Jump to content

Recommended Posts

i downloaded a book file 2 days before and it got saved in DVD drive E when i opened it, it asked to run it to view files and i did it, after few hours window security was popping up saying threat detected and i ejected the file, but still the window security is popping up and its saying its Trojan virus so my friend suggested to use Malwarebytes and I installed it did a full scan it detected the Trojan virus and quarantined it and I got it deleted and ran a full system scan with windows security and now its showing no threat.

but I'm still confused that it removed the virus or not because in the history of malwarebyte it says that the Trojan.glupteba.e - removal failed.

what to do? is it still in my pc?

and one more thing is can i use online banking ?

 

help.png

Link to post
Share on other sites

Hello archana and welcome to malwarebytes....

Continue with the following:

Open Malwarebytes, select > "settings" > "security tab"

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Go back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Single click on the target sight above scanner window.
  • In the new window select Report
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Export to Txt" then attach the log to your reply...


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply...

Thank you,

Kevin....
Link to post
Share on other sites

thank you so much for replying !!!

log from Malwarebytes:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/13/20
Scan Time: 11:55 AM
Log File: 7c911218-94e2-11ea-8972-507b9d892153.json

-Software Information-
Version: 4.1.0.56
Components Version: 1.0.896
Update Package Version: 1.0.23742
License: Trial

-System Information-
OS: Windows 10 (Build 18362.778)
CPU: x64
File System: NTFS
User: DESKTOP-NKMGN8V\IGML-Admin

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 307706
Threats Detected: 19
Threats Quarantined: 18
Time Elapsed: 4 min, 55 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 7
Adware.ICLoader, HKLM\SOFTWARE\MICROSOFT\bestavicampaign563, Quarantined, 520, 584322, 1.0.23742, , ame,
Adware.ICLoader, HKLM\SOFTWARE\MICROSOFT\campaign9961, Quarantined, 520, 518478, 1.0.23742, , ame,
Adware.ICLoader, HKLM\SOFTWARE\MICROSOFT\multitimercampaign84170, Quarantined, 520, 518476, 1.0.23742, , ame,
Adware.ICLoader, HKLM\SOFTWARE\MICROSOFT\Speedycar, Quarantined, 520, 518473, 1.0.23742, , ame,
Adware.ICLoader, HKLM\SOFTWARE\MICROSOFT\TechnologyDesktopnew, Quarantined, 520, 518479, 1.0.23742, , ame,
Trojan.Glupteba.E, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{57AA95DA-C291-4C1E-ACAC-DFC37E9D1B4E}, Quarantined, 493, 781231, 1.0.23742, , ame,
PUP.Optional.GarbageCleaner, HKU\S-1-5-21-1375186200-1658034882-4267554585-1001\SOFTWARE\GCleaner, Quarantined, 1205, 676886, 1.0.23742, , ame,

Registry Value: 2
Trojan.Glupteba.E, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{57AA95DA-C291-4C1E-ACAC-DFC37E9D1B4E}|PATH, Quarantined, 493, 781231, 1.0.23742, , ame,
Trojan.Glupteba.E, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{DD0786B3-1276-4F95-8FB1-A16CF7C18592}, Removal Failed, 493, 795081, 1.0.23742, , ame,

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.GarbageCleaner, C:\PROGRAMDATA\GARBAGE CLEANER, Quarantined, 1205, 676884, 1.0.23742, , ame,

File: 9
PUP.Optional.GarbageCleaner, C:\ProgramData\Garbage Cleaner\Bunifu_UI_v1.5.3.dll, Quarantined, 1205, 676884, , , ,
Adware.Linkury, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\installer.dat, Quarantined, 423, 715618, 1.0.23742, , ame,
Adware.Linkury.TskLnk, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\INSTALLATIONCONFIGURATION.XML, Quarantined, 15073, 444923, 1.0.23742, , ame,
Rootkit.Agent, C:\WINDOWS\SYSTEM32\DRIVERS\WDF23630.SYS, Quarantined, 489, 816419, 1.0.23742, 8983890321123109FCA4357F, dds, 00717372
Generic.Malware/Suspicious, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\TEMP\IQ4H42JLQJN\53QMYCRXDT3.EXE, Quarantined, 0, 392686, 1.0.23742, , shuriken,
Adware.Csdimonetize, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\TEMP\IS-C9HK7.TMP\MONTENEGRO.EXE, Quarantined, 2943, 820910, 1.0.23742, E5F2CE9B20920ACAB39DF2E9, dds, 00717372
PUP.Optional.DiskFixer, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\TEMP\G05R2TZXZGW.EXE, Quarantined, 2966, 758704, 1.0.23742, , ame,
Trojan.Ranumbot, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\TEMP\CSRSS\W20200508.EXE, Quarantined, 14854, 819921, 1.0.23742, E2E5978B7717AD25FF042E32, dds, 00717372
Trojan.Downloader.PWS, C:\USERS\IGML-ADMIN\APPDATA\LOCAL\TEMP\U4A3HW44BAL\WYFDGGFF.EXE, Quarantined, 13215, 807693, 1.0.23742, 5C2C5B225C465B74EC2EC84F, dds, 00717372

