Probably got hacked, definitely infected

[gdobre]

Hi, as I ran some scans this days, it occurred to me that I might been hacked.

I have attached below Malwarebytes scans (2 in a row, 10 minutes difference), ESET and Farbar. Between Malwarebytes and eset, I have received 5 Malwarebytes clean reports, after which eset found 5 more issues.

To be honest, I have neglected my antivirus/malware protection and counted only on Window security, and now I regret it.

If it's possible, I'd request some guidance, thank you.

I'd also love some assistance with improving the firewall security, wi-fi router (even courses would be great). Can't believe I wanna learn programming, but I'm so lazy even to install an antivirus, and got so burnt. 

Addition.txt FRST.txt Malwarebytes 1st scan.txt Malwarebytes 2nd scan.txt Eset log.txt

[AdvancedSetup]

Hello @gdobre

 

Please follow the directions from the following topic and let us know if that corrects the issue for you.

 

Please make sure you also clean up Google Chrome on each system

Set your default search engine
https://support.google.com/chrome/answer/95426?co=GENIE.Platform%3DDesktop&hl=en

Clear cache & cookies
https://support.google.com/accounts/answer/32050?co=GENIE.Platform%3DDesktop&hl=en

Clear browsing data
https://support.google.com/chrome/answer/2392709?hl=en&ref_topic=7438008

Remove unwanted ads, pop-ups & malware
https://support.google.com/chrome/answer/2765944?co=GENIE.Platform%3DDesktop&hl=en

Set your homepage and startup page
https://support.google.com/chrome/answer/95314?co=GENIE.Platform%3DDesktop&hl=en

Update Google Chrome
https://support.google.com/chrome/answer/95414?hl=en&ref_topic=7438008

 

 

If you need further help with cleaning Google Chrome or more extensive information please review the following.

Resetting Google Chrome to clear unexpected issues
https://forums.malwarebytes.com/topic/258938-resetting-google-chrome-to-clear-unexpected-issues/

Thank you

 

 

Edited March 25, 2021 by AdvancedSetup
updated information

[gdobre]

I have done all of that. The thing is I found out my email address has been in a data breach and had to make some checks, passwords changed, and that's how I ended up finding I got a malware in my pc. I have looked up, and found about Purple Fox malware upgrade today. Verified my netstat and I've seen a lot of suspicious things here, specially for ports 445 and 139 using PID 4.

 

Before I've restarted the PC after the second Malwarebytes scan, I have checked the files it detected (yeah, not such a bright idea) but found out there was a document, full of text plus strange characters, but the thing that scared me, every website visited, but don't remember if there was any other details. After a research about port 445 and 139, those should not even be open (I sure didn't) backtracked it through the PID, found out it might be a Microsoft application, ntoskrnl but, checking the Digital signature, there is an Unauthenticated attribute.

The default search engine for Chrome was always as google, but now I notice, there is a Russian search engine added, yandex. Removed it from the search engines. Used "Clean up computer" function yesterday, twice, it didn't find out anything, neither today after your recommendation. 

I am really sorry if my expression is unclear and I jump from a thing to another, but I'm kinda stressed, didn't sleep and I'm about to start work in couple of hours. I have attempted one more MB threat scan, it's been 3 hours and still scanning.

Going to restart my PC, give it another shot, and come back with an edit, if something appears. (not sure if right now, but when I wake up in 2 hours)

Is it just me, just being really paranoid? 

Here is what google password check reported back. 

What made me worried in first place, that made me check out the google email address and find what I found, was the thing that my mouse was always flying away, without being touched and extremely high latency.

Thank you so much for your time, attention and help, and I am so sorry for stressing you out, when is probably nothing, just me exaggerating just a password leak... Hopefully 

[AdvancedSetup]

Please click on Start menu and type in PowerShell and right-click over it and choose "Run as administrator" then copy / paste the following into the window and hit the Enter key.

$date = (get-date).AddDays(-2)
 
Get-WinEvent -MaxEvents 2000 -FilterHashtable @{
  LogName = "System"
  StartTime = $date
}  | Out-File c:\events.txt 

Then look for and upload the c:\events.txt log file

 

Then open an elevated admin command prompt and run the following. One-by-One each line and press the Enter key after each. Do not post the results back, just review them and see if anything looks suspicious or not and let me know.

wmic sysaccount
net localgroup administrators
wmic netlogin list

 

Then run the following antivirus scanner for me

 

 

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

Thanks

 

[gdobre]

As I checked the lines for cmd, didn't find anything suspicious (like I knew what to look for). The Status was OK for every SID, and true, at local account, no other administrator role. Checked the netstat again, and port 139 disappeared. 

Nothing found since the second scan, maybe the threat is over, or hiding? Can't find much info about the Purple Fox thing, how to detect it, and/or protect yourself against it. Can a virus evolve as it's detected? 

Should I reinstall my windows? I guess since it doesn't detect anything, it can't be a hidden virus in the HDD, can it? 

events.txt eset log 2.txt

[AdvancedSetup]

That all looks good. Let me have you run this routine again and get new logs please.

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[gdobre]

I got only 1 issue with ADW, a chrome extension, but all my extensions are still there. Thanks a lot for the help, hopefully the threat is gone, today I'll reinstall my windows too.

Addition.txt AdwCleaner[C00].txt FRST.txt Malwarebytes.txt

[AdvancedSetup]

The current logs do not show any infection. However the computer is certainly experiencing issues as shown by the Event Logs.
These all appear to be from today.

 

System errors:
=============
Error: (03/26/2021 09:24:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Steam Client Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (03/26/2021 09:24:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The SynTPEnh Caller Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (03/26/2021 09:24:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Citrix Workspace Updater Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (03/26/2021 09:24:23 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (03/26/2021 09:24:23 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) HD Graphics Control Panel Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (03/26/2021 09:24:23 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Bluetooth Driver Management Service service terminated unexpectedly.  It has done this 1 time(s).

 

If you're going to reinstall Windows 10 here is some information to possibly assist you.

 

Backup Software
https://forums.malwarebytes.org/index.php?/topic/136226-backup-software

 

Greg Carmack - MVP 2010-2020 -Clean Install Windows 10
https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/clean-install-windows-10/1c426bdf-79b1-4d42-be93-17378d93e587

How to Create a Local Account While Setting Up Windows 10
https://www.howtogeek.com/442792/how-to-create-a-local-account-while-setting-up-windows-10/

How to set up Windows 10 with a local account
https://www.windowscentral.com/how-set-windows-10-local-account

How to Clean Install Windows 10
https://www.tenforums.com/tutorials/1950-clean-install-windows-10-a.html

How to do a Clean Install of Windows 10 the Easy Way
https://www.howtogeek.com/224342/how-to-clean-install-windows-10/

How to do a clean installation of Windows 10
https://www.windowscentral.com/how-do-clean-installation-windows-10

How to install Windows 10 from DVD, USB, or ISO file
https://www.digitalcitizen.life/how-install-windows-10/

How to Custom Install Windows 10
https://www.tenforums.com/tutorials/120352-custom-install-windows-10-a.html

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you