i was infected by danabot

[Eft1]

i did as i was required in here.

I didn't connected to any account, was my passwords stolen anyways?

Am i registered in some botnet or i was removed from it when danabot was removed?

Should i change all of the passwords,even of those who are just connected to my email but i wasn't logged in to them?

 

thank you so much for the help,is there a way to show my appricietion?

Addition.txt FRST.txt

Edited May 21, 2020 by AdvancedSetup
corrected font issue

[AdvancedSetup]

Hello @Eft1

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[Eft1]

hello thank you for your help.

i scanned before with Farbar therefore i already have Addition.txt

FRST.txt Report.txt Addition.txt AdwCleaner[C00].txt AdwCleaner[S00].txt

Edited May 21, 2020 by AdvancedSetup
removed quote

[AdvancedSetup]

You have the following Google Chrome extension installed that looks to be bad. Please open your Extensions in Google Chrome and see if you can remove it.

CHR NewTab: Profile 1 ->  Not-active:"chrome-extension://gffphgpcblfoaknmcaldoggadmomcgmm/html/index.html"

You also have 2 locked files that may or may not be an indicator of a rootkit infection. We'll have you run the following fix below and then recheck the system and see where we're at.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

 

[Eft1]

1 hour ago, AdvancedSetup said:

You have the following Google Chrome extension installed that looks to be bad. Please open your Extensions in Google Chrome and see if you can remove it.

CHR NewTab: Profile 1 ->  Not-active:"chrome-extension://gffphgpcblfoaknmcaldoggadmomcgmm/html/index.html"

You also have 2 locked files that may or may not be an indicator of a rootkit infection. We'll have you run the following fix below and then recheck the system and see where we're at.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt 1.71 kB · 1 download

Thanks

 

this extension appired the momant i got infected by itself.
it did let me delet it and its gone now from the extension manneger,even after reseting my computre.

Fixlog.txt

[AdvancedSetup]

Do you have access to another clean computer and a new, clean USB stick?

There appears to be something that is actively causing issues. Both SFC and DISM were unable to run.

 

[Eft1]

1 minute ago, AdvancedSetup said:

Do you have access to another clean computer and a new, clean USB stick?

There appears to be something that is actively causing issues. Both SFC and DISM were unable to run.

 

yes i do

[Eft1]

oh and i don't know if that's might had something to do with what you see, but i had an SrtTrail.txt error every time i restarted my PC few weeks ago but after a format it's resolved and i don't get it any more.
but the HDD probably still damaged.

[AdvancedSetup]

Great.

Please use the other computer and download the FRST program and save it to a clean, fresh USB stick.

Then start the infected computer into the Recovery Console and after it boot insert the USB stick. Do not insert until the computer starts to load the Recovery Environment otherwise you'll need to format the USB stick and start over.

https://www.tenforums.com/tutorials/5487-troubleshoot-windows-10-failure-boot-using-recovery-environment.html

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

 

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt

Once in the Command Prompt:

1. In the command window type in notepad and press Enter.
2. The notepad opens. Under File menu select Open.
3. Select "Computer" and find your flash drive letter and close the notepad.
4. In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
5. Note: Replace letter e with the drive letter of your flash drive.
6. The tool will start to run.
7. When the tool opens click Yes to disclaimer.
8. Press Scan button.
9. It will make a log (FRST.txt) on the flash drive.
10. Restart the infected computer into Normal Mode, and post that new log from the USB stick to your topic here 

Thanks

 

[Eft1]

here it is

FRST.txt

[AdvancedSetup]

Please see if you can save the following file to the e:\ drive with the FRST program..

Then start into Recovery Environment and try to run FRST again as before but this time click on the FIX button.

fixlist.txt

Thanks

 

[Eft1]

8 hours ago, AdvancedSetup said:

Please see if you can save the following file to the e:\ drive with the FRST program..

Then start into Recovery Environment and try to run FRST again as before but this time click on the FIX button.

fixlist.txt 272 B · 2 downloads

Thanks

 

done

Fixlog.txt

[AdvancedSetup]

Great, please start back into Normal Mode and see if  you can run Malwarebytes or install Malwarebytes and do a new Threat Scan - go to settings and enable Rootkit scanning first.

MB4 Offline Installer
https://downloads.malwarebytes.com/file/mb4_offline

 

[Eft1]

1 hour ago, AdvancedSetup said:

Great, please start back into Normal Mode and see if  you can run Malwarebytes or install Malwarebytes and do a new Threat Scan - go to settings and enable Rootkit scanning first.

MB4 Offline Installer
https://downloads.malwarebytes.com/file/mb4_offline

 

hey i enabled Rootkit scan and scaned the system, MB didn't seems to find any thing.
here is the report:

Report.txt

[AdvancedSetup]

Good, good.

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not.

 

Once that is done, please run a new scan with FRST and make sure to place a checkmark in Addition

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

[Eft1]

33 minutes ago, AdvancedSetup said:

Good, good.

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not.

 

Once that is done, please run a new scan with FRST and make sure to place a checkmark in Addition

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Kaspersky getting stuck on this file (int the picture) i waited for about 4 hours and he didn't move on so i tried to scan aging but he got stock on the same file

[Eft1]

after few attempts and restarting my computer he completed! woohoo.

no threats found

FRST.txt Addition.txt

[AdvancedSetup]

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

 

[Eft1]

3 hours ago, AdvancedSetup said:

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt 538 B · 1 download

Thanks

 

done

Fixlog.txt

[AdvancedSetup]

Something prevented the tool from running as expected.

Please restart the computer. Then after reboot, disable security software and run the following fix.

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

 

[Eft1]

4 hours ago, AdvancedSetup said:

Something prevented the tool from running as expected.

Please restart the computer. Then after reboot, disable security software and run the following fix.

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt 110 B · 1 download

Thanks

 

here the log

Fixlog.txt

[Eft1]

i see this error in the new file aswell "Windows Resource Protection could not perform the requested operation.".
mybe its has to do something with my bad HDD?

[AdvancedSetup]

Have you tested the hard drive? If you have a failing hard drive I would highly recommend you back up your data and then get the drive replaced.

 

Press the Windows + R keys to open the Run dialog, type powershell.exe, and press Enter.

In PowerShell, copy and paste the command below, and press Enter

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

CHKDSKResults.txt file will be created on your desktop, that is the log file of your chkdsk scan results from Event Viewer.

Please upload that file on your next reply

 

[Eft1]

1 hour ago, AdvancedSetup said:

Have you tested the hard drive? If you have a failing hard drive I would highly recommend you back up your data and then get the drive replaced.

 

Press the Windows + R keys to open the Run dialog, type powershell.exe, and press Enter.

In PowerShell, copy and paste the command below, and press Enter

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

CHKDSKResults.txt file will be created on your desktop, that is the log file of your chkdsk scan results from Event Viewer.

Please upload that file on your next reply

 

i can't do it because whe i start powershell its opens and immidiatly close itself :\.
tryed some methosed that a saw on google to fix it but none of them worked.

i know for a fact that's the HDD is failing because  i had an SrtTrail.txt error every time i restarted my PC few weeks ago but after a format windows it's resolved and i don't get it any more.
sorry that my PC is such a mass,thank you very much for your time and effort.

[Eft1]

*methods that i saw (sorry for that,no edit button)