fake movie that actually ran powershell

[yuhuil]

Hi,

I downloaded a movie that was names .avi but was actually a shortcut, and it ran something in powershell similar to what this user saw

I followed the instructions from that thread and below attached are the files generated

what should I do next?

thanks

 

 

 

 

Edited January 14, 2019 by AdvancedSetup
files deleted per request

[yuhuil]

when I google something on chrome, it seems like additional ad-like links are added to the top of the list but made to look like part of the regular search (attached pic). also, I'm not able to make or reply to posts on this forum in chrome, but it does work on IE

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please run Malwarebytes and delete all the items listed.

After a restart of the computer run the Farbar program and post a fresh FRST.TXT log for my review.

[yuhuil]

here are the newly generated text files

 

 

 

Edited January 14, 2019 by AdvancedSetup
files deleted per request

[nasdaq]

Hi,

ATTENTION: System Restore is disabled
Turn System Restore ON for Drives in Windows 10 - Immediately.
https://www.tenforums.com/tutorials/4533-system-protection-turn-off-drives-windows-10-a.html
===

For your security please enable these programs.
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please let me know if you have any remaining issues with this computer.

 

Edited January 14, 2019 by AdvancedSetup
files deleted per request

[yuhuil]

Thanks. I ran the fix with FRST and turned on restore. 

However, I don't remember disabling this and windows defender. the chrome problems still exist.

When I try to enable defender, I see this

 

 

Edited January 14, 2019 by AdvancedSetup
files deleted per request

[yuhuil]

reinstalled chrome and the problems went away. still would like to know what this malware was trying to do, and how to enable defender. Thanks again!

[nasdaq]

Hi,

This should restore your Windows Defender.

Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 

start
	CreateRestorePoint:
CloseProcesses:
	HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
	Reboot:
End

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Something compromised Chrome.
Unable to say what.

[yuhuil]

here it is

 

Edited January 14, 2019 by AdvancedSetup
files deleted per request

[nasdaq]

Has the problem been solved?

[yuhuil]

yes, thank you so much

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks