easeUS file restoration program bundled with malware?

[Unfree]

i was browsing the web after trying to diagnose a flash drive not being recognized, when windows defender (of all things) (dont have MBAM premium) caught some malware. after a scam with malwarebytes, well, ill show you the logs.

Log File: 716586a2-865c-11e9-acd4-00ffe6bad8d1.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.586
Update Package Version: 1.0.10890
License: Free

-System Information-
OS: Windows 10 (Build 17763.503)
CPU: x64
File System: NTFS
User: CHRISTIANS-ABSO\chris

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 340797
Threats Detected: 5
Threats Quarantined: 5
Time Elapsed: 14 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 1
Hijack.ShellA.Gen, HKU\S-1-5-21-1013403379-1972433991-2537096884-1001\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|SHELL, No Action By User, [6376], [187664],1.0.10890

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
Trojan.StolenData, C:\USERS\CHRIS\APPDATA\ROAMING\DCLOGS, No Action By User, [3609], [250094],1.0.10890

File: 3
Trojan.StolenData, C:\USERS\CHRIS\APPDATA\ROAMING\DCLOGS\2019-06-03-2.dc, No Action By User, [3609], [250094],1.0.10890
PUP.Optional.Conduit, C:\USERS\CHRIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WTR8M8IT.DEFAULT\PREFS.JS, No Action By User, [208], [301520],1.0.10890
MachineLearning/Anomalous.96%, C:\USERS\CHRIS\APPDATA\ROAMING\S1V6BWX0A8CBFXYS\RICZBDZBBGKY.EXE, No Action By User, [0], [392687],1.0.10890

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

here is what the keylogger had got on me, too bad they wont get any passwords as i keep mine stored away.

:: Update (8:04:35 PM)

:: EaseUS Windows Data Recovery Software - Mozilla Firefox (8:04:41 PM)
[<-]lo

:: Mozilla Firefox (8:06:36 PM)
twi

:: Aleis_M_Alpto on Twitter: "I pay 35€ for this. And it's half of what we are supposed to be receiving.… " - Mozilla Firefox (8:07:50 PM)
relatable, only move the decimal point to make it 1.107, we spu[<-][<-][<-]supposed to get 10 [<-], welcome to c[<-]rur[<-]al [<-][<-][<-]ral canada *****ing hell

:: Mozilla Firefox (8:08:00 PM) [at this time i find out about the malware]
trojan.stolenDATA

:: Server Not Found - Mozilla Firefox (8:11:00 PM)
[<-]to[<-][<-][<-]win34[<-]2/5[<-]64 troka[<-][<-]h[<-]jan.stolendata

my password t[<-]for twiiter: usr[<-]ername: *****youhe[<-]ackers69420
password: if you [<-][<-][<-][<-][<-][<-]fyouthoughtiwasthisstupidyou [<-]areretarded

:: @Stone_Shovel - Discord (8:18:53 PM)
holy ***** i download a program to try to fix a flashd [<-][<-] drive, find out its actually a *****ing [<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-][<-] had a keylogger hidden in it, hijack.shell.a [<-], and a [<-][<-]some machine learning bus[<-][<-][<-]***** on it. if windows defene[<-]der was [<-]nt there i couldve gotten ***** stolen

:: Clipboard Change : size = 6 Bytes (8:18:53 PM)
cyr666

:: Cortana (8:19:55 PM)
instagram

:: Instagram (8:20:10 PM)

it started logging immediately after i installed the software, and from the tab of the url i was in, it was the official site. it is still logging, but it isnt getting anything useful for now.

[AdvancedSetup]

Hello @Unfree and

Sorry for the delay. Let's go ahead and scan the system to see what else if anything we can find going on.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Unfree]

problem was solved, threat was removed. just wanted to warn others that the software may have malware bundled in it. thanks.

[Unfree]

new to the forum so dont know if there is a sub for warnings.

 

[AdvancedSetup]

All good, I'll go ahead and give some advice to help keep the computer clean and go ahead and close your topic.

 

 

Let's get real. If you're not backing up your data and you're still using Google Chrome then you're just not serious about Privacy, Safety, and protecting your data. Malwarebytes is a fantastic program but you still need to back up your data and you still need to block scripts and Ads in your browser. 
If you're still using Google Chrome I would highly suggest you consider using Firefox instead. For more advanced users you might consider installing NoScript as well (it does have a higher learning curve though)

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer
How to use uBlock Origin to protect your online privacy and security | uBlock Origin tutorial 2018

This video tutorial above explains how to use uBlock Origin in advanced user mode and all the advanced settings to protect your online privacy and help prevent unwanted sites from changing your browser settings

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

Thank you for choosing Malwarebytes and tell your friends and family too. We're here to help.

Ron

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks