[dman1956]

My Win10 laptop (Dell Inspiron 3585) was hit with a couple of viruses back in Sept 2020.  I was able to quarantine them, but could only remove one.  Funny thing is, the history of those virus attacks later disappeared from my protection history.  How, I don't know.  Another weird thing that happened is when the viruses hit my system a voice speaking Spanish could be heard in the background.  After a couple of minutes, the voice stopped.  Then, later in the day, the voice came back for several minutes.  

 

I have my wifi router placed directly behind my laptop (within inches), so any chance the interference is coming from a microwave or refrigerator is unlikely.  Normal speed for my wifi connection is 50 mbps.

 

I've attached two screen recordings of my running a speed test showing what is going on.  You can definitely hear signal interference in the background on both recordings  There is a staticky noise and it happens each time I run the test.   

 

Sometimes, when I run the speed test, the first run occurs without issues, but after that, the signal interference happens and the speed slows dramatically.

 

I live out in the country (Arab, Alabama).  There a few homes and trailers nearby.  My hunch is someone is deliberately interfering with my wifi signal.  I tried using an ethernet connection and still got the interference (!).  Don't know how that's possible.  That's why I think there is some sort of virus embedded in my computer that Windows Defender can't find and remove.

 

I'd swear someone is remotely watching me play because the lag/latency issues with the game only start at the point where I'm entering a battle and starting to fire at other tanks.  

 

Any help someone could provide with resolving this issue would be greatly appreciated.

[Advertisements]

Maybe I should have posted this topic under Malware removal.  

 

Also, the signal interference and lag/latency will occur intermittently during game play, so it might let up for a few seconds, then start again, then go away, then start again.  Usually though, once I'm knocked out of the game it stops.  Really weird.   

[dman1956]

Maybe I should have posted this topic under Malware removal.  

 

Also, the signal interference and lag/latency will occur intermittently during game play, so it might let up for a few seconds, then start again, then go away, then start again.  Usually though, once I'm knocked out of the game it stops.  Really weird.   

[DR M]

Hello.

Welcome to GTG Forums.

I will be assisting you regarding your computer's issues. Here, we will check your computer for malware.

Please, adhere to the guidelines below, and then carefully follow, with the same order, all the instructions after:

1. Always ask before acting. Do not continue if you are not sure, or if something unexpected happens!

2. Do not run any tools unless instructed to do so. Also, do not uninstall or install any software during the procedure, unless I ask you to do so.

3. If your computer seems to start working normally, don't abandon the topic. Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.

4. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

5. Logs from malware diagnostic or removal programs can take some time to get analyzed. Also, have in mind that all the experts here are volunteers and may not be available to assist when you post. Please, be patient, while I analyze your logs.
 

==========================

Download Farbar Recovery Scan Tool and save it to your desktop. --> IMPORTANT

If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

[dman1956]

Thank you for your assistance, Dr. M. 

 

I downloaded and ran the Farbar Recovery Scan Tool.

 

The two logs generated by the scan are attached for your review.

 

 

 

 

Attached Files

•  Addition.txt   38.82KB   178 downloads
•  FRST.txt   31.4KB   172 downloads

[DR M]

Hi, dman1956.
 
There is no sign of infection in your logs. We can go a bit further to check your computer using different tools, but it seems that you should ask about advice in the Games forum, as soon as we finish from here. Needless to say that if you have evidence that you were/are hack you need to contact the Authoritiies. 
 
 

1. Notifications
 
Did you intentionally enabled notifications from the following sites?

hxxps://dlive.tv; 
hxxps://gab.com; 
hxxps://populist.press; 
hxxps://rightwirereport.com; 
hxxps://thegreggjarrett.com; 
hxxps://www.bandlab.com; 
hxxps://www.breitbart.com; 
hxxps://www.cbsnews.com; 
hxxps://www.churchmilitant.com; 
hxxps://www.thinkspot.com; 
hxxps://www.westernjournal.com; 
hxxps://www.youtube.com

 
2. Remove McAfee app
 
Click on the Start icon and find McAfee® Personal Security. Right click ad select Uninstall. Follow the instructions to uninstall it.
 
 
3. FRST fix

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
SystemRestore:On
CreateRestorePoint:
CloseProcesses:
FirewallRules: [TCP Query User{29D01CB2-8C36-456E-9C37-C272AC5C0B1A}C:\users\douglas martin\appdata\local\warthunder\launcher.exe] => (Allow) C:\users\douglas martin\appdata\local\warthunder\launcher.exe => No File
FirewallRules: [UDP Query User{ED48BA3E-2BD3-4BAF-AEBC-D7B23B32EA81}C:\users\douglas martin\appdata\local\warthunder\launcher.exe] => (Allow) C:\users\douglas martin\appdata\local\warthunder\launcher.exe => No File
FirewallRules: [{CFA9E6CF-3BD4-4DAB-B0CD-F9535B4800C3}] => (Block) C:\users\douglas martin\appdata\local\warthunder\launcher.exe => No File
FirewallRules: [{FEDF8128-DC4A-4F4D-A7C5-4FF383BA0C94}] => (Block) C:\users\douglas martin\appdata\local\warthunder\launcher.exe => No File
FirewallRules: [TCP Query User{57F59606-6F68-4188-9ED7-D77EA1677F9D}C:\users\douglas martin\appdata\local\warthunder\win64\aces.exe] => (Allow) C:\users\douglas martin\appdata\local\warthunder\win64\aces.exe => No File
FirewallRules: [UDP Query User{3EA4735C-B245-4714-80D4-3CF3C0CDDB5F}C:\users\douglas martin\appdata\local\warthunder\win64\aces.exe] => (Allow) C:\users\douglas martin\appdata\local\warthunder\win64\aces.exe => No File
EmptyTemp: 
End::

• Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please post the log in your next reply.

 

4. AdwCleaner (Scan mode)

Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click Scan Now.
  • When the scan has finished, a Scan Results window will open.
  • Click Cancel (at this point do not attempt to Quarantine anything that is found)
• Now click the Log Files tab.
  • Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number. The latest scan will have the largest number)
  • A Notepad file will open containing the results of the scan.
  • Please post the contents of the file in your next reply.

 

In your next reply please post:

1. Your reply about notifications
2. The fixlog.txt
3. The AdwCleaner[S0*].txt

[dman1956]

1. Notifications
 
Did you intentionally enabled notifications from the following sites?

 

YES.

 

 

2. Remove McAfee app

 
Click on the Start icon and find McAfee® Personal Security. Right click ad select Uninstall. Follow the instructions to uninstall it.

 

DONE.

 

 

3. FRST fix

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

DONE.  QUESTION: WHY DID YOU WANT ME TO SELECT AND COPY THE SCRIPT?  IT APPEARS YOU WANTED ME TO RUN IT, BUT YOU SAY 'NO NEED TO PASTE ANYTHING TO ANYWHERE.'

 

• Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Please post the log in your next reply.

DONE.  fixlist.txt attached.  

 

 

4. AdwCleaner (Scan mode)

Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click Scan Now.
  • When the scan has finished, a Scan Results window will open.
  • Click Cancel (at this point do not attempt to Quarantine anything that is found)
• Now click the Log Files tab.
  • Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number. The latest scan will have the largest number)
  • A Notepad file will open containing the results of the scan.
  • Please post the contents of the file in your next reply.

DONE.  AdwCleanerS00.txt attached.  

 

Attached Files

•  Fixlog.txt   3.53KB   167 downloads
•  AdwCleanerS00.txt   2.59KB   173 downloads

[dman1956]

I incorrectly said that Fixlist.txt was attached.  It's actually Fixlog.txt. 

[DR M]

Hi, dman1956.
 
Thanks for the information given. As for the "copy and not paste", that's the way the tool works. If you do not select/copy, the fix won't run.


1. AdwCleaner (Clean mode)

Let me explain to you the log created by AdwCleaner:

The findings in Folders and Registry parts of the log, are PUPs which stands for Potentially Unwanted Programs. In the instructions below, I will list them all to be removed.

The section at the bottom under Preinstalled Software is software that was apparently installed when the device was new, which you may or may not use. Personally, I don't want any program I don't use/need and I would remove everything. But it's your computer, so your decision.
 