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

 

Adw Cleaner log:

# -------------------------------
# Malwarebytes AdwCleaner 8.0.4.0
# -------------------------------
# Build:    04-03-2020
# Database: 2020-05-13.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    05-16-2020
# Duration: 00:00:08
# OS:       Windows 10 Enterprise
# Cleaned:  1
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\Windows\rss

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1560 octets] - [16/05/2020 15:01:20]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

 

 

malware.txt

Link to post
Share on other sites

 
Hello archana,

Thanks for those logs, continue:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

user posted image

Next,

Download "Microsoft's Safety Scanner" and save direct to the desktop

Ensure to get the correct version for your system....

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download


Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.


Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

The log will include log details for each time MSRT has run, we only need the most recent log by date and time....

Let me see those logs in your reply, also tell me if there are any remaining issues or concerns...

Thank you,

Kevin..

fixlist.txt

Link to post
Share on other sites

done with Microsoft's Safety Scanner and this is the log:

 

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.76, October 2019 (build 5.76.16439.1)
Started On Fri Oct 11 17:12:52 2019

Engine: 1.1.16300.1
Signatures: 1.301.2099.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Fri Oct 11 17:16:22 2019


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.77, November 2019 (build 5.77.16547.2)
Started On Fri Nov 15 08:42:26 2019

Engine: 1.1.16500.1
Signatures: 1.305.993.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Fri Nov 15 08:46:12 2019


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.78, December 2019 (build 5.78.16632.1)
Started On Sat Dec 14 05:16:16 2019

Engine: 1.1.16500.1
Signatures: 1.305.2804.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Sat Dec 14 05:21:03 2019


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.79, January 2020 (build 5.79.16654.1)
Started On Sun Jan 19 18:15:37 2020

Engine: 1.1.16600.7
Signatures: 1.307.832.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Sun Jan 19 18:20:18 2020


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.80, February 2020 (build 5.80.16723.5)
Started On Thu Feb 13 20:01:08 2020

Engine: 1.1.16600.7
Signatures: 1.307.2526.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 13 20:05:42 2020


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.81, (build 5.81.16832.1)
Started On Mon Mar 30 09:09:17 2020

Engine: 1.1.16800.2
Signatures: 1.311.96.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Mon Mar 30 09:14:05 2020

Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.82, (build 5.82.17046.2)
Started On Wed May 13 18:35:08 2020

Engine: 1.1.16900.4
Signatures: 1.313.2734.0
MpGear: 1.1.16330.1
Run Mode: Scan Run From Windows Update

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 13 18:38:14 2020


Return code: 0 (0x0)

 

Link to post
Share on other sites

its fine but I'm still concern about the torjan glupteba removal failed
did it got removed or quarantined ?

the location in the Detection History of Malwarebytes is under the Registry Key points to a Firewall rule .

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{DD0786B-1276-4F95-8FB1-A16CF7C18592}

Link to post
Share on other sites

Web history removal is part of the fixlist I created, standard procedure for an infected system.. The FW policy did not show in the log from Malwarebytes scan with rootkits enabled. Three FW rules were listed for and removed with FRST fix..

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6D4F2D0B-76DB-4117-BC87-C964560B3B23}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2237E65E-C204-4EBA-ACC8-3DC747D81638}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{575C1171-9A64-4F13-B43E-6C77795FC026}" => removed successfully

Continue with the following:

Run FRST one more time:

Type or copy/paste the following in the edit box after "Search:".

{DD0786B-1276-4F95-8FB1-A16CF7C18592}

Click Search Registry button and post the log (Search.txt) it makes to your reply.

user posted image

 
Thanks...

 

Edited by kevinf80
typo
Link to post
Share on other sites

Hello again archana,

Yes your computer is clean, you should change all passwords used on this system while infected; specifically any with financial impact. After that continue to clean up....

Right click on FRST here: C:\Users\IGML-Admin\Downloads\FRST64.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator"

If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST64 to uninstall

That action will remove FRST and all created files and folders...

Next,

Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2

Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point

Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/

From there you should be good to go...

Next,

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin... user posted image
Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.