Solved W7/64 freeze after few seconds; strange items in WMI

[Fenichel]

A week ago (April 1st, possibly pertinent), my computer became inoperable in Normal Mode. A few seconds after my desktop appears, the mouse continues to control the on-screen cursor, but no input from mouse or keyboard is recognized, and the only exit is a hardware reset. I am now in Safe Mode. Multiple diagnostic attempts have failed to find the problem. Various AV scans have found nothing.
The Event View shows that during each boot, these items

SQLServerEventProvider
    InvProv
    SQLServerEventProvider
    ActiveScriptEventConsumer
    CommandLineEventConsumer
    LogFileEventConsumer
    WpcClamperProv
    MS_NT_EVENTLOG_EVENT_PROVIDER
    HiPerfCooker_v1

are registered with the Windows Management Interface; they didn't used to be, and I think they are the problem. I also see that the only Restore Point on my system now is one that was created a few seconds after midnight on April 1st.
In another sevenforums thread, I found this sequence

Change startup type of Window Management Instrumentation (WMI) Service to disabled
     Stop the WMI Service; you may need to stop IP Helper Service first or other dependent services before it allows you to stop WMI Service
     Rename the repository folder: C:\WINDOWS\system32\wbem\Repository to Repository.old
     Open a CMD Prompt with elevated privileges
     CD windows\system32\wbem
     for /f %s in ('dir /b /s *.dll') do regsvr32 /s %s
     Set the WMI Service type back to Automatic and start WMI Service
     cd /d c:\ ((go to the root of the c drive, this is important))
     for /f %s in ('dir /s /b *.mof *.mfl') do mofcomp %s
     Reboot the server

to run in Safe Mode. The first few times I did this, the next Normal Mode boot would succeed, but then even this method stopped working, so I am stuck in Safe Mode.
Any suggestions will be welcome.

 

[Mellon Head]

Have you run sfc /SCANNOW from an elevated command prompt in Safe Mode? Run it three times to see if it catches everything.

It sounds like you've been had by a trojan or some kind of malware. The trick is finding it.

 

[Fenichel]

Yes, I think it's malware. You can see my results from sfc; the three files are the results of one run, not 3, broken into 3 files because of the forum's limits on uploaded file size.
The more telling result comes from chkdsk. I ran it with the /f argument at boot time, then without the argument while running in safe mode. As you see, I have an MFT problem, not fixed by chkdsk. I wish there were a way to fix this without scrubbing the disk, but I am not hopeful.

 

[Fenichel]

how to reload a selectively-updated Windows 7/64

I said in the last message that chkdsk had found a telltale Master File Table problem, and that was true. I ran it at boot time with the /F option, its results passed by too fast to read, then I ran it from the (Safe Mode) desktop without the /F, and it showed an unfixed MFT error. Then I ran it again from the desktop, this time piping it to the text file that I uploaded for the forum. I didn't look at the text file, assuming that it would show the same MFT problem, but of course it doesn't. Now, FWIW, I have determined with other software that the MFT, whether or not it is sound, is identical to its mirror copy. I don't know what's going on.

I am not looking forward to reloading Windows, but I think I'll have to do that. Just reloading from the DVD doesn't take much time, but there are any number of wanted updates and a small number of distinctly unwanted updates that I'll need to be alert to avoid, and then there'll be a few days of reinstalling all my applications.

I vaguely remember hearing of DVDs that provided Windows 7/64 in a moderately-updated state, speeding up the reloading process by at least a few hours. Are people on this forum familiar with those?

 

[Mellon Head]

I vaguely remember hearing of DVDs that provided Windows 7/64 in a moderately-updated state, speeding up the reloading process by at least a few hours. Are people on this forum familiar with those?

I think you're thinking of a Windows ISO with some of the updates slip-streamed into it. I would highly recommend avoiding these types of ISOs, because they often come from questionable sources and are often riddled with malware.

That's not to say that you couldn't make your own slip-streamed copy with the updates that you want to include. I just don't know how to do it, personally.

But take heart and stay tuned, I've asked some more experienced members of the forum to look into this thread and perhaps offer some advice

 

[Layback Bear]

Exactly what security programs were used to scan the computer?

Just exactly what Windows 7 are you using?

Do you have any backups or Clones?

Do others have access to your computer?

Jack

 

[Fenichel]

Exactly what security programs were used to scan the computer?

Kaspersky, MSE

Just exactly what Windows 7 are you using?

7/64 SP1, up to date with updates through last fall, when I lost confidence in my ability to keep MS from forcing Windows 10 on me

Do you have any backups or Clones?

I have good backups of all my data, but no clone that would allow for painless scrub-and-reload.

Do others have access to your computer?

No.
Also, you should know that I have probably found the original source of my problem, but not how to fix it. Yesterday I tried to write a new DVD of my recent data, and the DVD writer complained during the pre-write caching phase that one file had a bad handle. The DVD writer (Nero), thought this was non-critical, so I let it go ahead. During the write phase, Nero froze, possibly trying to copy this file, and I had to stop it from the Task Manager.
The file in question was I2CDEV.cpp, a file I had extracted from a GitHub ZIP file 8 months ago. Its claimed size on my disk was 56K, probably much bigger than it legitimately should be, and it showed up green (encrypted) in Windows Explorer. I can imagine ways of hiding malware between the declared EOF and the actual end of an ASCII file like <xxx>.cpp, although I'd never heard of this as a means of malpropagation before. I deleted this file; I'm sure I have it on a backup somewhere, if anyone wants it for forensic purposes.

 

[Layback Bear]

Good going Fenichel you found a problem.
It might not be a infection. Just might be a corrupt file.

These two programs I recommend using when needed to verify their are not bad guys are hanging around.

Malwarebytes and Eset free online scan.

Jack

 

[Ranger4]

Kaspersky, MSE
7/64 SP1, up to date with updates through last fall, when I lost confidence in my ability to keep MS from forcing Windows 10 on me
I have good backups of all my data, but no clone that would allow for painless scrub-and-reload.
No.
Also, you should know that I have probably found the original source of my problem, but not how to fix it. Yesterday I tried to write a new DVD of my recent data, and the DVD writer complained during the pre-write caching phase that one file had a bad handle. The DVD writer (Nero), thought this was non-critical, so I let it go ahead. During the write phase, Nero froze, possibly trying to copy this file, and I had to stop it from the Task Manager.
The file in question was I2CDEV.cpp, a file I had extracted from a GitHub ZIP file 8 months ago. Its claimed size on my disk was 56K, probably much bigger than it legitimately should be, and it showed up green (encrypted) in Windows Explorer. I can imagine ways of hiding malware between the declared EOF and the actual end of an ASCII file like <xxx>.cpp, although I'd never heard of this as a means of malpropagation before. I deleted this file; I'm sure I have it on a backup somewhere, if anyone wants it for forensic purposes.

While I don't want to rub salt into your present problem, it is good example of why you should run regular operating system back up images. If you had a recent image you could have reinstalled it & been back working again in very short time.

You have said that you have your data backed up to DVDs, which is certainly a start, but DVD are a messy way of backing up data.

A lot of members including myself use Macrium Reflect to create system images on a regular basis. A correctly done image backs up Windows, all your data as well as any installed programs.

It's best to back up to a hard drive, either an internal one or preferably an external one, as it's not a good idea to have the back up drive connected to the computer all the time as there is a possibility of a bad virus infection hitting your main system as well as the internal back up drive.

So you can give this some thought, have a look at this Macrium website. There is a free version & some paid version.

Macrium Reflect Free | Macrium Software

 

[Fenichel]

I didn't describe my whole backup system; DVDs are a small part of it. I also use CrashPlan to provide minute-by-minute backup of data.
I hadn't thought about cloning before, but I'm glad that Layback Bear and (more forcefully) you brought it up. I will be looking into when I'm back to some sort of steady state.

 

[Layback Bear]

I use Macrium Reflect to make backup's and Clones.
They are install on external ssd's.

I used one the other day because of a infection. As a matter of fact I'm on the Clone at the present time. It works like the older install, except without the infection. Just like it was designed to do.

Jack

 

[ICIT2LOL]

For what it is worth I agree with what the others are saying and personally that chkdsk I always run with the /r switch which unless I am terribly mistaken goes through the /f during the chkdsk operation.
With the Kaspersky I find that it will pick up a lot of stuff in a basically non Windows based program ie FF and Thunderbird. So what would be interesting to know is at what levels of security/sensitivity you have set in the KISS too I find using high level settings in Web Antivirus and Mail Antivirus settings for example do tend to make the KISS overly sensitive to what else goes on with Windows.
But this is only my two cents worth and what the others are saying and advising ie imaging is so important and me I do mine on regular basis and for the tie it takes it is not worth the grief.

 

[Fenichel]

Just to give you all a progress report: MalwareBytes found some strange-looking registry entries (not just GUIDs, which are always strange), and these (see attachment) were quarantined. Eset is doing an end-to-end scan, and has about 400 GB of stuff to go through. So far (1 hour 16 minutes, 580K items checked), it has found 12 files it doesn't like, but I won't know what they are until it's done.

