpAG (the data entry has 4955 more characters). <==== ATTENTION cmd: nets advfirewall reset cmd: type C:\Users\Miggy\AppData\Roaming\asof End:: ***************** Restore point was successfully created. Processes closed successfully. C:\WINDOWS\tracing => ":?" ADS removed successfully C:\ProgramData\DisplaySessionContainer1.log => ":F107EE40EF" ADS removed successfully C:\ProgramData\DisplaySessionContainer1.log_backup1 => ":2DD1EC5C91" ADS removed successfully C:\ProgramData\DisplaySessionContainer10.log => ":CCC93B07B0" ADS removed successfully C:\ProgramData\DisplaySessionContainer10.log_backup1 => ":AD433BF298" ADS removed successfully C:\ProgramData\DisplaySessionContainer11.log => ":72C8986B20" ADS removed successfully C:\ProgramData\DisplaySessionContainer11.log_backup1 => ":97A90964FA" ADS removed successfully C:\ProgramData\DisplaySessionContainer12.log => ":C40F6B9209" ADS removed successfully C:\ProgramData\DisplaySessionContainer12.log_backup1 => ":7CC29836A6" ADS removed successfully C:\ProgramData\DisplaySessionContainer13.log => ":AE3C879266" ADS removed successfully C:\ProgramData\DisplaySessionContainer13.log_backup1 => ":AF8AA3CDC1" ADS removed successfully C:\ProgramData\DisplaySessionContainer14.log => ":DE1448F4D7" ADS removed successfully C:\ProgramData\DisplaySessionContainer14.log_backup1 => ":D61270D3FD" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini => ":B1DA6C571C" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk => ":7661CCE9BF" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator 2022.lnk => ":0BBB729577" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2022.lnk => ":638138415C" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro 2022.lnk => ":C56174E6CE" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini => ":41964AA945" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk => ":BE32D07BC5" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk => ":980850BA8A" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk => ":8096E45125" ADS removed successfully C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Streamlabs Desktop.lnk => ":578370639A" ADS removed successfully C:\Users\Miggy\Application Data => ":00e481b5e22dbe1f649fcddd505d3eb7" ADS removed successfully "C:\Users\Miggy\AppData\Roaming" => ":00e481b5e22dbe1f649fcddd505d3eb7" ADS not found. =========== "C:\ProgramData\DisplaySessionContainer*.log" ========== C:\ProgramData\DisplaySessionContainer1.log => moved successfully C:\ProgramData\DisplaySessionContainer10.log => moved successfully C:\ProgramData\DisplaySessionContainer11.log => moved successfully C:\ProgramData\DisplaySessionContainer12.log => moved successfully C:\ProgramData\DisplaySessionContainer13.log => moved successfully C:\ProgramData\DisplaySessionContainer14.log => moved successfully C:\ProgramData\DisplaySessionContainer15.log => moved successfully C:\ProgramData\DisplaySessionContainer16.log => moved successfully C:\ProgramData\DisplaySessionContainer17.log => moved successfully C:\ProgramData\DisplaySessionContainer18.log => moved successfully C:\ProgramData\DisplaySessionContainer19.log => moved successfully C:\ProgramData\DisplaySessionContainer2.log => moved successfully C:\ProgramData\DisplaySessionContainer20.log => moved successfully C:\ProgramData\DisplaySessionContainer21.log => moved successfully C:\ProgramData\DisplaySessionContainer22.log => moved successfully C:\ProgramData\DisplaySessionContainer23.log => moved successfully C:\ProgramData\DisplaySessionContainer24.log => moved successfully C:\ProgramData\DisplaySessionContainer25.log => moved successfully C:\ProgramData\DisplaySessionContainer26.log => moved successfully C:\ProgramData\DisplaySessionContainer27.log => moved successfully C:\ProgramData\DisplaySessionContainer28.log => moved successfully C:\ProgramData\DisplaySessionContainer29.log => moved successfully C:\ProgramData\DisplaySessionContainer3.log => moved successfully C:\ProgramData\DisplaySessionContainer4.log => moved successfully C:\ProgramData\DisplaySessionContainer5.log => moved successfully C:\ProgramData\DisplaySessionContainer6.log => moved successfully C:\ProgramData\DisplaySessionContainer7.log => moved successfully C:\ProgramData\DisplaySessionContainer8.log => moved successfully C:\ProgramData\DisplaySessionContainer9.log => moved successfully ========= End -> "C:\ProgramData\DisplaySessionContainer*.log" ======== =========== "C:\ProgramData\DisplaySessionContainer*.log_backup1" ========== C:\ProgramData\DisplaySessionContainer1.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer10.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer11.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer12.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer13.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer14.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer15.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer16.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer17.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer18.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer19.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer2.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer20.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer21.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer22.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer23.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer24.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer25.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer3.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer4.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer5.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer6.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer7.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer8.log_backup1 => moved successfully C:\ProgramData\DisplaySessionContainer9.log_backup1 => moved successfully ========= End -> "C:\ProgramData\DisplaySessionContainer*.log_backup1" ======== C:\Users\Miggy\AppData\Local\Programs\RestMinder => moved successfully C:\Users\Miggy\AppData\Local\chrome_tab => moved successfully C:\WINDOWS\system32\Tasks\chrome tab => moved successfully "C:\users\miggy\appdata\roaming\energy" => not found "C:\users\miggy\appdata\roaming\bloom" => not found C:\Users\Miggy\AppData\Roaming\9a25f6f6-1ec0-461f-a765-037f99a8a9eb.tmp => moved successfully ========================= Folder: C:\Users\Miggy\AppData\Local\Enverr ======================== 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved\Config 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\CrashReportClient 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\CrashReportClient\UE4CC-Windows-40C24D264EA78888025A9BAB581B8207 2022-07-14 14:26 - 2022-07-14 14:26 - 000000112 ____A [13F8815C6C6582CD5630BAC6DF8D1E7C] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\CrashReportClient\UE4CC-Windows-40C24D264EA78888025A9BAB581B8207\CrashReportClient.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Compat.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\DeviceProfiles.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\EditorScriptingUtilities.ini 2022-07-14 14:26 - 2022-07-14 14:33 - 000001488 ____A [F6B8A0250E503EA641C4081292050C6C] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Engine.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Game.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\GameplayTags.ini 2022-07-14 14:26 - 2022-07-14 14:33 - 000001096 ____A [480933AB06629BE96E05C23906DBFB30] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\GameUserSettings.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Hardware.ini 2022-07-14 14:26 - 2022-07-14 14:28 - 000000172 ____A [889CF1C393EA3ABB4B8C9A14F9C83DA9] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Input.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\MagicLeap.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\MagicLeapLightEstimation.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Niagara.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\OculusVR.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Paper2D.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\PhysXVehicles.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\RuntimeOptions.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Scalability.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\Synthesis.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000002 ____A [81051BCC2CF1BEDF378224B0A93E2877] () C:\Users\Miggy\AppData\Local\Enverr\Saved\Config\WindowsNoEditor\VariantManagerContent.ini 2022-07-14 14:26 - 2022-07-14 14:26 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\Local\Enverr\Saved\Logs ====== End of Folder: ====== ========================= Folder: C:\Users\Miggy\AppData\LocalLow\Rayll ======================== 2022-01-22 00:32 - 2022-01-22 22:52 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom 2022-01-22 00:32 - 2022-01-22 22:52 - 000000733 ____A [083A8801812C55BD3E8B3D2740D14382] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\output_log.txt 2022-01-22 00:50 - 2022-01-22 01:08 - 000001469 ____A [A3ACBABD7EFDC9F3C4D2399EEBAE82CA] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\SaveFile.es3 2022-01-22 00:50 - 2022-01-22 01:08 - 000001470 ____A [783FA2DB6A3F01C9568841F3DB766C45] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\SaveFile.es3.tmp.bak 2022-07-11 22:21 - 2022-07-11 22:29 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom - Norwood Hitchhike 2022-07-11 22:21 - 2022-07-11 23:20 - 000007190 ____A [56B4D0057AF27A7BAFF90E3F6492C7D1] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom - Norwood Hitchhike\Player.log 2022-07-11 22:21 - 2022-07-11 22:29 - 000001567 ____A [9FBD561A096542CA21DD49FC31ECF12B] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom - Norwood Hitchhike\Player-prev.log 2022-01-22 00:33 - 2022-01-22 00:33 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity 2022-01-22 00:33 - 2022-01-22 00:33 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity\49b47be7-2b5a-42ac-82e3-9c50b889a393 2022-01-22 00:33 - 2022-01-22 00:33 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity\49b47be7-2b5a-42ac-82e3-9c50b889a393\Analytics 2022-01-22 00:33 - 2022-01-22 22:52 - 000000304 ____A [E4BE01C27E0FD275D87412CDA20AD316] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity\49b47be7-2b5a-42ac-82e3-9c50b889a393\Analytics\config 2022-01-22 00:33 - 2022-01-22 22:54 - 000000131 ____A [6BF803170A2A16846D7B9719971CA977] () C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity\49b47be7-2b5a-42ac-82e3-9c50b889a393\Analytics\values 2022-01-22 00:33 - 2022-01-22 22:54 - 000000000 ____D [00000000000000000000000000000000] C:\Users\Miggy\AppData\LocalLow\Rayll\Fears To Fathom\Unity\49b47be7-2b5a-42ac-82e3-9c50b889a393\Analytics\ArchivedEvents ====== End of Folder: ====== "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{35A6F66D-DC69-4521-8F02-D46FEAA910DC}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{35A6F66D-DC69-4521-8F02-D46FEAA910DC}" => removed successfully C:\WINDOWS\System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => moved successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\CUAssistant\CULauncher" => removed successfully HKLM\System\CurrentControlSet\Services\cpuz150 => removed successfully cpuz150 => service removed successfully HKLM\System\CurrentControlSet\Services\equ8_helper => removed successfully equ8_helper => service removed successfully HKLM\System\CurrentControlSet\Services\wtbt => removed successfully wtbt => service removed successfully "HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Medal" => removed successfully "HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Energy" => removed successfully "HKU\S-1-5-21-2826498334-1472090739-1589450912-1002\Software\Microsoft\Windows\CurrentVersion\Run\\NZXT.CAM" => removed successfully C:\Users\Miggy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk => moved successfully "C:\Users\Miggy\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe" => not found "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2C3DB3C3-1853-4F46-9049-ADE90B75A3FA}" => removed successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C3DB3C3-1853-4F46-9049-ADE90B75A3FA}" => removed successfully "C:\WINDOWS\System32\Tasks\chrome tab" => not found "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\chrome tab" => removed successfully ========= nets advfirewall reset ========= 'nets' is not recognized as an internal or external command, operable program or batch file. ========= End of CMD: ========= ========= type C:\Users\Miggy\AppData\Roaming\asof ========= x £ ========= End of CMD: ========= =========== EmptyTemp: ========== BITS transfer queue => 0 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 304738127 B Java, Discord, Steam htmlcache => 1220101557 B Windows/system/drivers => 36588728 B Edge => 284857 B Chrome => 421104190 B Firefox => 568659373 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 7268 B NetworkService => 6541376 B Miggy => 2688878477 B RecycleBin => 6705440 B EmptyTemp: => 4.9 GB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 18:02:48 ====

