MDM Posted November 21, 2017 ID:1185398 Share Posted November 21, 2017 Why didn't Malwarebytes detect this? Had to use Kaspersky Virus Removal Tool 2015 to get rid of this. Am I missing something about Malwarebytes? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 23, 2017 Root Admin ID:1185901 Share Posted November 23, 2017 Hello @MDM Is it possible for you to zip up the quarantine file that Kaspersky found and upload for us to take a look. Thank you Ron Link to post Share on other sites More sharing options...
MDM Posted November 23, 2017 Author ID:1185928 Share Posted November 23, 2017 Here is the folder that they use. Look at the 15th and 21st scan. I got hit twice. I don't know how to open the enc1 to see what it says. My ISP contacted me to let me know that I was spamming emails and to find out why. I ran AVG Business and Malwarebytes 3.3.1 and found nothing. I found 2 new tools to use. Sophos Virus Removal Tool and it said I had something in memory but couldn't remove it. Next I tried Kaspersky Virus Removal Tool 2015 and it did the trick to remove it. It came in through the windows browser so I set all the settings as high as it allowed me to and the payload stopped coming in. The Trojan came in through the browser, extracted to memory and deleted the file to cover its tracks. KVRT_Data.zip Link to post Share on other sites More sharing options...
Staff Atribune Posted November 23, 2017 Staff ID:1185962 Share Posted November 23, 2017 (edited) Not wanting to step on Ron's toes but I suspect something is still being missed. The detection of MEM Trojan:Win32 cometer.gen by KVRT began October 25th, and has been "removed" several times since then according to the log files you sent in. There needs to be something on disk that loads MEM Trojan:Win32 cometer.gen into memory or when you rebooted it would die and be gone as MEM indicates that it is only in memory. Unfortunately from the logs we can't be sure what exactly Kaspersky is seeing that they are calling MEM Trojan:Win32 cometer.gen. Could you please follow the instructions found here: Please attach the logs here. Edited November 23, 2017 by Atribune Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 27, 2017 Root Admin ID:1186894 Share Posted November 27, 2017 Hello @MDM Just checking to see if you're still with us and to see if you can post the requested logs. Thanks Ron Link to post Share on other sites More sharing options...
MDM Posted November 28, 2017 Author ID:1187156 Share Posted November 28, 2017 It came in through the windows browser several times so I set all the settings as high as it allowed me to and the payload stopped coming in. I've been free of this Trojan now for over a week. I'm just disappointed that Malwarebytes didn't catch it. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 29, 2017 Root Admin ID:1187325 Share Posted November 29, 2017 Why we'd like to help you but what you've provided so far is not an infection. It's a trace of an old infection. If you like we can run some scans to see if there really is something on the system, but basically so far it does not look to be like the computer has an actual infection. If you ran 20 different antivirus tools on the computer each may or may not find traces of old left over infections because often times the infection is not 100% removed of all traces. The main infection has been removed that actually does the harm, but some file or registry entry may be left over. The complexity of finding, preventing, and cleanup from malware If you'd like me to assist you in scanning your computer further for any possible infection please let me know. Thank you Ron Link to post Share on other sites More sharing options...
Recommended Posts