Infected motherboard and Windows OS

Hey! Im actually not sure what the problem might be, but it feels like my motherboard loads up a infected version of Windows. I believe it started with a phyton script i wrote using chatgpt (i know, very stupid) to help me organise and delete double mp3 files. After that I started noticing frame drops in games and overall performance issues with my PC (boot time, cpu usage 100 percent). And also my Registry looks corrupted and it feels like there are different accounts that are still on my machine even tho I re installed windows multiple times. My taskmanager keeps showing SearchHost.exe with a lot of processes im not familiar with.

 

Hope this can be fixed. 

 

 

Hi averagewindowsuser,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution, before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Please give me some time to examine your logs and I will get back to you as soon as possible.

Dennis

Although there are no obvious signs of malware, I'd like to check some items and also run a cleanup/maintenance script, to try and improve performance.
We can then investigate any remaining issues/concerns and also run a malware scan, as a double check.
I see that you have Peer 2 Peer torrent software installed. It is likely that if you continue to use this, you will become infected, as malicious Worms, Trojans & Ransomware can spread across P2P file sharing networks
It would be wise to uninstall Peer 2 Peer programs, but  that choice is up to you. If you choose to remove the program, you can do so via Start >Settings >Apps>Apps & Features.
However if you still wish to keep it, please do not use until we are finished and your computer is clean and updated.
-----------------------------------------------------------------------------
Could you please run this FRST script next.
As a part of this I have included the The Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code. Also we will be resetting the firewall, as a precautionary measure, which may result in you having to re-enable some connections.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
cmd: type  C:\WINDOWS\system32\local.txt
cmd: type  C:\WINDOWS\system32\prime.txt
Folder: C:\Users\soera\AppData\Local\setup
Folder: C:\ProgramData\Reprise
Folder: C:\ProgramData\OrayClient
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restrictie <==== AANDACHT
GroupPolicy: Restrictie ? <==== AANDACHT
Policies: C:\ProgramData\NTUSER.pol: Restrictie <==== AANDACHT
S3 Browser; %SystemRoot%\System32\browser.dll [X]
S2 MBAMService; "F:\Virus\MBAMService.exe" [X]
S3 MBVpnTunnelService; "F:\Virus\MBVpnTunnelService.exe" [X]
S4 MSI_Center_Service; "C:\Program Files (x86)\MSI\MSI Center\MSI_Central_Service.exe" [X]
S4 uhssvc; "C:\Program Files\Microsoft Update Health Tools\uhssvc.exe" [X]
S3 cpuz149; \??\C:\WINDOWS\temp\cpuz149\cpuz149_x64.sys [X] <==== AANDACHT
S3 NTIOLib_CC_CPU; \??\C:\Program Files (x86)\MSI\MSI Center\Super Charger\NTIOLib_X64.sys [X]
HKLM\...\Run: [AweSun] => "C:\Program Files\Aweray\AweSun\AweSun.exe" --cmd=autorun (Geen bestand)
HKU\S-1-5-21-1972111791-3876880343-3799735429-1003\...\Run: [OneDrive] => "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background (Geen bestand)
HKU\S-1-5-21-1972111791-3876880343-3799735429-1003\...\Run: [RazerAppEngine] => "C:\Program Files\Razer\RazerAppEngine\RazerAppEngine.exe" --url-params=apps=synapse --launch-force-hidden=synapse --autoStart=1 (Geen bestand)
HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe /StartMinimized (Geen bestand)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Geen bestand)
Task: {2E4F4E6A-FB96-41E0-B937-1A7CD1627F94} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-1972111791-3876880343-3799735429-1003 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  /reporting (Geen bestand)
Task: {B5B00C89-21CB-4688-A207-A50925D93A36} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1972111791-3876880343-3799735429-1003 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  (Geen bestand)
Winsock: Catalog9 17 %windir%\system32\vsocklib.dll => Geen bestand
Winsock: Catalog9 18 %windir%\system32\vsocklib.dll => Geen bestand
Winsock: Catalog9-x64 17 %windir%\system32\vsocklib.dll => Geen bestand
Winsock: Catalog9-x64 18 %windir%\system32\vsocklib.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{07CA83F0-DF06-4E67-89DD-E80924A49512}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{3A308EFE-656D-46BB-9963-0A41C0D6BCA2}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuthLib64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\Microsoft.SharePoint.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /autoplay => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\Microsoft.SharePoint.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll => Geen bestand
CustomCLSID: HKU\S-1-5-21-1972111791-3876880343-3799735429-1003_Classes\CLSID\{F37369D9-1C22-40A0-A997-0B4D5F7B6637}\localserver32 -> "C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileCoAuth.exe" => Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => F:\Virus\mbshlext.dll -> Geen bestand
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => F:\Virus\mbshlext.dll -> Geen bestand
ContextMenuHandlers1_S-1-5-21-1972111791-3876880343-3799735429-1003: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ContextMenuHandlers4_S-1-5-21-1972111791-3876880343-3799735429-1003: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
ContextMenuHandlers5_S-1-5-21-1972111791-3876880343-3799735429-1003: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Users\soera\AppData\Local\Microsoft\OneDrive\24.045.0303.0003\FileSyncShell64.dll -> Geen bestand
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /RestoreHealth
Emptytemp:
End::

• Click on the Fix button just once and wait.
• If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.