Scan shows Tojan.Emotet. User cannot open browsers

[Variscite]

I have three computers (so far) with this same problem.  The browsers won't open.  One of the computers, gets a message from Anti-Exploit when he clicks on FireFox that Malwarebytes Anti-Exploit has blocked an exploit attempt.  Application: Mozilla Firefox.  Protection Layer:  Malicious Memory Protection.  Protection Technique:  Exploit code executing from Heap Memory blocked.   When he clicks on Internet Explorer, he gets the same message with the application being Internet Explorer.  When I log onto the same computer as another user (an administrator) I can open both browsers without a problem.

This didn't work:  Opened Anti-Exploit and went to Settings > Advanced Settings and on each tab, I clicked Default Settings.  

This didn't work:  Ran a full scan in Malwarebytes Anti-Malware and removed the Trojan.Emotet malware and rebooted the computer.

Windows is fully patched.  

As a test, I stopped Anti-Exploit on one computer and the browsers worked again for the regular user.  

I have attached FRST scan results.  I searched the results for the text in the Malwarebytes blog under "Identifying the infected machines" and none of the text was found.

 Please help.  Thanks.  

 

Addition.txt

FRST.txt

[Variscite]

Quote

I'm running another full Malwarebytes Anti-Malware scan to see if Trojan.Emotet is really gone.  This time a drive mapped to a server was in the drive selection list to scan.  It doesn't show on the other computers and didn't show the first time I scanned this computer.  

 

[kevinf80]

Hello Variscite and welcome to Malwarebytes, Upload a File to Virustotal Go to http://www.virustotal.com/   Click the Choose file button Navigate to the file C:\ProgramData\kMGISrp.exe Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the URL address back here please. Repeat the above steps for the following file C:\ProgramData\nT16F2AOBNbX.exe Thank you, Kevin...

[Variscite]

Hello Kevin and thanks for replying,

I went to www.virustotal.com and selected c:\ProgramData\kMGISrp.exe and it displayed this on the details tab (attached).

The computer automatically rebooted and when it came back up C:\ProgramData\kMGISrp.exe  and   C:\ProgramData\nT16F2AOBNbX.exe were gone. I'm running another Malwarebytes scan now to see if they come back.  

[kevinf80]

All I want is the url address of analysis results from VirusTotal for each file I listed for you..

[kevinf80]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks