csalmon Posted March 2, 2019 ID:1301629 Share Posted March 2, 2019 My roommate ran a shortcut he downloaded and it appears to have installed some kind of malware. Malewarebytes is giving me this error now. Please help. Log files are attached. FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 3, 2019 ID:1301763 Share Posted March 3, 2019 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Your logs are clean. === If the problem persists in Firefox and you are Syncing with other Devices reset it.https://support.mozilla.org/en-US/kb/how-do-i-set-sync-my-computer When all is well you can re-sync your devices. === If the problem persists and this happens only when the Shortcut is executed it could be compromised. Scan the computer with the Farbar program and check the the box to create a the shortcut file. Post the log for my review. p.s. You did not attach the MBAM log. Link to post Share on other sites More sharing options...
csalmon Posted March 3, 2019 Author ID:1301799 Share Posted March 3, 2019 Thank you nasdaq, I have attached the shortcut file for reference. Can you let me know how to create the MBAM log? Chuck Shortcut.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 3, 2019 ID:1301812 Share Posted March 3, 2019 Hi, Please download Malwarebytes Anti-Malware from here Just update if necessary. Right-click on the MBAM icon and select Run as administrator to run the tool. Click Yes to accept any security warnings that may appear. Once the MBAM dashboard opens, on the right detail pane click on the word "Current" under the Scan Status to update the tool database. On the left menu pane click the Settings tab, and then select the Protection tab on the top. Under the Scan Options, turn on the button Scan for rootkits and Scan within archives. Click the Scan tab on the right detail pane, select Threat Scan and click the Start Scan button Note: The scan may take some time to finish, so please be patient. If potential threats are detected, ensure to check mark all the listed items, and click the Quarantine Selected button. While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop. The log can also be viewed by clicking the log to select it, then clicking the View Report button. Please post the log for my review. Note: If asked to restart the computer, please do so immediately. === Post the log for my review. Link to post Share on other sites More sharing options...
csalmon Posted March 3, 2019 Author ID:1301834 Share Posted March 3, 2019 MBAM logfile attached. The file in question was shortcut file that was disguised as a .avi movie file. The target in the file was executing an elevated powershell command. I know these logs don't seem to show any infections but I am very suspicious of this file. I am nervous that malware scanners are not identifying this file correctly. Unfortunately the file is 1.5GB so it too big to upload anywhere to check. Malwarebytes Summary File.txt Link to post Share on other sites More sharing options...
nasdaq Posted March 4, 2019 ID:1301950 Share Posted March 4, 2019 Hi, For your peace of mind run this scan. Please download Sophos Virus Removal Tool and save it to your computer's Desktop. Right-click the icon and select Run as administrator. Click Yes to accept any security warnings that may appear. Click the Next button. Select 'I accept the terms in the license agreement', then click Next twice. Click the Install button and wait until the installation is complete. Click the Finish button. The tool created a shortcut icon on the Desktop of your computer. Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool. Click Yes to accept any security warnings that may appear. After it updates and a "Start Scanning" button appears in the lower right: Disconnect from the Internet or physically unplug your Internet cable connection. Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver. Temporarily disable your anti-virus and real-time anti-spyware protection. Windows Vista and above: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log Please post the contents of the log in your next reply and note any errors encountered. === Link to post Share on other sites More sharing options...
csalmon Posted March 4, 2019 Author ID:1301979 Share Posted March 4, 2019 Thank you Nasdaq, I will run the Sophos check tonight and post the results. Is there some way to upload this file to you for analysis? The file is large (1.5 GB)and is definitely meant to contain malware of some sort. Link to post Share on other sites More sharing options...
nasdaq Posted March 4, 2019 ID:1302018 Share Posted March 4, 2019 Hi, Go to this site.https://www.virustotal.com/#/home/upload Submit the .avi file for inspection. Post the link generated so I can see the results. Link to post Share on other sites More sharing options...
csalmon Posted March 4, 2019 Author ID:1302064 Share Posted March 4, 2019 Here is the Sophos log from a few days ago when I ran it. SophosVirusRemovalTool.log Link to post Share on other sites More sharing options...
csalmon Posted March 4, 2019 Author ID:1302068 Share Posted March 4, 2019 Here is the link to the scan. https://www.virustotal.com/#/file/d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d14466677/detection Link to post Share on other sites More sharing options...
nasdaq Posted March 5, 2019 ID:1302161 Share Posted March 5, 2019 The file has been reported clean. Any remaining issues with this computer? Link to post Share on other sites More sharing options...
csalmon Posted March 5, 2019 Author ID:1302167 Share Posted March 5, 2019 I don't think so. Thanks so much for giving me peace of mind with this issue and that suspicious file! Link to post Share on other sites More sharing options...
nasdaq Posted March 5, 2019 ID:1302171 Share Posted March 5, 2019 Glad we could help. Link to post Share on other sites More sharing options...
csalmon Posted March 5, 2019 Author ID:1302192 Share Posted March 5, 2019 Nasdaq, my friend just let me know that since the file I uploaded to virustotal was in the form of filename.avi.lnk with the target being powershell, it only scanned the powershell command on my PC. He opened the file in a hex editor and stripped out the extra padding and rechecked it on virustotal. This is a very different result on the actual file. What are your thoughts on this? https://www.virustotal.com/#/file/bb745ee7b0bd0dd70ab075a068e18e5ad38b30f0a3758c7e9efffd00b7c5658c/detection Link to post Share on other sites More sharing options...
nasdaq Posted March 5, 2019 ID:1302224 Share Posted March 5, 2019 Hi, I would not trust it. Delete the file and the .lnk. Link to post Share on other sites More sharing options...
csalmon Posted March 5, 2019 Author ID:1302225 Share Posted March 5, 2019 Thanks, unfortunately he had already run it. Since there is definitely something fishy with the file and no virus scanners seem able to identify it as a threat, I think at this point it is probably best to just reinstall windows to a new drive and start over. Thanks again nasdaq! Link to post Share on other sites More sharing options...
nasdaq Posted March 6, 2019 ID:1302356 Share Posted March 6, 2019 Glad we could help. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 11, 2019 Root Admin ID:1303256 Share Posted March 11, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts