Outbound Trojan Blocked and Removed keylogger

[RedCat]

Hello, so I have a couple of problems I found out about today.

I reïnstalled Malwarebytes today after a half a year. I ran a scan and found out there was a keylogger on my system for about 30 days and let Malwarebytes immediately remove it. I have attached the log from that scan below. It is removed from my pc and it doesn't come up in the scans anymore. Is it gone now?  Keylogger scan.txt

I'm a little bit worried if there is maybe more wrong on my system. I resumed my work and after 2 hours I restarted my pc. When I did that malwarebytes notified me it had blocked three outbound connections. I can't remember exactly what I did after that, I just know I did some cleaning and restarted my pc again. Now instead of 3 outbound connections blocked, only one was left. And that's the only connection it blocks after restarting my pc, the other two are gone.

The connection that still gets blocked is a

Connection 1: Trojan Horse in the file C:\Windows\SysWOW64\wscript.exe Connection 1.txt

The the connections that were blocked before and are not right now are:

Connection 2: Trojan Horse in C:\Program Files (x84)\Google Chrome\Application\chrome.exe Connection 2.txt

Connection 3: Malware in C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Connection 3.txt

I have attached all the scan report files too.

Should I be worried? I hope someone can help me that would be great. I have also attached the FRST scan files from the scan I just did.

FRST.txt

Addition.txt

 

[AdvancedSetup]

Hello @RedCat and

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[RedCat]

Hi Ron thank you for the reply

I ran the fix in FRST and restarted my pc, but unfortunately malwarebytes still has to block the same trojan horse connection.

Fixlog.txt

trojan connection.txt

[AdvancedSetup]

Yes, unfortunately, it takes a bit of work to clean the computer but we'll get you fixed up.

Let me have you run the following to get new scans and logs. If anything is found make sure you have Malwarebytes or AdwCleaner remove what it finds.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[RedCat]

I have done everything you listed and attached everything below

mwb threat scan.txt

AdwCleaner[C00].txt

FRST.txt

Addition.txt

[AdvancedSetup]

Let me have you run this scanner, please.

 

Please visit this web page and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

[RedCat]

Hi when I'm trying to run combofix it gives me this message: "Current date is 2019-03-15. Combofix has expired. Click yes to run in REDUCED FUNCTIONALITY mode. Click no to exit."

When you click yes it only deletes itself

[AdvancedSetup]

Okay, I'll check with the author. Let me have you run this scanner from Kaspersky then.

 

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

[RedCat]

Hi, I ran the Kaspersky virus removal tool and found this:

After the scan my pc had to restart and it performed another bigger scan and found this:

I clicked on neutralize all, but a couple of the files are still in quarantine now even though I wanted to delete them.

Hope you can help with this

[AdvancedSetup]

Being in quarantine is okay. Files are encrypted and cannot get out or affect the computer from there.

That's great. That is actually what I was looking for that I was not seeing in the other logs.

Let me get a new set of Malwarebytes, AdwCleaner, and FRST logs please.

 

How is the computer running now?
Are you still seeing any signs of an infection?

 

[RedCat]

Hi, I haven't seen the powershell.exe popup in a couple of days, and haven't seen the wscript.exe pop up anymore that I was getting everytime I restarted my pc.

 

I have attached the new scan logs here

MWB Scan.txt

AdwCleaner[S01].txt

FRST.txt

Addition.txt

[AdvancedSetup]

Overall the logs look good. I would recommend you reset Chrome to ensure all is good.

Please follow the directions from the topic below.

 

After resetting Chrome look at the following information.

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

 

Thank you for choosing Malwarebytes
 

Ron

 

[RedCat]

Thank you! I did everthing you said, and haven't got any messages pop up anymore. Also all new scans can't find anything anymore. So I guess we're done right?

[AdvancedSetup]

Yes, the computer should be clean now.

 

[RedCat]

Okay thank you very much for the help! I

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks