Computer infested with trojanfloxif

[robertdsouza]

Gave my PC for servicing and now I see that it has been infested with trojanfloxif. Malwarebytes removes it. But looks like it never goes away as MalwareBytes keeps prompting me to restart even after restarting. Looks like this malware keeps regenerating. Is there any solution for this? Please help

I have attached the FRST and Addition files after running Farbar

FRST.txt Addition.txt

[robertdsouza]

I am running MalwareBytes Premium Trial 4.3.0 on a Windows 10 64 bit machine

[Maurice Naggar]

Hi,       

My name is Maurice. I will be helping and guiding you, going forward on this case.

Let me know what first name you prefer to go by.   

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 

Please only just attach   all report files, etc  that I ask for as we go along.

I would appreciate  getting some key details from this machine in order to help you forward.

 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

 

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.

Download Malwarebytes Support Tool

    

    Once the file is downloaded, open your Downloads folder/location of the downloaded file

    Double-click mb-support-1.8.4.896.exe  to run the report

 

Once it starts, you will see a first screen with 2 buttons.  Click the one on the left marked "I don't have an open support ticket".

 

        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.

        

    Place a checkmark next to Accept License Agreement and click Next

Now click the left-hand side pane "I do not have an open support ticket"

 

    You will be presented with a page stating, "Get Started!"

    Do NOT use the button “Start repair” !   But look instead at the far-left options list in black.

 

    Click the Advanced tab on the left column

    

    Click the Gather Logs button

    

    A progress bar will appear and the program will proceed with getting logs from your computer.  Please do have patience.  It takes several minutes to gather.

   

    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK.  Then Exit the tool.

 

    Please attach the ZIP file in your next reply.

 

Please know I help here as a volunteer.  and that I am not on 24 x 7.

Help on this forum is one to one.   Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Thank you,

Sincerely.

Edited April 14, 2021 by Maurice Naggar

[robertdsouza]

Thank you Maurice,

I have attached the file in this comment.

Thankyou

Robert

mbst-grab-results.zip

[Maurice Naggar]

Thanks for sending the Zip report.

That shows that the Malwarebytes program is just Not installed.  And unfortunately as well, there is no old scan history.

 

We need to reuse the mb-support tool to do a new Clean install operation. Go to where you saved the mb-support-1.8.4.896.exe

 

Then double-check on it to get it to start.

Accept the EULA and click Advanced tab on the left (not Start Repair)

Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here

Please let us know how it goes.

After the new install, just let me know & wait for more guidance to follow.

[robertdsouza]

Hello Maurice, I have installed Malwarebytes

[Maurice Naggar]

Hello. These here are next steps.

Do Option One of this article so that Windows is set to SHOW all folders & files 

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

.

In Malwarebytes for Windows program, we want to do a special scan.

 

Click Settings ( gear icon) at the top right of Malwarebytes window. We want to see the SETTINGS window.

 

Then click the Security tab.   

 

Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON 👈

Click it to get it ON if it does not show a blue-color

 

Next, click the small x on the Settings line to go to the main Malwarebytes Window.

 

Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

 

You can actually click ( tick ) the topmost left check-box on the very top line to get ALL lines ticked ( all selected). 👈

🔻

Then click on Quarantine selected.

 

Then, locate the Scan run report; export out a copy; & then attach in with your reply.

 

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

We will do more, later. Cheers.

Edited April 22, 2021 by Maurice Naggar

[Maurice Naggar]

Hello. I hope you are doing well.

I have not heard back from you.

[robertdsouza]

Hello Maurice, extremely sorry for the delay.

I did the steps which you told me to do. Attached is the scan report

malwarebytes-report-7june-2021.txt

[Maurice Naggar]

Hello.  It's good to hear back from you.

I notice that on that last scan, only 1 file was removed.   BUT several related entries for "tasks" were left behind.   Please do what follows below with special attention to all detail.

 

• In Malwarebytes for Windows program, we want to do a special scan.
•  
• Click Settings ( gear icon) at the top right of Malwarebytes window. We want to see the SETTINGS window.
•  
• Then click the Security tab.   
• Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON 👈
•  
• Click it to get it ON if it does not show a blue-color
• .
• Next, click the small x on the Settings line to go to the main Malwarebytes Window.
•  
• Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

 

You can actually click ( tick ) the topmost left check-box on the very top line to get ALL lines ticked ( all selected). 👈

🔻

• Then click on Quarantine selected.

 

Then, locate the Scan run report; export out a copy; & then attach in with your reply.

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[robertdsouza]

Hello Maurice,

I have not quarantined the KMS~Rain onces as they are needed by Microsoft Word. They were present even before floxif was discovered on the computer. Is it possible if we can ignore them?

Thanks and regards

Robert

[Maurice Naggar]

Hello.

The thing is, "key management systems" are only ever used by large organizations, corporations  and only if they are purchased thru Microsoft.   and if so, they shoukd be signed by Microsoft.  AND Microsoft ddoes nor package them as R@1n .

On the other hand, files & related that are 

R@1n-KMS

 are known RISKWARWE    & classified as RiskWare.KMS

https://blog.malwarebytes.com/detections/riskware-kms/

The tools are often downloaded from sites of a shady nature.

I strongly advise that you have all of those Riskware entries removed. 

Edited June 8, 2021 by Maurice Naggar

[Maurice Naggar]

I am locking / closing this topic.  I cannot help on cases that have pirated software.   It is also against forum policy.   See this link.

 

I will not be following this topic thread.

It is a very big risk to keep anything R@1n-kms  .  Those types of things are known to be bundled with malicious malware.  Some can lead to encrypting ransomware.

This forum has had many many cases of infections by so-called KMS.

I regret you do nor take my advice.

Edited June 9, 2021 by Maurice Naggar