Does this sound like malware, or system file corruption?

[NobodyIsHome]

Yesterday when I booted my computer, I got the "Windows is updating, do not turn off your computer (or whatever)" screen. Immediately I was concerned because I did not do any updates the day before, and I have updates set to notify, but not download, the updates. Eventually the log-in screen came up so I logged in and did what I was intending to do. Since I tend to be a little paranoid, when I was done I decided to do a Malwarebytes Anti-malware scan. I started the scan and left the room. Returning 5-10 minutes later, my computer was on the bios screen! I couldn't figure out how to get out of there, so I did a hard shutdown. I then restarted the computer and it booted normally (I mean other than getting the screen "Windows did not shut down properly"). I decided to try the scan again, but this time I first cleaned the drive using Ccleaner. After cleaning I noticed it deleted a larger amount than usual, about 750 megs. Upon close inspection, I notice one file was 700 megs, the CBS_log file under Windows System Log files. I did some quick research online and it seems the cbs log file is a Windows log file that lists system errors. Anyway, I did the MBAM scan and this time it completed, and came back clean. While doing the research on what is a cbs file, I also came across instructions on the "System File Check (SFC) scan." So I did that scan (verify only) and that scan came back "Windows did not find any integrity violations."

Being somewhat paranoid as already stated, today I did a whole C drive scan using 1) Windows Malicious Software Removal Tool; 2) MBAM (again); 3) Malwarebytes Anti-Rootkit; and 4) Avast; and all 4 came back clean.

So, as the header asks, does what happened to my computer yesterday sound like malware, or just a system file(s) corruption? It appears to me to be the latter, but I'd like the opinion of some experts (which I am not). Thanks.

 

[derekimo]

Did you check your update history? There was an out of band update released yesterday or the day before.

Update changes the currency symbol of Lithuania from the Lithuanian litas (Lt) to the euro (

 

[americancritic2]

Hello and welcome if it is a system file corruption have you tried to do a SFC /scannow to see if it will repair it's self if not try here are the instructions.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[AddRAM]

He did a scan, it found no violations.

 

[whs]

It sounds like one of those gremlins for which we never find the cause. I think you have done the right things and there is nothing to worry about. I doubt that malware would start the system file checker - that just makes no sense.

 

[edy1en]

so you did worry about " I'm having a weird Windows Update, i leave them but it comeback with BIOS screen without someone triggering it?

try this check list:
1. are you using laptop? does the F2 keys faulty?
2. did you use bios update program installed? maybe you did do something with the program before.
3. try to dump your bios to file and check the hash with the one you downloaded from manufacturer website and compare it. since setting is in the ram part, you will have same checksum with the bios with same version, if not.. maybe it is some advanced rootkit or virus entered your system.
of course if you don't want to be hassled with this part... just get updated bios and flash your bios with it.

 

[ThrashZone]

Did you check your update history? There was an out of band update released yesterday or the day before.

Update changes the currency symbol of Lithuania from the Lithuanian litas (Lt) to the euro (

I love those types of updates so much I Hide them for later

 

[AddRAM]

You don`t have windows update set to automatic do you ?

 

[NobodyIsHome]

derekimo wrote:
Did you check your update history?

Yes, the last thing listed was from 2 days before.

americancritic wrote:
have you tried to do a SFC /scannow

Yes, it came back okay.

AddRAM wrote:
You don`t have windows update set to automatic do you?

No, I have it set to check, but download it myself (not automatic).

whs wrote:
It sounds like one of those gremlins for which we never find the cause. I think you have done the right things and there is nothing to worry about.

That's what I'm thinking.

Thanks to everyone for your help/comments.