Threat sucured message ictkjkmd.top connection aborted

system · 2017-11-07T21:14:12.000Z

Logs are attached.

SassDrake · 2017-11-07T21:42:05.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\Run: [ Maintance] => "C:\Program Files\\net1.exe" windowsStartup
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: E - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {34a40282-5427-11e6-9ffe-f82fa8e6e870} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a4cabf1d-55b8-11e6-b568-f82fa8e6e870} - I:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a69de2c5-50d5-11e6-8efe-806e6f6e6963} - Q:\LenovoQDrive.exe
cmd: type "C:\Users\Craig\Documents\sub_drvs.bat"
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
VirusTotal: C:\Program Files\net1.exe;C:\Users\Craig\AppData\Local\vsdgbtk\wirlhpx.exe;C:\Windows\system32\Drivers\sbsvzcfi.sys
C:\Program Files\net1.exe
C:\Users\Craig\AppData\Roaming\et
C:\Users\Craig\AppData\Local\PCBooster
C:\Windows\system32\atozxdh
C:\Windows\SysWOW64\atozxdh
C:\Users\Craig\AppData\Local\pwdxlbk
C:\Users\Craig\AppData\Local\vsdgbtk
C:\Windows\system32\Drivers\sbsvzcfi.sys

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-11-07T21:59:06.000Z

Done! Fixlog.txt attached.

SassDrake · 2017-11-07T22:27:12.000Z

What is system status now?

system · 2017-11-07T22:34:20.000Z

I haven’t seen the original message for awhile. System Restore will still not launch either from the Windows menu, Run command or from command prompt.

SassDrake · 2017-11-07T22:37:14.000Z

Do you get any error message?

system · 2017-11-07T22:43:06.000Z

No, nothing happens at all. I even tried creating a new restore point earlier. It said it created successfully, but still no dice.

bob3160 · 2017-11-07T22:53:03.000Z

You may want to look at the following:
https://forum.avast.com/index.php?topic=164936.msg1284599#msg1284599

system · 2017-11-07T23:06:48.000Z

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

bob3160 · 2017-11-07T23:09:19.000Z

cglasser post:16:

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

It is quite possible but Sass Drake would be the expert to confirm that.

system · 2017-11-07T23:12:03.000Z

OK, I’ll assume so for now. Thanks very much for all of your help!

bob3160 · 2017-11-07T23:21:31.000Z

You’re welcome.

SassDrake · 2017-11-07T23:40:33.000Z

Malware you had should not be reason why System Restore Apllication won’t open. Follow these instructions and tell us results.
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

system · 2017-11-08T00:32:39.000Z

The sfc /scannow process is running now.

system · 2017-11-08T01:05:00.000Z

Process complete with message: “Windows Resource Protection found corrupt files but was unable to fix some of them.” Log attached.

SassDrake · 2017-11-08T12:12:08.000Z

Does System Restore application works now?

system · 2017-11-08T12:32:58.000Z

No. I was going to try re-running the sfc process after re-starting in safe mode. I had been thinking it might be necessary to completely reload Windows if that fails.

system · 2017-11-08T14:35:39.000Z

After a couple more reboots, system restore is now working. It shows only the restore point I created yesterday. Very strange. Have you any advice on further action?

bob3160 · 2017-11-08T14:38:01.000Z

That’s all you’re going to find unless you create another one or,
MS creates one before an update or a program creates one.

system · 2017-11-08T14:43:23.000Z

OK, I guess I should be content with getting the system up and running again. Thanks very much for all of your help!

Announcements