Suspect HDD activity and lots of suspectly named keys and key values in Registry

[yettyn]

Long story short, I decided to go Full S&D Professional after noticing some suspect activity on my Windows 10 system (more or less constant HDD activity on C:), which still is ongoing at this after running several scans and some careful cleanup with system repair. I also uninstalled some old apps no longer used, and I have also tried, without success, to trace what's going on with Task Manager. I'm note sure what has caused it, but today when I tried to open my VB6 environment (I'm a VB6 developer) I was met with this:

13269

and then it died when clicking OK button.

I don't know why VB6 asks for that file as it's nothing I'm using, but possibly it's some old legacy it's setup to load. This made me open Regedit to make a search for DAO350.DLL and found several item, which confirmed the file didn't exist where Windows supposedly expected it to be (Program Files(x86)\Common Files\Microsoft Shared\DAO\), but when I looked closer on the registry keys I saw this:

13270

and this:

13271

and that sure looks suspect to me. In fact, I found several "InprocServer32" keys with those suspect items, not only for DAO350/DAO.DBEngine.35 - but what is it? Is it a virus/trojan or other malware that S&D missed to detect, or something legit?

I also ran a Rootkit scan, where the quick scan showed ether "No hidden files detected, No hidden entries detected or No hidden processes detected" for all items. When I run a "Deep scan" it displays about 10 registry keys with "No admin in ACL" and a length list of file item with "Unkown ADS" in details. Most of the files are in "C;\Windows\Installer\$PatchCache$\Managed"

Anyone has any insight on this?

TIA

[tashi]

Hello yettyn,

The RootAlyzer is an analyst tool, sometimes even legitimate software uses rootkit technologies.

If you suspect an infection it would be best if someone can take a look at the system in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22)

Please start a new topic there, the forum's FAQ includes instructions in post #2 on how to provide the logs from Farbar Recovery Scan Tool and aswMBR, which are the two logs used in the preliminary analysis.

http://forums.spybot.info/showthread.php?t=288

Then a volunteer analyst will advise as soon as available. :)

Best regards,
tashi

[yettyn]

huh you must bet getting tired to repeat that in basically every post, but I'm sure you have a snippet ready to paste :)

but, yes I have got that, many legit items in the list, so nothing to be scared about the amount. Just a bigger challenge to find the needle in the haystack, so to speak.

I'll open a new topic in suggested fora when I'm done with my own research and if I don't manage to figure it out by myself. Something suspicious certainly going on with almost constant HDD activity, whether it has anything to do with those suspect registry entries or not.

Thanks.

Admin Edit: Malware forum topic: https://forums.spybot.info/showthread.php?77560-Need-help-to-trace-and-remove-source-of-malious-HDD-write-activity&p=485807#post485807