BitCoinMiner keeps reappearing, MalwareBytes only working in SafeMode

[uncalex]

My computer has new ads popping up in new tabs every 20 minutes or so in Chrome. 

I can't run MalwareBytes, RKill, or Farbar unless it is in SafeMode. 

MalwareBytes detects RiskWare BitCoinMiner, but after quarantine and deletion, it reappears on reboot. 

I know I have utorrent installed and I am 95% sure that's what has caused this issue...will never use again. 

Please HELP!!!

Addition.txt

FRST.txt

MalwareBytes Scan Log.txt

[AdvancedSetup]

Hello @uncalex and

You're running 2 different antivirus programs. Please choose one of them only and fully uninstall the other one.

Avast
Bitdefender

Then run the following

Also, your System Restore is disabled. I highly recommend that you enable it.
ATTENTION: System Restore is disabled

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

 

fixlist.txt

 

Once that is done please follow the steps below. Make sure on FRST that you place a check mark in the Additions.txt check box and attach back all new logs.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[uncalex]

Hello Ron, thanks for helping me with this. 

I first made sure to remove Avast, and turned on System Restore. 

I then downloaded that fixlist and ran it with FRST64. It gave me this Fixlog (attached below). 

Following this I proceeded with Steps 1, 2, and 3. I ran MalwareBytes3 and received another Export Summary. It found 3 threats. They have been removed, but I have removed similar threats (BitCoinMiner) many times last night, but they keep reappearing. I also want to note that it appears that MWB3 only scans my C Drive. My C drive has some files on it, but mainly used for my OS. My D Drive contains the bulk of my stored files. 

Following MWB3, I ran AdwCleaner, restarted my computer, and finished with FRST64. AdwCleaner did not detect anything. And I will link my FRST.txt and Addition.txt. 

Please let me know what I should do next! Thank you!

Fixlog.txt

MalwareBytes Export Summary 6.29.18.txt

FRST.txt

Addition.txt

[AdvancedSetup]

Please follow the directions from the following topic

 

Then reboot the computer one more time and run the following scan from this topic

Once that's done post back the logs and let me know how the computer is running now.

 

[uncalex]

Hello Ron,

I've completed the directions from both topics you've sent. The first was the Chrome sync reset. I have the log linked below. I haven't noticed any more random ads opening in new tabs by itself now even before the sync reset. After the reset, everything seems to be fine as well.

Next was the Anti Rootkit. I downloaded the application, ran it accordingly and finished the scan with no malware detected. 

I have been running scans of Malwarebytes and Adwcleaner a few times since my last response and everything has been clean so far. I hope this means all is well!!

MWB.after.Chrome.Reset.Sync.txt

[AdvancedSetup]

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

IE: C:\FRST folder, FRST -OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.
 

How to uses System Restore Windows 10

As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education, you can certainly swing things in your favor.

• How Malware Spreads - How did I get infected
• Best Practices for Safe Computing - Prevention of Malware Infection
• Avoiding those unwanted free applications
• A close look at how Oracle installs deceptive software with Java updates
• IAC / Ask.com toolbars
• Malwarebytes Unpacked Blog

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.

 

Thank you and take care

Ron

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks