Threat sucured message ictkjkmd.top connection aborted

system · 2017-11-07T21:01:45.000Z

I’m in the process of running a Malwarebytes scan with the root kits option enables as suggested; however, I got another Avast message saying that wirlhpx.exe had been quarantined. It may be that the problem is solved. Is it reasonable to assume the threat is neutralized? I’ve also noticed that I am unable to run system restore, even from a newly created system repair disc. When I tried to I got a message saying that there were no restore points. Ay Yi Yi.

Pondus · 2017-11-07T21:05:59.000Z

Is it reasonable to assume the threat is neutralized?

Read my post above again

system · 2017-11-07T21:10:35.000Z

OK, I’m running FRST64.exe. I’ll post the logs as soon as it is done.

system · 2017-11-07T21:14:12.000Z

Logs are attached.

SassDrake · 2017-11-07T21:42:05.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\Run: [ Maintance] => "C:\Program Files\\net1.exe" windowsStartup
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: E - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {34a40282-5427-11e6-9ffe-f82fa8e6e870} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a4cabf1d-55b8-11e6-b568-f82fa8e6e870} - I:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a69de2c5-50d5-11e6-8efe-806e6f6e6963} - Q:\LenovoQDrive.exe
cmd: type "C:\Users\Craig\Documents\sub_drvs.bat"
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
VirusTotal: C:\Program Files\net1.exe;C:\Users\Craig\AppData\Local\vsdgbtk\wirlhpx.exe;C:\Windows\system32\Drivers\sbsvzcfi.sys
C:\Program Files\net1.exe
C:\Users\Craig\AppData\Roaming\et
C:\Users\Craig\AppData\Local\PCBooster
C:\Windows\system32\atozxdh
C:\Windows\SysWOW64\atozxdh
C:\Users\Craig\AppData\Local\pwdxlbk
C:\Users\Craig\AppData\Local\vsdgbtk
C:\Windows\system32\Drivers\sbsvzcfi.sys

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-11-07T21:59:06.000Z

Done! Fixlog.txt attached.

SassDrake · 2017-11-07T22:27:12.000Z

What is system status now?

system · 2017-11-07T22:34:20.000Z

I haven’t seen the original message for awhile. System Restore will still not launch either from the Windows menu, Run command or from command prompt.

SassDrake · 2017-11-07T22:37:14.000Z

Do you get any error message?

system · 2017-11-07T22:43:06.000Z

No, nothing happens at all. I even tried creating a new restore point earlier. It said it created successfully, but still no dice.

bob3160 · 2017-11-07T22:53:03.000Z

You may want to look at the following:
https://forum.avast.com/index.php?topic=164936.msg1284599#msg1284599

system · 2017-11-07T23:06:48.000Z

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

bob3160 · 2017-11-07T23:09:19.000Z

cglasser post:16:

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

It is quite possible but Sass Drake would be the expert to confirm that.

system · 2017-11-07T23:12:03.000Z

OK, I’ll assume so for now. Thanks very much for all of your help!

bob3160 · 2017-11-07T23:21:31.000Z

You’re welcome.

SassDrake · 2017-11-07T23:40:33.000Z

Malware you had should not be reason why System Restore Apllication won’t open. Follow these instructions and tell us results.
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

system · 2017-11-08T00:32:39.000Z

The sfc /scannow process is running now.

system · 2017-11-08T01:05:00.000Z

Process complete with message: “Windows Resource Protection found corrupt files but was unable to fix some of them.” Log attached.

SassDrake · 2017-11-08T12:12:08.000Z

Does System Restore application works now?

system · 2017-11-08T12:32:58.000Z

No. I was going to try re-running the sfc process after re-starting in safe mode. I had been thinking it might be necessary to completely reload Windows if that fails.

Announcements