When Eset finishes, I'll probably accept all of its quarantine recommendations, but before trying another Normal-mode boot I'll be back here for last-minute advice. Since starting this thread, I've made some parallel attempts to find the problem, and in some ways I seem to have made things worse.

1. I had had only about 13% free space on my C: drive, so I extended it.
2. In my first Normal-mode boot after this expansion, the freeze didn't happen until after close to a minute after the desktop appeared. I don't know if the volume-expansion had anything to do with this. In any event, I now had time to get into ProcMon and ask for a bootlog.
3. On the next Normal-mode boot, I expected ProcMon to tell me it had a boot log waiting, but it didn't. I saved the log it did have (probably useless non-boot stuff), and you can see it, if you wish, on my Web site here.
4. I tried to do another ProcMon run, thinking that I might have missed some part of the boot-log-capturing procedure (ProcMon is not a program I am at all familiar with). I set it up, rebooted, and during the reboot encountered an AVGUI error. I pushed ahead, but now I have no Normal-mode desktop. Instead, there is an all-cream screen (no task bar, no Start menu) with a tiny white legend claiming (falsely) that my copy of Windows is not a legal one.

 

[ICIT2LOL]

Now I did ask if you have any really hard settings in the Kaspersky so have you?? If that MBAM is a free one then ok but if it is a real time / paid for then again Kaspersky does not like playing with other AV's like that.

 

[Layback Bear]

From you log.

PUP.Optional.Conduit, C:\USERS\ROBERT R. FENICHEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\702QQ0Q4.DEFAULT\PREFS.JS, Replaced, [522], [301520],1.0.1694

Conduit is very worrisome.

I have always removed all PUP's found by Malwarebytes and or Eset. Never had any problems.

Malwarebytes 3.0 Trial version will act just like the paid for version until the time expires.

I have been running Malwarebytes 3.0 Premium along side MSE for about a week and have had no problems.
I have no idea if it runs well with other anti virus programs. Malwarebytes says it okay with other anti virus programs but one will just have to test to make sure.

TFC by Old Timer doesn't get along with Malwarebytes 3.0. I had to remove TFC.

If I don't have any problems with Malwarebytes 3.0 for about another week I will upgrade my other system to 3.0.

Jack

 

[ICIT2LOL]

Conduit is very worrisome.

Yes Jack have come across this a few moons ago and it was ugly then I did find this though
What is Conduit browser hijacker? - Definition from WhatIs.com

It would be worth running this if it hasn't already
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

I still would like to know about those Kaspersky settings as well.

 

[Fenichel]

In Safe Mode, I am not sure how to access my Kaspersky settings. I have the paid, full version of Kaspersky.

 

[Fenichel]

I have a question for the clone-experienced contributors. When I first thought about cloning, quite a few years ago, I thought that it couldn't work. My thought was that most disk drives have a few unusable sectors here and there, identified to prevent their being allocated, but straight copying of one HDD onto another would not take proper account of the receiving HDD's bad sectors. Now, obviously my thinking was wrong, but what did I miss?

 

[Fenichel]

SuperAntiSpyware found lots of tracking cookies, but only 2 files of interest. One was Borland's Package Collection Editor; this dates from 2002, and I strongly suspect that it's a false positive. The other is Unlocker, that I use only every year or so to get rid of files that appear to be open by nonexistent userrs. I haven't used either of these for a very long time.

I can't find any trace of Conduit on my machine, but I haven't used any specialized tools to find it.

In view of the bizarre difficulty I had when I last tried to get into Normal mode (see message #13), is there anything I should do before trying again?

 

[ICIT2LOL]

Ok mate have just tried it out in safe mode on my tester as I have never used safe mode for disabling it.

Now get into safe mode Start > All programs > open the Kaspersky program listing >open the Kaspersky GUI > click on Settings (lower left) of GUI > go to the General tab > then turn off that other button to activate Protection > it will open a small window asking you to choose how long you want ti pause the pritection > do that and if you have protected the Settings it will ask you to type the password for that > then Enter.

The prog rm will switch off for that allocated time. It is a good idea to add a permission viw=a your own password to change settings in case someone inadvertently or maliciously tries to reset the level of protection with in your AV.

Just tip make sure you have the current edition of the program by clicking on the small icon in blue circle. You should do that after each install or major updates after a reboot from those updates - not the malware database ones.

Pics are of my small 10 laptop but will look the same in 7/