System Infected: Miner.Bitcoinminer Activity 7

[coleoptero]

Hello, first of all I apologize because my English is not very good.

My antivirus (Norton) constantly notifies me that it has blocked an attack of: "System infected: Miner.Bitcoinminer Activity 7" (at least 5 or 10 times per minute), and when I display the details of any of these notifications, it indicates that the Gravity is high, and what was blocked was an "intrusion attempt by system-update.info".

I have tried to solve this by scanning the computer with different software and antivirus such as SpyHunter5, MalwareBytes, Avast, and Norton. Of all these programs, the only one that identified a threat (Trojan) was Norton, which it repaired and eliminated. However, Norton continues to constantly report that it has blocked "the Miner.Bitcoinminer Activity 7 attack."

It is as if he could not identify and control the source of the attack, but he can block the attack every so often. I think this means that my computer is not protected against this threat and I would like to control it, and it is very annoying that the antivirus notify me again and again. I thank you very much in advance.

My laptop is an Acer 4gb RAM, Intel core I3 (8th gen), 1Tb hard drive, with Windows 10.

Attached the security history in .txt format to this post, I think you can get more information from there.

Historial reciente.txt

[AdvancedSetup]

Hello @coleoptero and

Please temporarily disable your Norton antivirus and run the following for me. Once completed make sure you re-enable your Norton protection.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[coleoptero]

Okay, thank you very much for answering. I followed all the steps.

I attach the corresponding files:

Step 1: "Summary text"
Step 2: "AdwCleaner [C00]"
Step 3: "FRST" and "Additions"

All files in .txt format.

What should I do now?

 

Addition.txt AdwCleaner[C00].txt FRST.txt Summary Text.txt

[AdvancedSetup]

Please temporarily fully uninstall the following applications. Go to Control Panel, Programs, Add/Remove and uninstall them.

Avast Free Antivirus
Norton Security
SpyHunter 5
Bonjour
 

Once you've done that, restart the computer one more time. Then run the 3 steps again.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[coleoptero]

Ok, thanks, I have uninstalled the 4 softwares that you indicated to me. Now I return to attach the 4 new files.

Step 1: "Summary text"
Step 2: "AdwCleaner [C00]"
Step 3: "FRST" and "Additions"

What should I do now?

Addition.txt AdwCleaner[C01].txt FRST.txt Summary Text.txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[coleoptero]

 

Ok, I did what you told me and I attached the file "fixlog.txt". What should I do now? Do I reinstall the antivirus? Thank you very much again.

Fixlog.txt

[AdvancedSetup]

No, don't install anything just yet.

How is the computer running now?
Are there still any signs of an infection?

If the computer is no longer showing any signs of an infection you should run Windows Update and update your computer. It's running an older version of Windows 10

Click on START and type in "Check for updates" and click on the application. That should run and update Windows 10

Let me know if there are any issues

Ron

 

[AdvancedSetup]

The Windows 10 build 1903 is metered by Microsoft.  So if it does not show up today  ( when you do your Windows Update check run),

try again tomorrow at the top of the hour.

You eventually will see a display like this on Windows Update.

 

 

When you see it, click the blue line "Download and install now".

[coleoptero]

Well, it took me a while to install the updates but I finally did it. I have not observed strange behaviors in the computer that could be associated with an infection, however, I think that before all this I did not distinguish them either, I just realized due to the warnings from Norton, so I can not say for sure that the threat is no longer. What comes? Thanks again.

[AdvancedSetup]

Restart the computer one more time. Then run the following again and attach back both new logs

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

[coleoptero]

Ok, I'm ready with the new scan, here are the two files FRST64 threw. I will be attentive.

Addition.txt FRST.txt

[AdvancedSetup]

I do not see any obvious signs of an infection. The computer looks to be clean.

Ron

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[AdvancedSetup]

Hi there,

Let me get all new logs please.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[coleoptero]

Ok, here are the new files

Addition.txt FRST.txt Summary.txt AdwCleaner[C02].txt

[AdvancedSetup]

There seems to be either something wrong with your installation of Norton or it's locking files. Can you please temporarily uninstall Norton antivirus for now.

It looks like Norton probably auto updated recently.
https://community.norton.com/en/blogs/product-update-announcements/norton-2217247-windows-now-available

Please download their removal tool from the following link and use it to uninstall Norton Antivirus
https://support.norton.com/sp/en/us/home/current/solutions/v60392881_EndUserProfile_en_us

Once that has completed, please run the 3 STEPS again and post back new, fresh logs.

Ron

 

 

[coleoptero]

Now I did it after uninstalling the antivirus

AdwCleaner[S03].txt Addition.txt FRST.txt Summary.txt

[coleoptero]

 

I was wrong, here is the correct adwcleaner file

AdwCleaner[C03].txt

[AdvancedSetup]

Hi there

Are  you sure you used the Norton Removal Tool? The logs seem to indicate that there are still Norton files and entries running which that tool should have removed.

 

[coleoptero]

Thats weird. Well, to make sure I manually uninstalled Norton and then I got rid of the files associated with it. Here are the new files.

Addition.txt AdwCleaner[C04].txt FRST.txt Summary.txt

[AdvancedSetup]

The following items are installations from Microsoft that have Advertising elements that come with it. You may wish to consider uninstalling these applications.

 

¡Solitario! -> C:\Program Files\WindowsApps\26720RandomSaladGamesLLC.SimpleSolitaire_6.14.58.0_x64__kx24dqmazqk8j [2019-06-08] (Random Salad Games LLC) [MS Ad]
Correo y Calendario -> C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20174.0_x64__8wekyb3d8bbwe [2019-06-08] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for JavaScript -> C:\Program Files\WindowsApps\Microsoft.Advertising.JavaScript_10.1805.2.0_x64__8wekyb3d8bbwe [2019-06-09] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for JavaScript -> C:\Program Files\WindowsApps\Microsoft.Advertising.JavaScript_10.1805.2.0_x86__8wekyb3d8bbwe [2019-06-09] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-06-08] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-06-08] (Microsoft Corporation) [MS Ad]
Microsoft Noticias -> C:\Program Files\WindowsApps\Microsoft.BingNews_4.30.10924.0_x64__8wekyb3d8bbwe [2019-06-08] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.6132.0_x64__8wekyb3d8bbwe [2019-06-15] (Microsoft Studios) [MS Ad]
MSN El tiempo -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.28.10351.0_x64__8wekyb3d8bbwe [2019-06-08] (Microsoft Corporation) [MS Ad]
Picas -> C:\Program Files\WindowsApps\26720RandomSaladGamesLLC.Spades_5.2.24.0_x64__kx24dqmazqk8j [2018-09-11] (Random Salad Games LLC) [MS Ad]
Simple Mahjong -> C:\Program Files\WindowsApps\26720RandomSaladGamesLLC.SimpleMahjong_5.5.13.0_x64__kx24dqmazqk8j [2019-06-08] (Random Salad Games LLC) [MS Ad]

 

You may also want to consider using Google Public DNS which is often a faster and more secure DNS than some other and in some cases better than an ISP.

https://developers.google.com/speed/public-dns/

I see you appear to be using Dashlane for passwords. I would highly suggest moving to a better program. Here are a couple of free unrestricted programs
https://bitwarden.com/
https://keepass.info/

The logs do not show any signs of a Bitcoin Miner. What makes you believe you may have one?

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Ron

 

 

 

 

[coleoptero]

Hi, thanks for that information. I followed the steps and I feel that I no longer have bitcoinminer presence. I'll leave the fixlog here. Can I reinstall norton? Thank you very very much.

Fixlog.txt

[AdvancedSetup]

Hello @coleoptero

Sorry for the delay. Yes, if all is working well now and you'd like to reinstall Norton, please do. Let me know if there is anything else I can assist you with.

Thank you again

Ron