smart coin miner

[Aura]

The ShellExperienceHost in C:\Windows\SystemApps is legit. The one in ProgramData isn't. Alright, run a new scan with FRST and provide me a fresh set of logs. We'll try something afterwards. It seems that only the miner came back, and not the whole infection (Explorerplug.dll and so on).

[dbs00]

here they are

Addition.txt

FRST.txt

[Aura]

Alright now don't panic, but this fix will delete the taskmgr.exe executable. However, we'll restore it afterwards (the legit one this time).

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Fix button
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
• Copy and paste its content in your next reply
  

fixlist.txt

[dbs00]

I think I did it twice. 

Did it once, it asked for a restart. I couldn't see the log so I did it again

this is the log from the second run for the fixlist.txt

Fix result of Farbar Recovery Scan Tool (x64) Version: 16.05.2018 01
Ran by Administrator (17-05-2018 17:44:32) Run:2
Running from C:\2
Loaded Profiles: Administrator &  (Available Profiles: Administrator & MSSQL$MICROSOFT##WID & .NET v4.5 & .NET v4.5 Classic)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Task: {68746C60-7353-4C14-89CA-88A700D3BCF0} - System32\Tasks\WindowsRecoveryCleaner => C:\ProgramData\Iostream.exe <==== ATTENTION

C:\ProgramData\WindowsTask
C:\ProgramData\System32
C:\Windows\System32\Taskmgr.exe
*****************

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{68746C60-7353-4C14-89CA-88A700D3BCF0} => not found
"C:\Windows\System32\Tasks\WindowsRecoveryCleaner" => not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindowsRecoveryCleaner => not found
"C:\ProgramData\WindowsTask" => not found
"C:\ProgramData\System32" => not found
"C:\Windows\System32\Taskmgr.exe" => not found

==== End of Fixlog 17:44:32 ====

 

 

seems it deleted taskmgr and it didn't add it back

At least now I don't have the problem with the virus closing task manager so I can't see the resource spike :))

Edited May 17, 2018 by dbs00

[Aura]

Now if you restart the server and run a scan with Malwarebytes, does it find anything?

[dbs00]

I did that a few times. atm isn't finding anything with malwarebytes

[Aura]

Awesome Can you provide me a fresh set of FRST logs? I'll make sure that the malware is indeed gone.

[dbs00]

I removed the virus from all the servers, I changed the RDP passwords, and seems the virus is back on some servers. on some isn't back yet. 

 

here are the frst logs from the previous server on which we've been testing things

 

Addition.txt

FRST.txt

[Aura]

And from what I can see, the infection on that server didn't come back, right? When you cleaned all the other servers, did you delete taskmgr.exe as well?

[dbs00]

I did not. I used just malwarebytes, without FRST with fix

and malwarebytes didn't delete taskmgr

 

so I should do a mwalrebytes sweep and after use frst with fix file?

[dbs00]

also how can I add taskmanager back? after FRST deleted it, I can't use it anymore

https://cl.ly/rhGJ

[Aura]

Run a SFC /scannow on the server, and the TaskMgr.exe should be restored from the components store.

Yes, do a sweep with Malwarebytes, then run the FRST fix and restart the server. Make sure to run both before restarting it.

[dbs00]

Okey , will do that.

TYVM Aura for your help in this matter!

[Aura]

No problem, keep me posted  

[Aura]

So, are the servers clean and behaving properly now?

[Aura]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks