Found cryptominer and now rundll error on startup

[ziemekp]

Hello,

Thanks to malwarebytes for helping me find cryptominer! I removed it, but now got RunDLL error on startup.

Logs:
https://pastebin.com/Cc0GhNDr
https://pastebin.com/9dXBQeYM

 

Can you help me fix it? 

[TwinHeadedEagle]

Hello,

Can you export MalwareBytes scan log when you removed the infection?

[ziemekp]

I closed app. Got only fresh scan.

Cryptominer was locate: Users/User/AppData/Roadming/Microsoft/Xservice

raport.txt

[TwinHeadedEagle]

This log doesn't show infection. Can you find one with infection in the log?

Edited April 22, 2020 by TwinHeadedEagle

[ziemekp]

That's the problem, i don't have it...

[TwinHeadedEagle]

Please collect and upload the diagnostic data using our MBST?

• Download and run the Malwarebytes Support Tool
• Accept the EULA and click Advanced tab on the left (not Start Repair)
• Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

[ziemekp]

1h it is still working, it's normal? PC slowed down

[TwinHeadedEagle]

Hmm, can you open your Task Manager and locate FRST process if present and kill it. MBST should finish then.

[ziemekp]

There is only mb-support procecss, "Collect LOGS" is done, MBST is stuck on "Run FRST"

[TwinHeadedEagle]

Yes. Press Ctrl + Shift + Esc, then click Details. Locate FRST64.exe or FRST.exe or FRSTEnglish.exe, right click on it and then end process. MBST should finish.

Edited April 22, 2020 by TwinHeadedEagle

[ziemekp]

[TwinHeadedEagle]

Nevermind you can close MBST.

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

 

 

Let me know if DLL error on startup is fixed now.

fixlist.txt

[ziemekp]

Perfect, no error and system is now working properly. Thanks!

[TwinHeadedEagle]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

[TwinHeadedEagle]

Topic has been reopened per request.

Thanks

 

[ziemekp]

Miner again

raport.txt Addition.txt FRST.txt

[TwinHeadedEagle]

I don't see anything obvious in the logs. Let's check something. You can do the Fix the same way to did before.

 

fixlist.txt

[ziemekp]

Done, restart and observe?

[TwinHeadedEagle]

No need to restart as we didn't fix anything. Please upload fixlog.txt

[ziemekp]

Fixlog.txt

[ziemekp]

I propablu uploaded wrong report damn, sorry

raport.txt

[TwinHeadedEagle]

Is miner still active?

[ziemekp]

RunDLL popped once errror with: vccorelib141xvd.dll

But defender/malwarebytes didn't find anything.

[ziemekp]

Damn, still this:

 

FRST.txt Addition.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

fixlist.txt