Jump to content
jdubo79

possible infection

Recommended Posts

My computer has been at 100% disk usage and running very slow, perhaps due to malware.  I followed the instructions you posted on https://forums.malwarebytes.com/topic/256382-its-very-very-bad/ in the second post and my results are below and attached.

 

malw# -------------------------------
# Malwarebytes AdwCleaner 8.0.2.0
# -------------------------------
# Build:    01-27-2020
# Database: 2020-01-24.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    02-07-2020
# Duration: 00:00:02
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted       banggood.com

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1416 octets] - [07/02/2020 09:53:24]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 

 

MBScanReport.txt FRST.txt Addition.txt

Share this post


Link to post
Share on other sites

 

Hi, 

My name is Maurice. I will be helping and guiding you, going forward on this case.   Let me know what first name you prefer to go by.

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible.

 

Please only just attach   all report files, etc  that I ask for as we go along.

Thanks for the reports you attached above.

 

Windows 10 has the Microsoft Windows Defender which can run the Windows Defender Offline scan.
Windows Defender Offline in Windows 10 can be run directly from within Windows 10..

Click the Windows Start menu button on the Taskbar, select Settings icon. Then choose Update and Security.
 

In Windows Settings  >>> click on Windows Security from the left side list.

Next, In Windows Security section:  Click on the grey button Open Windows Security

next click on the blue Scan options

Look down the options list.  Tick on Windows Defender Offline scan.   Then click the grey "Scan now" button.


and let it scan the system.

Keep in mind that the design and what is scanned by Windows Defender is a whole different design from Malwarebytes. But do let me know how this scan goes and what the result is.

Share this post


Link to post
Share on other sites

Just scanned the system.  When it was done it just booted up windows normally, did not display any results or anything.

Share this post


Link to post
Share on other sites

You may seek / look at Windows Defender history.

This is the way to look at the Windows Defender scan history.

 

Go to the Windows Start menu.  Click on the Settings icon.

Now click on Update & Security.   Then click on Open Windows Security.

·  Click the Virus & threat protection tile     and then the Protection  history label  ( in blue color)

The Protection history will have a list of recent events.

.

In any event, I would like to proceed with all that follows.

As much as possible, for duration of this case, use the EDGE browser instead of Chrome.

[  2   ]

Housekeeping for Chrome.

Using Chrome go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

 

 

Other suggestions, for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history"

Check mark the line "Download history"

Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )


Still in Chrome, press ALT+F then Settings
Click Extensions on the left.
Closely review the browser extensions that are listed. Disable any that you are not familiar with or that you do not trust.

[   3    ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

 

I suggest you install the Malwarebytes Browser guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

 

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

 

Then proceed with the setup.

 

Also suggested for Chrome or Brave browser, the NoScript add-on extension for added protection from script exploits 

https://chrome.google.com/webstore/detail/noscript/doojmbjmlfjjnbmnoijecmcbfeoakpjm

 

.

for Mozilla Firefox, to get & install the Malwarebytes Browser Guard  Firefox extension.

Open this link in your Firefox browser:   

https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

Then proceed with the setup.

That link is for English US.   There are other language version.  Just go to the very bottom right of the page and look at “Change language” list drop down.

 

[   4    ]

Now a new scan of the system to check for viruses and other malware using a Microsoft tool.

The Microsoft Safety Scanner  is a free Microsoft stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Let me know the result of this.

The log is named MSERT.log 

the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is

C:\Windows\debug\msert.log

Please attach that log with your reply.

 

[   5    ]

Let’s  please try to get and run a special  report  tool from Microsoft. 

It does not make changes. It will be just a report.

 

  • Please download Sysinternals Autoruns from here and save it to your desktop.
  • Note: you also need to do the following:
  • Right-click on Autoruns.exe and select Properties
  • Click on the Compatibility tab
  • Under Privilege Level check the box next to Run this program as an administrator
  • Click on Apply then click OK


Double-click Autoruns.exe to run it.
Once it starts, please press the Esc key on your keyboard.
Now that scanning is stopped, click on the Options button at the top of the program and select Filter Options...

In the Autoruns Filter Options dialogue, verify that the following are unchecked, if they are checked, uncheck them:

  • Include empty locations
  • Hide Microsoft entries
  • Hide Windows entries


Verify that the following is checked, if it is unchecked, check it:

  • Verify code signatures


Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.


Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
Attach the Autoruns.zip folder you just created to your next reply

 

Thank you.

 

Edited by Maurice Naggar

Share this post


Link to post
Share on other sites

Hi,

Just a bit curious if you had the opportunity to do the prior suggestions over this weekend ?

Share this post


Link to post
Share on other sites

also your instructions look like they are only for chrome.  I just wanted to make you aware that this is a computer wide issue and not just Chrome

Share this post


Link to post
Share on other sites

That is a excellent result.     No infection found.
Microsoft Safety Scanner Finished On Mon Feb 10 10:59:21 2020

.

Thanks for the Autoruns report too.

There are 3 or so  tasks ( auto-starts) that you may temporarily turn off  .....just to help out a bit with the processor load.

CCleaner  + EpicGames Launcher + Switchboard Server
See Ed Bott's article on ZDNET  Windows 10 tip: How to disable  ( turn off )  unwanted startup programs
https://www.zdnet.com/article/windows-10-tip-how-to-disable-unwanted-startup-programs/

 

[  2  ]

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.
When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Look at & un-tick   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.

Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).

Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

Share this post


Link to post
Share on other sites

Eset found a few things attached.  My Disk Usage is still extremely high, I guess this may not be due to Malware if nothing else was found?esetresults.txt

Share this post


Link to post
Share on other sites

Thanks for the scan report.  The only actual potential threats were the 2 .php files    ( they were removed by Eset).

Yes, the disk usage is likely to be due to other factors.   Such as what other programs are running.   See about minimizing auto-started programs to the very bare bones needed.

This is what we geeks call a "clean boot startup"

How to perform a clean boot startup of Windows

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

 

Set the auto-started programs to only those that are absolutely necessary.   Then boot up and test.

Then you may try adding one at a time & re-enabling  and seeing where the difference is.  OR, just do only start the ones that are a absolute necessity.

and by the way, since we see no malware at this point, we will need to plan to wrap up this "malware suspect case".

Sincerely,

Maurice

Share this post


Link to post
Share on other sites

Thanks for your help.  I think it was due to a scheduled defrag of my hard drive.  I disabled it, and the problem seems better.

Share this post


Link to post
Share on other sites

Allright.  Let's wrap this up.

You should delete esetonlinescanner_enu.exe

You may delete anything else I had you download.

I am glad to have helped.  You are welcome.

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.