Malware Log Analysis

Start:: SystemRestore: On CreateRestorePoint: CloseProcesses: AVG Update Helper (HKLM-x32\...\{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5}) (Version: 1.8.1693.6 - AVG Technologies) Hidden GroupPolicy: Restriction ? <==== ATTENTION Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION File: C:\Users\dngo7\Downloads\Programs\GhostDeck.exe Folder: C:\WINDOWS\system32\Tasks\GhostDeck Folder: C:\Users\dngo7\AppData\Roaming\GhostDeck Task: {B13420CB-13DA-4F46-852E-C9C1F5242D6C} - System32\Tasks\GhostDeck => C:\Users\dngo7\Downloads\Programs\GhostDeck.exe [162788368 2026-07-17] (—) [File not signed] [File is in use] <==== ATTENTION C:\Users\dngo7\Downloads\Programs\GhostDeck.exe 2026-07-18 03:42 - 2026-07-18 03:42 - 000003280 _____ C:\WINDOWS\system32\Tasks\GhostDeck 2026-07-17 12:48 - 2026-07-17 14:34 - 000000000 ____D C:\Users\dngo7\AppData\Roaming\GhostDeck Zip: C:\Windows\Temp\DCRCVDrv.sys S3 NvStreamKmd_dcrcv; C:\Windows\Temp\DCRCVDrv.sys [141240 2026-07-23] (Microsoft Windows Hardware Compatibility Publisher -> MOCOMSYS & DCRC) <==== ATTENTION C:\Windows\Temp\DCRCVDrv.sys FCheck: C:\WINDOWS\system32\MpCmdRun.exe [2025-06-11] <==== ATTENTION (zero byte File/Folder) Folder: C:\ProgramData\Common C:\Users\dngo7\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbebcjgcmobigpeffafkodonchffocl SearchScopes: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File IE trusted site: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\webcompanion.com -> hxxp://webcompanion.com HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {1cc7b19b-4ca4-11f1-8837-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {1cc7cc7e-4ca4-11f1-8837-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {1cc7cccf-4ca4-11f1-8837-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {245a7bbd-4337-11f1-882a-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {3968c370-5939-11f1-8844-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {3968c528-5939-11f1-8844-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {99b6049a-3b6c-11f1-8828-345a601ff3fe} - "E:\OnePlus_USB_Drivers_Setup.exe" HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {bbb0bd14-52a3-11f1-883f-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {bbb0bd43-52a3-11f1-883f-345a601ff3fe} - "D:\OnePlus_setup.exe" /s HKU\S-1-5-21-1029224622-1212531496-3759611801-1001\...\MountPoints2: {c138b524-306f-11f1-8822-345a601ff3fe} - "E:\HTC_Sync_Manager_PC.exe" Task: {6986AB53-5703-4C2D-A719-C505A6A7F2EE} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No File) Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File) S4 phantomtap; \SystemRoot\System32\drivers\phantomtap.sys (No File) CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{19537814-C79B-4BE5-99E9-2E2F1FFEF4E1}\localserver32 -> C:\Users\dngo7\AppData\Local\WeMod\app-12.37.0\Wand.exe => No File CustomCLSID: HKU\S-1-5-21-1029224622-1212531496-3759611801-1001_Classes\CLSID\{273CD8A9-178E-4D03-8805-5E14D1F3914A}\localserver32 -> C:\Users\dngo7\AppData\Local\WeMod\app-12.36.0\Wand.exe => No File Comment: This snippet removes all Windows Defender exclusions DeleteKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths StartPowershell: Try { $Paths=(Get-MpPreference).ExclusionPath $Extensions=(Get-MpPreference).ExclusionExtension $Processes=(Get-MpPreference).ExclusionProcess foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop } foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop } foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop } } Catch { Write-Error "Error occurred while removing Windows Defender exclusions: $_" } EndPowershell: Comment: Remove unwanted files from common folders using native removal power of Farbar to include remove on reboot if needed. Please double check the user does not have any applications incorrectly installed in the directories listed below.