Coputer hacked - Malware can't be removed

[nach000]

Two days ago my computer was hacked and the hacker got access to my coinbase account. My bitcoins are gonne.

I used Malwarebytes to remove the trojans, changed my passwords and reinstalled chrome.

Then I run Malwarebytes again and it detected 5 trojans again. I put them in quarantine. 

After some time I run Malwarebytes again and it detects the same 5 files in a different folder location.

Trojan.BrowserHijack, C:\ProgramData\Iajcws\Szifzn\40343396\ctmch

\Szifzn\ - this part keeps changing to different letter combinations and the trojan never dissappears.

I am almost sure it appears everytime I restart the computer.

I would appreciate your help

 

Thanks

 

Addition.txt FRST.txt AdwCleaner[C01].txt Malwarebytes-scan 02.txt Malwarebytes-scan 01.txt

[nach000]

Update: I noticed a google chrome extension is being installed in my computer. The extension is called yRunFree

yRunFree is being installed from the trojan folder  C:\ProgramData\Iajcws\Szifzn\40343396

 

I deleted it and reinstalled chrome but it always reppears (same way as the trojan folder)

[Maurice Naggar]

Hi @nach000.    

i will need some other reports as well.

 

Please download MBST Support tool

https://downloads.malwarebytes.com/file/mbst

Once you start it click Advanced > Gather Logs

 

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

[nach000]

Thanks for your answer.

Here is the zip you asked

mbst-grab-results.zip

[TwinHeadedEagle]

Hi,

I will assist you.

Fix with Farbar Recovery Scan Tool

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

fixlist.txt

Edited May 17, 2021 by TwinHeadedEagle

[nach000]

Hi,

Thanks for your help!

Here is the fixlog

Fixlog.txt

[TwinHeadedEagle]

Ok. Please do another scan with MalwareBytes now.

[nach000]

My computer was off for some hours and I turned on now to do new scan.

Again it detected same Trojan with different location this time... and extension in google chrome is appearing again.

It doesn't matter how many times I scan and remove the files they keep appearing again and again

Malwarebytes scan.txt

[AdvancedSetup]

Hello @nach000

Can we get some fresh logs please.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

[nach000]

Hello!

Here are the files attached

Addition.txt FRST.txt

[AdvancedSetup]

Is this a Home computer or a Business computer?

You appear to be running McAfee antivirus as many service files are there and loading but the actual installation does not show and it does not show as registered to the Security Center either.

Did you install McAfee or are you using McAfee ?

 

[nach000]

It is my personal computer. I use it everyday. It is my main work tool.

To be honest, I don't remember installling McAfee. I thought it was preinstalled in my computer but I am not sure if that make sense.

I never used McAfee. Is it related to the problem?

Thanks for your help!

[AdvancedSetup]

I was going to manually remove some of them and then noticed there were too many. Let me find you the removal tool from McAfee and have you run that.

Back in minute

 

[AdvancedSetup]

Please visit the following site and download the McAfee Removal Tool under Method 2

https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS101331

 

The direct download link for the tool is:

https://download.mcafee.com/molbin/iss-loc/SupportTools/MCPR/MCPR.exe

Run that and restart the computer.

 

Then run the following for me.

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here.
• Save Autoruns.exe to your desktop and double-click it to run it.
• Once it starts, please press the Esc key on your keyboard.
• Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures and Check VirusTotal.com and Submit Unknown Images
• Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
• When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.
• Right-click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the Autoruns.zip folder you just created to your next reply

 

 

Thanks

 

[nach000]

I followed all the steps you mentioned above

Here is the Autoruns zip Autoruns.zip.zip

Thanks!

[AdvancedSetup]

Did you run the McAfee removal tool?

Please restart the computer one more time. Then run FRST and click on SCAN and post back as an attachment both new log files.

Thanks

 

[nach000]

Yes, I run the McAfee removal tool.

FRST.txtAddition.txt

Here are the new log files.

I also reinstalled google chrome again but this time I did a total clean of chrome before installing it with a tool I found in this forum - and it is the firt time after restart that I don't get the virus appearing again.

Let's see if it appears again during the day

Thanks for your help

[AdvancedSetup]

Thanks for the logs @nach000

We'll do a little bit more cleaning and checking

 

Please go to Control Panel, Programs, Programs and Features and uninstall the following

• Bonjour

 

What exactly is mDNSResponder.exe? (Bonjour)

https://www.groovypost.com/howto/howto/what-is-mdnsresponder-exe-and-why-is-it-running/

MDNSResponder, also known as Bonjour, is Apple’s native zero-configuration networking process for Mac that was ported over to Windows and associated with MDNSNSP.DLL.  On a Mac or iOS device, this program is used for networking nearly everything.  On Windows, this process is only necessary for sharing libraries via iTunes and other Mac applications like the Apple TV that were ported to Windows.  Bonjour allows different computers running iTunes to communicate with each other regardless of network configuration, this is because it enables automatic network discovery.

What Is mDNSResponder.exe / Bonjour and How Can I Uninstall or Remove It?
https://www.howtogeek.com/howto/6456/what-is-mdnsresponder.exe-bonjour-and-how-can-i-uninstall-or-remove-it/

 

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[nach000]

Hello,

No sing of the trojan today. I scanned the computer several time and it seems to be clean.

I followed all the steps you mentioned above.

Here is the Fixlog. Fixlog.txt

Thank you so much for your help

[AdvancedSetup]

Please find and attach the following file on your desktop

C:\Users\Nacho\Desktop\18.05.2021_22.01.31.zip

 

Protección de recursos de Windows encontró archivos dañados y los reparó correctamente.

Windows Resource Protection found corrupted files and repaired them successfully.

 

[nach000]

18.05.2021_22.01.31.zip

Here is the file

[AdvancedSetup]

By itself it does not look dangerous but not sure what it's really used for. I'd recommend maybe moving it to a new location such as C:\TEMP and see how the computer and your programs work with it missing.

C:\ProgramData\autobk.inc

It could be a licensing file maybe? The issue is that no files belong in the root of the parent folder C:\ProgramData\  so why this file is there makes no sense.

Other then that all looks good.

Is there anything else I can assist you with before we finish up here?

 

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you