Trojan.Bitcoin.Miner - dwm.exe

[brechtendeure]

Hi,

 

Recently ive had problems with a Trojan.Bitcoin.Miner in a folder iswizard (C:\Users\Name\AppData\Local\Temp\iswizard\) its located in a .7z zip file: dwm.exe. When i remove it with Malwarebytes Anti-Malware it seems to relocate itself in that folder. Then Anti-Malware puts it back in Quarantine. My anti-virus program seems to also not solve this problem.

 

I have noticed that this problem had occured to somebody else on this forum. You have helped him get rid of it, and now I wonder if I can just follow the same steps you provided the other user with, or that I need personal assistance. It seems to be a hard-to-get-rid-off virus, so I rather not take any chances.

 

Please help

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

 

Kevin

[brechtendeure]

Here are both logs...

Addition.txt

FRST.txt

[kevinf80]

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Next

 

Run Malwarebytes,  Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware,

Make sure that everything is checked, and click Remove Selected on any found items.

 

Post the produced log

 

Next,

 

Download CKScanner from here: http://downloads.malwareremoval.com/CKScanner.exe

 

Important - Save it to your desktop.

 

Doubleclick CKScanner.exe (Right click and "Run as administrator" in Vista/Win7).

Give permission if necessary, and click Search For Files.

After a very short time, when the cursor hourglass disappears, click Save List To File.

A message box will verify the file saved. Please run the program once only.

Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

 

Let me see those logs..

fixlist.txt

[brechtendeure]

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler6.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler6.dll
c:\unrealtournament\maps\ctf-bt-ttfaf-forcrackspider-v3.unr
c:\windows\prefetch\keygen.exe-cc82967c.pf
scanner sequence 3.FF.11.LBNAXZ
 ----- EOF -----
 

Fixlog.txt

mbam-log-2013-11-07 (03-06-20).txt

[kevinf80]

CKScanner log is not correct, four (4) entry lines are missing. Post full log please....

[brechtendeure]

Excuse me. I don't know what went wrong...

 

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad
c:\frst\quarantine\utorrent\atomic email hunter 7.0 incl.crack 100% working.torrent
c:\frst\quarantine\utorrent\atomic.email.hunter.v4.60.winall.cracked-czw.rar.torrent
c:\frst\quarantine\utorrent\pro webcam hack v 1.0+keygens.torrent
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\en_us\vstplugins\decrackler6.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler1.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler2.dll
c:\program files\adobe\adobe premiere pro cs6\plug-ins\zh_cn\vstplugins\decrackler6.dll
c:\unrealtournament\maps\ctf-bt-ttfaf-forcrackspider-v3.unr
c:\users\brecht\downloads\atomic email hunter + crack.rar
c:\windows\prefetch\keygen.exe-cc82967c.pf
scanner sequence 3.FF.11.LBNAXZ
 ----- EOF -----
 

[kevinf80]

I did give a prompt at the start regarding P2P issues, cracked software and the use of Keygens etc. I did expect that all such entries would be removed to comply with Forum protocol.

 

Remove this please c:\users\brecht\downloads\atomic email hunter + crack.rar  and then we can continue:

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system, this scan can take several hours to complete, it is very thorough and well worth running, please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• click on the Run ESET Online Scanner button
  
• Tick the box next to YES, I accept the Terms of Use.
  Click Start
  
• When asked, allow the add/on to be installed
  Click Start
  
• Make sure that the option Remove found threats is unticked
  
• Click on Advanced Settings, ensure the options
  
• Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  Click Scan
  
• wait for the virus definitions to be downloaded
  
• Wait for the scan to finish
  

 

When the scan is complete

 

• If no threats were found
  
• put a checkmark in "Uninstall application on close"
  
• close program
  
• report to me that nothing was found
  

 

If threats were found

 

• click on "list of threats found"
  
• click on "export to text file" and save it as ESET SCAN and save to the desktop
  
• Click on back
  
• put a checkmark in "Uninstall application on close"
  
• click on finish
  

 

close program

 

copy and paste the report here

 

Finally:

 

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop.

Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

Post those logs, let me know if there are any remaining issues or concerns...

 

Kevin....

[brechtendeure]

ESET SCAN:

 

C:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$R1C4BM4\pro webcam hack v 1.0.Fullversion.With.Crack.New.SKIDROW.exe    Win32/TrojanDownloader.Delf.RLB trojan
C:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$RJ3GXC8\hmh+56g14m+65j1+jk6,\Citp\email.extractor.v.5.6.0.0-patch.exe    a variant of Win32/HackTool.Patcher.AD application
C:\FRST\Quarantine\18be6784_.exe    multiple threats
C:\FRST\Quarantine\294823_.exe    a variant of Win32/Preloader.A application
C:\FRST\Quarantine\AskSLib.dll    a variant of Win32/Bundled.Toolbar.Ask application
C:\FRST\Quarantine\bitool.dll    Win32/Somoto.B application
C:\FRST\Quarantine\ICReinstall_Mouse Rate Checker 1.1_isdmgr.exe    Win32/InstallCore.DG application
C:\FRST\Quarantine\MixiYD.exe    multiple threats
C:\FRST\Quarantine\toolbar37727453.exe    a variant of Win32/Amonetize.T application
C:\FRST\Quarantine\toolbar691677.exe    Win32/BrowseFox.C application
C:\FRST\Quarantine\tsiVi032.dll    a variant of Win32/CoinMiner.ES trojan
C:\FRST\Quarantine\tsiVi132.dll    a variant of Win32/CoinMiner.ES trojan
C:\FRST\Quarantine\tsiVi232.dll    a variant of Win32/CoinMiner.ES trojan
C:\FRST\Quarantine\uninstall37805937.exe    a variant of Win32/ExpressFiles.B application
C:\FRST\Quarantine\uninstall37809291.exe    a variant of Win32/YourFileDownloader.B application
C:\FRST\Quarantine\uninstall767306.exe    a variant of Win32/ExpressDownloader.H application
C:\Program Files (x86)\GoforFiles\uninstall.exe    a variant of Win32/ExpressDownloader.H application
C:\Program Files (x86)\PSupport\uninstall.exe    a variant of Win32/SProtector.B application
C:\Users\Brecht\AppData\Local\Google\Chrome\User Data\default\extensions\pbldkgaiebjgehfdphpdhdfdafmaodpi\1.1\W09zyRfIYx.js    Win32/Adware.MultiPlug.H application
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\BabMaint.exe    a variant of Win32/Toolbar.Babylon.I application
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\ccp.exe    Win32/Toolbar.Babylon.M application
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\IEHelper.dll    Win32/Toolbar.Babylon.E application
C:\Users\Brecht\AppData\Roaming\GooglePlug\Unlocker1.9.1.exe    multiple threats
C:\Users\Brecht\AppData\Roaming\Mozilla\Firefox\Profiles\8edjdg4t.default\extensions\v.btb@atp-oae.co.uk\content\bg.js    Win32/Adware.MultiPlug.H application
C:\Users\Brecht\Downloads\cpu-z_1.59-setup-en.exe    a variant of Win32/Bundled.Toolbar.Ask application
C:\Users\Brecht\Downloads\Mouse Rate Checker 1.1_isdmgr.exe    Win32/InstallCore.DG application
C:\Users\Brecht\Downloads\utorrent.exe    a variant of Win32/Bunndle application
C:\Users\Brecht\Downloads\LicGen_OF_v1.2.123__Winx64_-ByDanCor\Win_x64\Patch OF v1.2.123 WinX64.exe    Win32/HackTool.Patcher.A application
C:\Users\Brecht\Downloads\The Great Gatsby 2013 DVDRIP. Jaybob\Jaybob's_Movies_Toolbar_Internet Explorer.exe    a variant of Win32/Toolbar.Conduit.B application

 

 

SECURITYCHECK:

 

 Results of screen317's Security Check version 0.99.76  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials   
  (On Access scanning disabled!)
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 45  
 Adobe Flash Player 11.8.800.168  
 Mozilla Firefox (25.0)
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 28% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


 

[brechtendeure]

I have turned on MBAM again. So far no popups telling me that I am still infected...

[brechtendeure]

And apologies for c:\users\brecht\downloads\atomic email hunter + crack.rar. Not getting much sleep lately (kids) and I must have missed it...

 

Still no popups telling me I have any infections

[kevinf80]

That is good news, ok do this:

 

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe  

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

• Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Files :Filles
  
  

  :Filesipconfig /flushdns /cC:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$R1C4BM4\pro webcam hack v 1.0.Fullversion.With.Crack.New.SKIDROW.exeC:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$RJ3GXC8\hmh+56g14m+65j1+jk6,\Citp\email.extractor.v.5.6.0.0-patch.exeC:\Users\Brecht\AppData\Local\Google\Chrome\User Data\default\extensions\pbldkgaiebjgehfdphpdhdfdafmaodpi\1.1\W09zyRfIYx.jsC:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\BabMaint.exeC:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\ccp.exeC:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\IEHelper.dllC:\Users\Brecht\AppData\Roaming\GooglePlug\Unlocker1.9.1.exeC:\Users\Brecht\AppData\Roaming\Mozilla\Firefox\Profiles\8edjdg4t.default\extensions\v.btb@atp-oae.co.uk\content\bg.jsC:\Users\Brecht\Downloads\cpu-z_1.59-setup-en.exeC:\Users\Brecht\Downloads\Mouse Rate Checker 1.1_isdmgr.exeC:\Users\Brecht\Downloads\utorrent.exeC:\Users\Brecht\Downloads\LicGen_OF_v1.2.123__Winx64_-ByDanCorC:\Users\Brecht\Downloads\The Great Gatsby 2013 DVDRIP. Jaybob:Commands[EmptyTemp]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

 

Next,

 

We need to remove FRST, first it is very important to deal with its Quarantine folder using FRST itself..

OK, we continue:

Delete any fixlist.txt file previously used, continue:

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). That will confirm the removal action, delete if successful. 

Next,

 

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

 

Next,

 

Remove ESET online scanner  (Only If installed):

 

• 
  

Click Start, type Uninstall a Program into the Search programs and files box, and then press ENTER.
Click to select ESET Online Scanner from the listing of installed products, and then click Uninstall/Change from the bar that displays the available tasks. Uninstall ESETonline Scanner, only re-boot if prompted.

 

Next,

 

Follow the instructions here (if needed): http://windows.microsoft.com/en-gb/windows7/improve-performance-by-defragmenting-your-hard-disk  and Defrag your HDD.

 

Next,

 

Create a new restore point:

 

   1. Right-click on Computer and go to Properties.

   2. Next click on the System Protection link.

   3. The System Properties dialog screen opens up and you will want to click on Create.

   4. Type in a description for the restore point which will help you remember the point at which it was created. Click on create.

   5. You should see the message "The restore point was created successfully

 

To remove all but the most recent restore point do the following:

 

   1.      Open Disk Cleanup by clicking the Start button . In the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.

   2.      If prompted, select the drive that you want to clean up, and then click OK.

   3.      In the Disk Cleanup for (usually C:\) dialog box, click Clean up system files. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

   4.      If prompted, select the drive that you want to clean up, and then click OK.

   5.      Click the More Options tab, under System Restore and Shadow Copies, click Clean up.

   6.      In the Disk Cleanup dialog box, click Delete.

   7.      Click Delete Files, and then click OK. Re-Boot your PC.

 

Let me know if those steps complete, alos if any remaining issues or concerns.....

 

Ensure real time protection is turned back on for MSE..

 

Kevin...

 

 

[brechtendeure]

Could it be that you forgot to attach the fixlist.txt file?

[kevinf80]

Yes probably, been a long day..... Is attach now, apologies..

fixlist.txt

[brechtendeure]

I know the feeling. No probs

 

Defrag your HDD: done

Remove tools: done

Create restore point: done

 

OTM log:

 

All processes killed
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP-configuratie
De DNS-omzettingscache is leeggemaakt.
C:\Users\Brecht\Desktop\cmd.bat deleted successfully.
C:\Users\Brecht\Desktop\cmd.txt deleted successfully.
C:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$R1C4BM4\pro webcam hack v 1.0.Fullversion.With.Crack.New.SKIDROW.exe moved successfully.
C:\$Recycle.Bin\S-1-5-21-704944380-1527385307-4179125320-1000\$RJ3GXC8\hmh+56g14m+65j1+jk6,\Citp\email.extractor.v.5.6.0.0-patch.exe moved successfully.
C:\Users\Brecht\AppData\Local\Google\Chrome\User Data\default\extensions\pbldkgaiebjgehfdphpdhdfdafmaodpi\1.1\W09zyRfIYx.js moved successfully.
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\BabMaint.exe moved successfully.
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\ccp.exe moved successfully.
DllUnregisterServer procedure not found in C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\IEHelper.dll
C:\Users\Brecht\AppData\Local\Temp\D2EA03ED-BAB0-7891-83CB-075C2A5931E3\Latest\IEHelper.dll moved successfully.
C:\Users\Brecht\AppData\Roaming\GooglePlug\Unlocker1.9.1.exe moved successfully.
C:\Users\Brecht\AppData\Roaming\Mozilla\Firefox\Profiles\8edjdg4t.default\extensions\v.btb@atp-oae.co.uk\content\bg.js moved successfully.
C:\Users\Brecht\Downloads\cpu-z_1.59-setup-en.exe moved successfully.
C:\Users\Brecht\Downloads\Mouse Rate Checker 1.1_isdmgr.exe moved successfully.
C:\Users\Brecht\Downloads\utorrent.exe moved successfully.
C:\Users\Brecht\Downloads\LicGen_OF_v1.2.123__Winx64_-ByDanCor\Win_x64 folder moved successfully.
C:\Users\Brecht\Downloads\LicGen_OF_v1.2.123__Winx64_-ByDanCor folder moved successfully.
C:\Users\Brecht\Downloads\The Great Gatsby 2013 DVDRIP. Jaybob folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Brecht
->Temp folder emptied: 101303061169 bytes
->Temporary Internet Files folder emptied: 242988299 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 379562937 bytes
->Flash cache emptied: 30157 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 198237860 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42286327 bytes
RecycleBin emptied: 57515235525 bytes
 
Total Files Cleaned = 152.284,00 mb
 
 
OTM by OldTimer - Version 3.1.21.0 log created on 11082013_014717

Files moved on Reboot...
C:\Users\Brecht\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Brecht\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

Registry entries deleted on Reboot...
 

[kevinf80]

How is your system responding, any issues or concerns? Read the following link to fully understand PC security and best practices....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

If all ok can we close?

 

Kevin...

[brechtendeure]

Yes kevinf80, we can close

 

Thanks so much! Brilliant service you guys provide here!

 

Regards

[kevinf80]

Glad to help, come back anytime...

[Maurice Naggar]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.