Powershell.exe And Re-occuring Malware

Sadly I cleared what the antivirus programs found originally, but the virus/problem came back. However I do have the antivirus log from the previous clearing, and all programs were finding PUP variants. I attached the dated log labeled as malware.txt.. whereas Malwareantibytes.txt is the new log.

My current problem is that a CMD is starting with my startup, and a blue window appears quickly after that. I could not use a screenshot program to screenshot these windows even at 1 millisecond, so i used a video capturing software afterward. Through the video I can see the CMD is on the path: C:\Windows\System32\wbem\WMIC.exe and the blue windows is on the path: c:\windows\system32\windowspowershell\v.1.0\powershell.exe I can only assume someone is using these windows programs to install Trojans? So the virus keeps coming back?

With that said I don't really see anything malicious in ALT-CTRL-DEL, and when I went to the registry to delete the startup of powershell, it still came back. As well I saw something there called Yandex, deleted that too. Anyway I think I have some russian rootkit or something, I was installing a free powerpoint plugin for art/photowork and it was small in size but that's normally how big plugins are, and it installed all these programs even though I exited out of the installer. A lot of them might have been removed but it's clear something is lingering... and I did go to add/remove programs and uninstall them almost instantly too.

Also do you think I need to change my online passwords? Is there a keylogger here? Thanks.

 

Hi Dr. Moriarty,

Thank you for helping me, the majorgeeks team has been awesome through the years keeping peoples pc's safe.

Sorry about using the admin account, it was something i set up ages ago (maybe six or more years ago, back when i first installed win 7) and i have all my files and preferences set up on it, i wouldn't even know how to convert back at this point... but i do plan to buy a new PC next Christmas so this one is definitely getting a reformat then.

i did as you instructed, and the 1 millisecond appearance of the CMD and the blue window powershell.exe still appear on startup. this never happened before all this malware got installed... Maybe i should remove malware disconnected from the internet?

(EDIT: though maybe the reg-edit you just provided is a fix for that)

As well upon restart after deleting all the malware, my desktop had appearances of files that i created that are mine, that were originally located in my documents in their own folder. Except these files were all transparent, and have tildes besides the name? example: ~mypowerpresentation.ppt what on earth would cause them to magically appear on my desktop? could be something unrelated but thought i should report it.

Also i'm getting things like this a lot: https://ibb.co/4Zh5CyQ
i assume the very first time the trojans got installed was because i exited out of malwareantibytes at some point the very first time i cleaned everything? Anyway if something keeps sending my browser places it means it must not be fully removed? despite all the logs coming back clean. as well i get ransomware blocked popups from malwareantibytes.

It's interesting i thought Adwcleaner was Malwareantibytes, so i was like why would there be two versions of the same program? guess they are different because Adwcleaner found something Malwareantibytes didn't detect.

Here is an example of weird files appearing in random places: https://ibb.co/Sd53Rnr

The pictures and folders are all mine, but the files in red circles are new appearances and all have the tildes.

I'll do the regedit stuff now... it says it was successfully added to the registry.

 

Should I clean the viruses found using Zemana? I didn't press clean yet.

I'm still getting those pop windows CMD and Powershell. And I'm re-running all the scans again now.

 

I performed all the tasks in the order you gave them... including running the scanners in the order you wrote them down... i added the registry key and it said it was successful, and i restarted the computer. But because CMD and powershell keep popping up on restart/startup, i ran all the scanners again and they don't come up with any threats (and this is technically what happened the first time i removed the malware, no threats detected)... it was a day later when NEW malware came back... and i didn't do anything in between.

Malware antibytes keep blocking things? i didn't go to any websites, and my browser doesn't suffer from popups... https://ibb.co/0ySchJP

Anyway it's hard to explain the CMD and blue window that happens on start up but they last 1 millisecond, i was only able to read what they say because i made a video of my screen. Here is a link to the zipped video: https://ufile.io/in47t the event happens at 26-27 seconds in.

According to the scanners my PC is clean now, which is great if it lasts, but i want to get rid of the CMD and powershell thing too if at all possible...

 

Alright completed, here are the logs, also I don't use internet explorer, and i opened it to check it, and it has russian writing, so obviously something from the russian malware i downloaded got in there. Here is a screenshot. https://ibb.co/LQMXM2s

 

Attached fixlist.txt?

Hey since you said it might be a software issue, i googled the issue, and i found this website.
http://www.tomshardware.com/answers/id-2858821/windows-powershell-appears-startup.html

At first I went to windows 10 startup section and i didn't see anything there. But then i re-read the thread and it said to do this in ccleaner, so i did, and this was what i found.

https://ibb.co/PTF0kyZ

So AudiTVID is definitely a malware right? I've never seen this before, and it doesn't ring a bell for anything, as well when i did track down the registry entries for this and deleted it, it was also listed as AudiTVID.... what is this?

 

Okay finally, the eset scan took 4 hours...

 

Anyway, thank you. I think my PC is clear of malware except this AudiTVID thing... do you know if there is anyone who can help remove it? Even when I delete the registry entry it comes back every restart.

https://ibb.co/b3wBCSx

maybe I should have run this? I was infected with PUPS...

Junkware Removal Tool is a security utility that searches for and removes common adware, toolbars, and potentially unwanted programs (PUPs) from your computer. A common tactics among freeware publishers is to offer their products for free, but bundle them with PUPs in order to earn revenue.Nov 15, 2018