To proceed, please do the following:

• Double click AdwCleaner.exe on your Desktop, to run it as you did before.
• Click Scan Now.
• When the scan has finished a Scan Results window will open.
• Please check all the boxes and then click Quarantine.
• Click Next.
  • If any pre-installed software was found on your machine, a prompt window will open. Click OK to close it.
  • Check any pre-installed software items you want to remove.
  • Click Quarantine.
• A prompt to save your work will appear.
  • Click Continue when you're ready to proceed.
• A prompt to restart your computer will appear.
  • Click Restart Now.
• Once your computer has restarted:
  • If it doesn't open automatically, please start AdwCleaner.
  • Click the Log Files tab.
  • Double click on the latest Clean log (Clean logs have a [C0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
  • A Notepad file will open containing the results of the removal.
  • Please post the contents of the file in your next reply.

 

2. Eset Online Scanner

Download ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time, perhaps up to a couple of hours or more.
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

 

3. Fresh FRST logs

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

 

In your next reply please post:

1. The AdwCleaner[C0*].txt
2. The eset.txt
3. The fresh FRST logs (FRST and Addition)

[DR M]

Do you still need assistance? 

[dman1956]

Yes.  Will reply shortly with requested information.

[dman1956]

1. AdwCleaner (Clean mode)

• • If it doesn't open automatically, please start AdwCleaner.
  • Click the Log Files tab.
  • Double click on the latest Clean log (Clean logs have a [C0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
  • A Notepad file will open containing the results of the removal.
  • Please post the contents of the file in your next reply.

 

# -------------------------------

# Malwarebytes AdwCleaner 8.2.0.0

# -------------------------------

# Build:    03-22-2021

# Database: 2021-05-17.1 (Cloud)

# Support:  https://www.malwarebytes.com/support

#

# -------------------------------

# Mode: Clean

# -------------------------------

# Start:    05-19-2021

# Duration: 00:00:15

# OS:       Windows 10 Home

# Cleaned:  13

# Awaiting reboot:2

# Failed:   0

 

 

***** [ Services ] *****

 

No malicious services cleaned.

 

***** [ Folders ] *****

 

Deleted       C:\ProgramData\SecuritySuite

Deleted       C:\ProgramData\TotalAV

 

***** [ Files ] *****

 

No malicious files cleaned.

 

***** [ DLL ] *****

 

No malicious DLLs cleaned.

 

***** [ WMI ] *****

 

No malicious WMI cleaned.

 

***** [ Shortcuts ] *****

 

No malicious shortcuts cleaned.

 

***** [ Tasks ] *****

 

No malicious tasks cleaned.

 

***** [ Registry ] *****

 

Deleted       HKCU\Software\SSProtect

Deleted       HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.totalav.passwordvaultassistant

Deleted       HKLM\SOFTWARE\Mozilla\NativeMessagingHosts\com.totalav.passwordvaultassistant

 

***** [ Chromium (and derivatives) ] *****

 

No malicious Chromium entries cleaned.

 

***** [ Chromium URLs ] *****

 

No malicious Chromium URLs cleaned.

 

***** [ Firefox (and derivatives) ] *****

 

No malicious Firefox entries cleaned.

 

***** [ Firefox URLs ] *****

 

No malicious Firefox URLs cleaned.

 

***** [ Hosts File Entries ] *****

 

No malicious hosts file entries cleaned.

 

***** [ Preinstalled Software ] *****

 

Deleted       Preinstalled.DellSupportAssistAgent   File   C:\Users\Public\Desktop\SupportAssist.lnk

Deleted       Preinstalled.DellSupportAssistAgent   Folder   C:\Windows\DELL\SUPPORTASSIST

Deleted       Preinstalled.DellSupportAssistAgent   Registry   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F4B2B7B9-20BE-41BA-824B-E3B7229E3110} 

Deleted       Preinstalled.DellSupportAssistAgent   Registry   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F4B2B7B9-20BE-41BA-824B-E3B7229E3110} 

Deleted       Preinstalled.DellSupportAssistAgent   Registry   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dell SupportAssistAgent AutoUpdate

Deleted       Preinstalled.DellSupportAssistAgent   Task   C:\Windows\System32\Tasks\DELL SUPPORTASSISTAGENT AUTOUPDATE

Needs Reboot  Preinstalled.DellUpdateforWindows10   Folder   C:\Program Files (x86)\DELL\UPDATESERVICE

Needs Reboot  Preinstalled.DellUpdateforWindows10   Folder   C:\ProgramData\DELL\UPDATESERVICE