¨ C:\ProgramData\*.csproj C:\ProgramData\*.a3x C:\ProgramData\*.ahk C:\ProgramData\*.au3 C:\ProgramData\*.bat C:\ProgramData\*.cab C:\ProgramData\*.cmd C:\ProgramData\*.com C:\ProgramData\*.dll C:\ProgramData\*.exe C:\ProgramData\*.hta C:\ProgramData\*.jar C:\ProgramData\*.js C:\ProgramData\*.jse C:\ProgramData\*.lnk C:\ProgramData\*.pif C:\ProgramData\*.ps1 C:\ProgramData\*.py C:\ProgramData\*.pyc C:\ProgramData\*.pyd C:\ProgramData\*.scr C:\ProgramData\*.tmp C:\ProgramData\*.vbe C:\ProgramData\*.vbs C:\ProgramData\*.wsf C:\ProgramData\*.wsh C:\ProgramData\*.zip C:\ProgramData\*.rar C:\ProgramData\*.7z C:\Users\*\AppData\Roaming\*.csproj C:\Users\*\AppData\Roaming\*.au3 C:\Users\*\AppData\Roaming\*.bat C:\Users\*\AppData\Roaming\*.cab C:\Users\*\AppData\Roaming\*.cmd C:\Users\*\AppData\Roaming\*.com C:\Users\*\AppData\Roaming\*.dll C:\Users\*\AppData\Roaming\*.exe C:\Users\*\AppData\Roaming\*.hta C:\Users\*\AppData\Roaming\*.jar C:\Users\*\AppData\Roaming\*.js C:\Users\*\AppData\Roaming\*.jse C:\Users\*\AppData\Roaming\*.lnk C:\Users\*\AppData\Roaming\*.pif C:\Users\*\AppData\Roaming\*.ps1 C:\Users\*\AppData\Roaming\*.py C:\Users\*\AppData\Roaming\*.pyc C:\Users\*\AppData\Roaming\*.pyd C:\Users\*\AppData\Roaming\*.scr C:\Users\*\AppData\Roaming\*.tmp C:\Users\*\AppData\Roaming\*.vbe C:\Users\*\AppData\Roaming\*.vbs C:\Users\*\AppData\Roaming\*.wsf C:\Users\*\AppData\Roaming\*.wsh C:\Users\*\AppData\Roaming\*.zip C:\Users\*\AppData\Roaming\*.rar C:\Users\*\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\*.csproj C:\Users\CurrentUserName\AppData\Local\*.a3x C:\Users\CurrentUserName\AppData\Local\*.ahk C:\Users\CurrentUserName\AppData\Local\*.au3 C:\Users\CurrentUserName\AppData\Local\*.bat C:\Users\CurrentUserName\AppData\Local\*.cab C:\Users\CurrentUserName\AppData\Local\*.cmd C:\Users\CurrentUserName\AppData\Local\*.com C:\Users\CurrentUserName\AppData\Local\*.dll C:\Users\CurrentUserName\AppData\Local\*.exe C:\Users\CurrentUserName\AppData\Local\*.hta C:\Users\CurrentUserName\AppData\Local\*.jar C:\Users\CurrentUserName\AppData\Local\*.js C:\Users\CurrentUserName\AppData\Local\*.jse C:\Users\CurrentUserName\AppData\Local\*.lnk C:\Users\CurrentUserName\AppData\Local\*.pif C:\Users\CurrentUserName\AppData\Local\*.ps1 C:\Users\CurrentUserName\AppData\Local\*.py C:\Users\CurrentUserName\AppData\Local\*.pyc C:\Users\CurrentUserName\AppData\Local\*.pyd C:\Users\CurrentUserName\AppData\Local\*.scr C:\Users\CurrentUserName\AppData\Local\*.tmp C:\Users\CurrentUserName\AppData\Local\*.vbe C:\Users\CurrentUserName\AppData\Local\*.vbs C:\Users\CurrentUserName\AppData\Local\*.wsf C:\Users\CurrentUserName\AppData\Local\*.wsh C:\Users\CurrentUserName\AppData\Local\*.zip C:\Users\CurrentUserName\AppData\Local\*.rar C:\Users\CurrentUserName\AppData\Local\*.7z C:\Users\CurrentUserName\AppData\Roaming\*.csproj C:\Users\CurrentUserName\AppData\Roaming\*.a3x C:\Users\CurrentUserName\AppData\Roaming\*.ahk C:\Users\CurrentUserName\AppData\Roaming\*.au3 C:\Users\CurrentUserName\AppData\Roaming\*.bat C:\Users\CurrentUserName\AppData\Roaming\*.cab C:\Users\CurrentUserName\AppData\Roaming\*.cmd C:\Users\CurrentUserName\AppData\Roaming\*.com C:\Users\CurrentUserName\AppData\Roaming\*.dll C:\Users\CurrentUserName\AppData\Roaming\*.exe C:\Users\CurrentUserName\AppData\Roaming\*.hta C:\Users\CurrentUserName\AppData\Roaming\*.jar C:\Users\CurrentUserName\AppData\Roaming\*.js C:\Users\CurrentUserName\AppData\Roaming\*.jse C:\Users\CurrentUserName\AppData\Roaming\*.lnk C:\Users\CurrentUserName\AppData\Roaming\*.pif C:\Users\CurrentUserName\AppData\Roaming\*.ps1 C:\Users\CurrentUserName\AppData\Roaming\*.py C:\Users\CurrentUserName\AppData\Roaming\*.pyc C:\Users\CurrentUserName\AppData\Roaming\*.pyd C:\Users\CurrentUserName\AppData\Roaming\*.scr C:\Users\CurrentUserName\AppData\Roaming\*.tmp C:\Users\CurrentUserName\AppData\Roaming\*.vbe C:\Users\CurrentUserName\AppData\Roaming\*.vbs C:\Users\CurrentUserName\AppData\Roaming\*.wsf C:\Users\CurrentUserName\AppData\Roaming\*.wsh C:\Users\CurrentUserName\AppData\Roaming\*.zip C:\Users\CurrentUserName\AppData\Roaming\*.rar C:\Users\CurrentUserName\AppData\Roaming\*.7z C:\Users\CurrentUserName\AppData\Local\Temp\* CMD: cscript c:\windows\system32\slmgr.vbs /xpr & cscript c:\windows\system32\slmgr.vbs /dlv CMD: netsh int ip reset CMD: ipconfig /flushDNS CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: netsh winhttp reset proxy CMD: netsh winsock reset catalog CMD: bitsadmin /reset /allusers CMD: Winmgmt /salvagerepository CMD: winmgmt /resyncperf CMD: DISM.exe /Online /Cleanup-image /Restorehealth CMD: sfc /scannow Hosts: RemoveProxy: EmptyTemp: End::