Strange email with need to "update" PDF reader plug-in for Firefox Browser

[Boutrous]

Hi there, I am confused about a message I received just now and unfortunately downloaded and activeated the file...

A short while ago I received the following strange message which wasn't so suspicious to me at first...

____________________

Von: Mtgox Compensation [mailto:mtgox-compensation@mtgox.cn.com]
Gesendet: Donnerstag, 30. März 2017 11:53
An: ME
Betreff: To you compensation is appointed.Bankruptcy Proceedings

 

At 09:52 on 30.03.2017, the Tokyo District Court granted the order for the commencement of the bankruptcy proceedings vis-à-vis MtGox Co., Ltd. (“MtGox”).
For the purpose of providing information to the related parties, we hereby inform you of the basic matters regarding the bankruptcy proceedings as attached.
You are entitled to compensation in the amount of 5.8295 BTC. Detailed information is available in the document on the official site.



Bankrupt MtGox Co., Ltd. Bankruptcy trustee Attorney-at-law Nobuaki Kobayashi

_______________________

I clicked on the link and received an error message saying that the PDF displayed here is written with the latest PDF version and I would need the latest PDF reader plug in for Firefox which is available through the following link. I downloaded this file it is called: firefox_plugin.exe and then a "DOS like command window" opened and something was exectued on my WIN 10 computer. Is there anyone that can help me with that strange thing?

Thanks

Peter

Edited March 31, 2017 by AdvancedSetup
Removed potentially dangerous link

[Aura]

Hi Boutrous

Please give me a few while I investigate the link you posted.

Edit: It looks like a Ransomware from the VirusTotal report. Follow the instructions in the thread below and provide me the FRST.txt and Addition.txt logs please.

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

Edited March 30, 2017 by Aura

[Boutrous]

Hello Aura,

Thank you very much for your assistance. I had a run through my computer with Malware Bytes and it found the following incidence: HackTool.LaZagne. It was quarantined but I am not sure whether I got rid of it completely. I think it retrieves all my passwords from Firefox Browser. I protected them with a Master Password but I am afraid that it circumvented this as well. How do I best get rid of this? I would be tremendously greatful for any kind of help!

Cheers

Boutrous

[Aura]

After discussion with a colleague yesterday, we also came to the conclusion that this malware was probably a stealer/RAT, not a Ransomware. Can you copy/paste the Malwarebytes log where the detection occured so I can see?

[Aura]

Hi Boutrous,

Are you still with me?

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!