 

 

*************************

 

[+] Delete Tracing Keys

[+] Reset Winsock

 

*************************

 

***** Reboot Required to Complete *****

 

 

***** [ Folders ] *****

 

Cleaning failed   C:\Program Files (x86)\DELL\UPDATESERVICE

Cleaning failed   C:\ProgramData\DELL\UPDATESERVICE

 

*************************

 

AdwCleaner[S00].txt - [2652 octets] - [16/05/2021 19:21:07]

AdwCleaner[S01].txt - [2713 octets] - [19/05/2021 06:27:27]

 

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

 

 

2. Eset Online Scanner

Download ESET Online Scanner and save it to your desktop.

 

I downloaded this program this morning at 7 am (CST) and started a full scan around 7:30 am.  It's still running.  I will forward the full scan log and new FRST logs as soon as the scan completes.  

 

[DR M]

I downloaded this program this morning at 7 am (CST) and started a full scan around 7:30 am. It's still running. I will forward the full scan log and new FRST logs as soon as the scan completes.

 

Yes... It can take a lot of time. However, it can detect some things that other scanners (like Malwarebytes) can't, so let it run.

 

Thank you for letting me know. 

[dman1956]

2. Eset Online Scanner

 

DONE.

 

The Eset scan completed without finding any threats - no Eset.text file generated.  See attached image confirming scan completed successfully.

 

 

 3. Fresh FRST logs

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply

DONE.

 

 

 

 

DONE.

Attached Thumbnails

• 

Attached Files

•  FRST.txt   31.37KB   171 downloads
•  Addition.txt   36.65KB   168 downloads

[DR M]

Hi, dman1956.
 
Since you decided to uninstall ay preinstalled software, you may consider do the following:
 
 
1. Uninstall Dell SupportAssist

• Press the Windows Key + R.
• Type appwiz.cpl in the Run box and click OK.
• The Add/Remove Programs list will open. Locate the following program on the list:

Dell SupportAssist

• Select the above program and click Uninstall.
• Restart the computer.

 

2. Uninstall preinstalled Dell apps

• Click on the Start icon, find the following apps, right click on them and select Uninstall. 

Dell Customer Connect 
My Dell 

• Restart the computer

 
3. FRST fix

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Start::
CreateRestorePoint:
CloseProcesses:
S2 Dell Hardware Support; "C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7240.285\DSAPI.exe" [X]
S2 DellSupportAssistGatewaySvc; %SystemRoot%\Dell\SupportAssist\SupportAssistGatewayService.exe [X]
R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [287776 2020-10-25] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3750944 2020-10-25] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [507936 2020-10-25] (Dell Technologies Inc. -> Dell Technologies Inc.)
R2 Dell Platform Service; C:\WINDOWS\Dell\DPS\ServiceShell.exe [74016 2019-07-05] (Dell Inc -> )
R2 DellClientManagementService; C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe [38592 2020-10-29] (Dell Inc -> )
R3 DellDPSDrv; C:\WINDOWS\System32\drivers\DellDPS.sys [36632 2019-07-05] (Dell Inc -> )
R3 DellRbtn; C:\WINDOWS\System32\drivers\DellRbtn.sys [29776 2018-10-04] (Dell Inc -> OSR Open Systems Resources, Inc.)
R3 DellSupportAssistDriver; C:\WINDOWS\System32\drivers\DellSupportAssist.sys [36608 2020-09-10] (Dell Inc. -> )
C:\Program Files\Dell
C:\WINDOWS\Dell
C:\Program Files (x86)\Dell
C:\WINDOWS\System32\drivers\DellDPS.sys
C:\WINDOWS\System32\drivers\DellRbtn.sys
C:\WINDOWS\System32\drivers\DellSupportAssist.sys
EmptyTemp: 
End::

• Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.
  • Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt on your Desktop.
  • Please post the log in your next reply.

 

In your next reply please post:

• The fixlog.txt after the uninstalls
• Feedback: How is the computer running now? Any remaining issue/question/concern?

[dman1956]

Appreciate all of your help up to this point, but I'm still experiencing the lag/latency issue with gaming (World of Tanks Blitz).  If I continue to remove pre-installed apps, what is your next recommended step after that?  I would kind of like to see where this is heading in terms of what you have planned.