Please do the following.

Run FRST Fix
Warning: This script was created for this specific system. Attempting to use the fix on another system may cause damage to the system

• Right-click FRST64.exe then click "Run as administrator".
• Select the entire content of the code below including "Start::" and "End::", right click and select "Copy"
• Click Fix button once and wait
• When finished, it will produce a log called Fixlog.txt in the same directory the tool was run from.
• Please copy and paste the log in your next reply.

Start::
CreateRestorePoint:
CloseProcesses:
C:\Users\Miggy\AppData\Roaming\asof
cmd: netsh advfirewall reset
exportkey:  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
End::

 

===============================================

In your next post
In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• Content of fixlog.txt

here is the content of fixlog.txt

The logs look good so far. The Windows Update portion is a new detection in FRST, by design FRST detects the presence of it as it may or may not have something malicious there. In your situation it is just the presence and nothing malicious there.

 

 

Please do the following next, this scanner is very thorough. After ESET is finished, please run a new scan with FRST.

ESET Online Scanner
Please download ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

 

===============================================

In your next post
In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• Content of eset.txt
• Content of FRST.txt
• Content of Addition.txt

Here is eset.txt

Please do the following.

Run FRST Fix
Warning: This script was created for this specific system. Attempting to use the fix on another system may cause damage to the system

• Right-click FRST64.exe then click "Run as administrator".
• Select the entire content of the code below including "Start::" and "End::", right click and select "Copy"
• Click Fix button once and wait
• When finished, it will produce a log called Fixlog.txt in the same directory the tool was run from.
• Please copy and paste the log in your next reply.

Start::
CloseProcesses:
EmptyTemp:
AlternateDataStreams: C:\ProgramData\NvcDispCorePlugin.log:AAE9D2281E [4298]
AlternateDataStreams: C:\ProgramData\NvcDispCorePlugin.log_backup1:E79F04DA79 [4298]
AlternateDataStreams: C:\ProgramData\NVDisplay.ContainerLocalSystem.log:5ACBC90093 [4298]
AlternateDataStreams: C:\ProgramData\NVDisplay.ContainerLocalSystem.log_backup1:A416BDA264 [4298]
AlternateDataStreams: C:\ProgramData\NVDisplayContainerWatchdog.log:204739A7F2 [4298]
AlternateDataStreams: C:\ProgramData\NVDisplayContainerWatchdog.log_backup1:C3CA1050CA [4298]
AlternateDataStreams: C:\ProgramData\rsEngine.config.backup:CF02139FF4 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk:7661CCE9BF [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator 2022.lnk:0BBB729577 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2022.lnk:638138415C [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro 2022.lnk:C56174E6CE [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk:E77773B271 [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Streamlabs Desktop.lnk:578370639A [4298]
End::

----------------------------------------------
 
Malwarebytes
Please download Malwarebytes to your desktop.

• Right click the downloaded Malwarebytes file and choose Run as Administrator.
• Click Yes when you see the User Account Control prompt.
• Follow the prompts to install the program.
• Right in the top in Malwarebytes click on the settings icon, click Check for updates to download the latest updates.
• Click Scan.
• If potential threats have been detected, check all listed items and click Quarantine Selected.
• While you're still on the Scan tab, click View Report > Export > Copy to clipboard and paste the content of the log in your next post.

===============================================
 
In your next post
In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• Content of fixlog.txt
• Content of Malwarebytes log
• How is your computer behaving with the randomly opening and closing of Chrome browser?

Edited by axe0, 23 July 2022 - 02:28 PM.
Fixed formatting

here is fixlog.txt

Good news. 

 

It looks like a part of the fix didn't go through properly, please do the following. After the below fix, please run a new scan with FRST, I'd like to have a look at the logs one more time.

 

Run FRST Fix

Warning: This script was created for this specific system. Attempting to use the fix on another system may cause damage to the system

• Right-click FRST64.exe then click "Run as administrator".

• Select the entire content of the code below including "Start::" and "End::", right click and select "Copy"

• Click Fix button once and wait

• When finished, it will produce a log called Fixlog.txt in the same directory the tool was run from.

• Please copy and paste the log in your next reply.

Start::
CloseProcesses:
AlternateDataStreams: C:\ProgramData\NVDisplayContainerWatchdog.log_backup1:C3CA1050CA [4298]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [4298]
End::
 

 

===============================================

 

In your next post

In your next post, please include the following. Make sure to copy and paste any requested logs unless asked to attach it.

• Content of fixlog.txt

• Content of FRST.txt

• Content of Addition.txt