Jump to content

Riskware.Bitcoinminer keeps reappearing after quarantie


Recommended Posts

I have an issue were when copying crypto wallet address the copied address will always change to a particular undesired address. After running Malwarebytes it quarantined some trojans and malware, including Riskware.Bitcoinminer. After a reset only Riskware.Bitcoinminer and Malware.AI.288223801 keep showing up even after being put under quarantine.

Link to post
Share on other sites
  • Root Admin

Hello @Sanger and :welcome:

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.

 

Spoiler
 
 
 
 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

image.png

image.png

image.png

 

 



STEP 01

  • If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
  • If you don't have Malwarebytes installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and select Scan and let it run.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Double-click to run the program
  • Accept the End User License Agreement.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, if items are found please click Quarantine.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
  • Please attach the Additions.txt log to your reply as well.
  • On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

Link to post
Share on other sites
  • Root Admin

Please go into Control Panel, Programs, Programs and Features and uninstall the following

Java 8 Update 251
 

If at all possible I would recommend you try to use your computer without Java. If you really do need to have it then please keep it up to date at all times and uninstall older versions before installing the newer version.  https://java.com

Windows Defender is flagging this file as a potential password stealer.

 

Date: 2021-02-07 12:11:58
Description:
Antivirus de Microsoft Defender detectó malware u otro software potencialmente no deseado.
Para más información, consulta lo siguiente:
https://go.microsoft.com/fwlink/?linkid=37020&name=PWS:Win32/VB.CU&threatid=2147646377&enterprise=0
Nombre: PWS:Win32/VB.CU
Id.: 2147646377
Gravedad: Grave
Categoría: Programa de interceptación de contraseñas
Ruta de acceso: file:_F:\setup.exe
Origen de detección: Equipo local
Tipo de detección: Concreto
Origen de detección: Protección en tiempo real
Usuario: DESKTOP-UJ4O9GI\donal
Nombre de proceso: C:\Windows\explorer.exe
Versión de inteligencia de seguridad: AV: 1.331.443.0, AS: 1.331.443.0, NIS: 1.331.443.0
Versión de motor: AM: 1.1.17800.5, NIS: 1.1.17800.5

 

 

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

  • It will start a download of "esetonlinescanner.exe"
  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started. 
  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes 
  • When prompted for scan type, Click on Full scan 
  • Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
  • Have patience.  The entire process may take an hour or more. There is an initial update download.
  • There is a progress window display.
  • You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
  • When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
  • Click The blue “Save scan log” to save the log.
  • If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
  • Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

Link to post
Share on other sites
  • Root Admin

Please do the following.

  • Open Malwarebytes and click the cross-hair just above the word Scanner
  • Then near the bottom click the Advanced scanners link
  • Then under Custom Scan click on the Configure Scan button
  • Enable scan for rootkits
  • Place a checkmark on your C: volume hard drive and click the Scan button

This scan will take a long while to run but once completed please go to Reports and export the log to text or clipboard and post back the results.

 

Visually

Please open Malwarebytes and click on the cross-hair just above the word Scanner

image.png

 

Then click Advanced scanners

image.png

 

Then click the Configure Scan button

image.png

 

Enable all checked items as shown and select your C: drive and click the Scan button

image.png

 

Allow Malwarebytes to remove anything it finds and post back the log once completed.

 

Thanks

 

 

 

Link to post
Share on other sites

Malwarebytes
www.malwarebytes.com

-Detalles del registro-
Fecha del análisis: 22/2/21
Hora del análisis: 18:58
Archivo de registro: 6a99dd00-7561-11eb-bdc5-1078d2843130.json

-Información del software-
Versión: 4.3.0.98
Versión de los componentes: 1.0.1173
Versión del paquete de actualización: 1.0.37407
Licencia: Prueba

-Información del sistema-
SO: Windows 10 (Build 19041.804)
CPU: x64
Sistema de archivos: NTFS
Usuario: DESKTOP-UJ4O9GI\donal

-Resumen del análisis-
Tipo de análisis: Análisis personalizado
Análisis iniciado por:: Manual
Resultado: Completado
Objetos analizados: 512281
Amenazas detectadas: 1
Amenazas en cuarentena: 0
Tiempo transcurrido: 8 hr, 21 min, 48 seg

-Opciones de análisis-
Memoria: Activado
Inicio: Activado
Sistema de archivos: Activado
Archivo: Activado
Rootkits: Activado
Heurística: Activado
PUP: Detectar
PUM: Detectar

-Detalles del análisis-
Proceso: 0
(No hay elementos maliciosos detectados)

Módulo: 0
(No hay elementos maliciosos detectados)

Clave del registro: 0
(No hay elementos maliciosos detectados)

Valor del registro: 0
(No hay elementos maliciosos detectados)

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 0
(No hay elementos maliciosos detectados)

Archivo: 1
Malware.AI.288223801, C:\USERS\DONAL\APPDATA\ROAMING\DO\WORK, Sin acciones por parte del usuario, 1000000, 0, 1.0.37407, 5462C40034F4990B112DF239, dds, 01128759, E7F4C450FD3EDAFA7CA333E99CABE270, 7058B3DAF39F7499BCFD46858180FDEDB74ED7C61A9E3D79926B94A1B7BC3233

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

Link to post
Share on other sites
2 hours ago, AdvancedSetup said:

Good day @Sanger

That looks to be a False Positive

How is the computer running now?

Are there still any signs of an issue?

 

Good day, apparently is running fine and crypto wallet addresses are not changing after copying them.

 

1 hour ago, AdvancedSetup said:

Our Research Team would like to get some logs to look at that detection please.

Can you follow the directions from below and post back the log.

Upload Malwarebytes Support Tool logs offline

Thanks

 

Done

mbst-grab-results.zip

Link to post
Share on other sites
  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites
  • Root Admin

So Research says this is not a False Positive. They say this is a Bitcoin Miner

Did you tell our Program to remove it?

 

Archivo: 1
Malware.AI.288223801, C:\USERS\DONAL\APPDATA\ROAMING\DO\WORK, Sin acciones por parte del usuario, 1000000, 0, 1.0.37407, 5462C40034F4990B112DF239, dds, 01128759, E7F4C450FD3EDAFA7CA333E99CABE270, 7058B3DAF39F7499BCFD46858180FDEDB74ED7C61A9E3D79926B94A1B7BC3233

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.