Bwaj Posted January 7, 2018 ID:1197625 Share Posted January 7, 2018 Hello, My laptop has been infected by a trojan malware. It seems that once I connect to the internet, it starts some new services (windows process manager) and starts utilizing my memory resources. I did some initial check about this malware and I tried using few anti viruses but I am not able to remove it. Further, there are three folders in Appdata/Local path - igfxmtc, pshcrzw and dwotuil. When I try to access these folders, it says access is denied. Though in the task manager, I find only igfxmtc service running, I suspect the other two are malware as well. I have attached FRST.txt and Addition.txt files after running a scan using FRST64. I did this step as per the discussion done in this thread. - Please help me in removing the malware. Thank you so much. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 7, 2018 ID:1197683 Share Posted January 7, 2018 Hello Bwaj and welcome to Malwarebytes, You have smartservice infection on your system, to remove that infection you will need access to a known clean computer and USB flash drive 4gb or above: Boot up your spare PC plug in the flash drive, navigate to that drive, right click on it direct and select format. Quick option is adequate... Next, On that same PC downoad and save FRST to same Flash drive, make sure to get the correct version, if you are unsure d/l and save both, only the correct one will run. Do not plug Flash Drive into sick PC until booted to Recovery Environment.http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ Next, Boot sick PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference...https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html Next, From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" Ensure to plug the flash drive into a USB port... You should now be in Recovery Environment with the Command Prompt Window open...... Continue with the following: Select Command Prompt In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" or "My PC" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Leave the sick PC in Recovery mode, post back that log via spare PC... Thank you, Kevin Link to post Share on other sites More sharing options...
Bwaj Posted January 7, 2018 Author ID:1197792 Share Posted January 7, 2018 Hi Kevin, Sorry for the late response, I am not able to boot my infected PC in the recovery environment. I tried various options listed in the post still my PC aint getting booted in the recovery environment. Please suggest me how to proceed further. Regards Link to post Share on other sites More sharing options...
kevinf80 Posted January 7, 2018 ID:1197799 Share Posted January 7, 2018 I assume you have access to a spare PC, if so what version of Windows is installed..? Link to post Share on other sites More sharing options...
Bwaj Posted January 7, 2018 Author ID:1197800 Share Posted January 7, 2018 Yes, I do have my friend's PC with windows 10 OS. Link to post Share on other sites More sharing options...
kevinf80 Posted January 7, 2018 ID:1197803 Share Posted January 7, 2018 Ok, you can create a recovery drive on your friends PC, Go to your spare PC, plug in Flash drive. Open the search function bottom left hand corner of the Desktop type in or copy/paste create recovery drive hit enter.... In the new window UNCheck "Back up system files to recovery drive" from there click "Next" from there just follow the prompt, The flash drive will be formatted before the RD is created. When that is complete you will need to add FRST again to same flash drive... https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ We now need to boot the infected PC direct to the Recovery Environment which is on the Flash Drive... It will may be necessary to change the boot order in the infected PC to boot from the USB Flash drive: https://craftedflash.com/info/how-boot-computer-from-usb-flash-drive After booting to the Recovery Environment select the correct keyboard, from the next window select "Trouble Shoot" then "Command Prompt" Continue with the following: In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" or "My PC" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Leave the sick PC in recovery mode, post log from Flash drive via spare PC.... Link to post Share on other sites More sharing options...
Bwaj Posted January 7, 2018 Author ID:1197806 Share Posted January 7, 2018 Hi Kevin, I did the above steps. I have attached the FRST.txt log file. Regards, Bharathwaj FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 7, 2018 ID:1197812 Share Posted January 7, 2018 From your spare PC Save the attached file fixlist.txt to your flash drive, same place as FRST. Plug Flashdrive back into Sick PC, Run System Recovery Options as you did to get the log. Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Next, Boot sick PC back to Normal mode.... Open Malwarebytes Anti-Malware. On the Settings tab > Protection Scroll to and make sure the following are selected:Scan for RootkitsScan within Archives Scroll further to Potential Threat Protection make sure the following are set as follows:Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended) Click on the Scan make sure Threat Scan is selected, A Threat Scan will begin. When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab If asked to restart your computer to complete the removal, please do so When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more to retrieve the log. To get the log from Malwarebytes do the following: Click on the Reports tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system....https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs in your reply, also tell me if there are any remaining issues or concerns... Thank you, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
Bwaj Posted January 8, 2018 Author ID:1197835 Share Posted January 8, 2018 I am attaching all the requested logs. All scans are completed and no threat were found. I do have a couple of questions - 1. When my PC was infected, sometimes I noticed that a search in google automatically redirects to bing . I am not sure if this of concern but just thought it would be better to bring it to your attention. 2. Due to these infections, will my saved passwords be compromised? If yes, should I change all my passwords? 3. Will there be problem to other devices linked to my chrome account? (I am not sure if something like this is possible but still wanted to ensure) Thank you so much for your support and patient replies. Kind Regards, Bharathwaj AdwCleaner[C0].txt AdwCleaner[S0].txt Fixlog.txt Malware_bytes_log.txt mrt.log Link to post Share on other sites More sharing options...
kevinf80 Posted January 8, 2018 ID:1197898 Share Posted January 8, 2018 Hello Bharathwaj, Anytime your PC is infected you should always change all passwords when cleaning is complete. I do not believe cross infection will affect other devices through your Chrome account, I have not heard of or seen this happen. Obviously if you are suspicious or are experiencing problems with other devices then it would be prudent to have them checked out... We need one more scan on problem PC from Normal Mode with FRST... Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Thank you, Kevin... Link to post Share on other sites More sharing options...
Bwaj Posted January 8, 2018 Author ID:1198051 Share Posted January 8, 2018 Hi, I have attached the logs. Thank you Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted January 8, 2018 ID:1198064 Share Posted January 8, 2018 Hello Bharathwaj, Those logs are clean, no obvious malware or infection... Unless you have any remaining issues or concerns run the following to clean up... Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down:"Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 23, 2018 Root Admin ID:1202609 Share Posted January 23, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts