sysWOW64 Powershell Trojan Help Needed

[blackhole5334]

It's a laptop. I could be wrong about the hdd, but ever since it was dropped, it has been slow and laggy.

I did a clean boot, but it didn't do anything. Was still getting 100% disk at startup and when opening anything. I tried twice. So I ran check disk with the f parameter, and again, no change. So then I ran check disk with the r parameter, and it seems to have done something. It hit 100% on startup, but quickly went down to normal. Thanks a lot for that.

So, it's all clean? Is there anything else I should do to be 100% sure there's no malware?

[Maurice Naggar]

I had suggested that you add the appropriate Malwarebytes Browser Guard for each of Edge, Chrome, Firefox, so that they are made safer.

We have run a series of different scans.

I do not believe that this machine has infection at this point.

If you think you suspect anything, you can scan with AVG & Malwarebytes for Windows.

 

Do a Check for Updates in Malwarebytes app. Use the guide here https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

 

Next, do a Windows RESTART.

 

Next be sure you do not open any games or such.

Next, do one new Scan with Malwarebytes.

 

If it tags anything, TICK the line item so that it is Quarantined.

 

When all done, copy the Scan report & attach with Reply.

[blackhole5334]

I don’t suspect anything. It’s running much better since the malware was removed and especially since the check disk fix.

Thanks a lot again! I wish you well.

[Maurice Naggar]

Hello. Glad that things are much better. I am glad to have helped.  

We can proceed with cleanup of tools we used.

To remove the FRST  tool & its work files, do this.  Go to your Downloads folder.  Do a RIGHT-click on FRST64.exe & select RENAME & then change it to UNINSTALL.exe .

Then run that ( double click on it)  to begin the cleanup process.

Delete msert.exe

Delete the esetonline download file.

Any other download file I had you download, you may delete.  

I wish you all the best.  Stay safe.

Sincerely.

Maurice.    

Edited May 16, 2021 by Maurice Naggar

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you