Luther2343 Posted July 17, 2021 ID:1469860 Share Posted July 17, 2021 I have a File called Update.exe in my C:\Users\Pimparoo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup file location I saw other topics and it said it was a Microsoft teams update. Malware is detecting it a trojan i dont have a picture because malware keeps quarantining it. if someone can help me Remove/ tell me if it a threat or not it would be greatly appreciated. Link to post Share on other sites More sharing options...
kevinf80 Posted July 17, 2021 ID:1469872 Share Posted July 17, 2021 Hello Luther2343 and welcome to Malwarebytes, Disable smart screen if it interferes with software we may have to use:https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8 Please remember to enable when we are finished.... Next, Disable any Anti-virus software you have installed if it stops software we may use from working:https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/ Please remember to enable AV software when we are finished running scans.... Next, Lets grab some logs and see whats going on, continue with the following: If you do not have Malwarebytes installed do the following: Download Malwarebytes version 4 from the following link:https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. When the install completes or Malwarebytes is already installed do the following: Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab. Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following: Open Malwarebytes Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.htmlNote: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin.... Link to post Share on other sites More sharing options...
Luther2343 Posted July 17, 2021 Author ID:1469876 Share Posted July 17, 2021 Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 7/17/21 Protection Event Time: 7:36 PM Log File: d681161a-e757-11eb-91af-4cebbd01d6b6.json -Software Information- Version: 4.4.3.125 Components Version: 1.0.1387 Update Package Version: 1.0.43207 License: Trial -System Information- OS: Windows 10 (Build 19042.1110) CPU: x64 File System: NTFS User: System -Blocked Malware Details- File: 1 Trojan.BitCoinMiner.BITSRST, C:\Users\Pimparoo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.exe, Quarantined, 16480, 955724, 1.0.43207, , ame, , B81EE7D3AC6D2AF9E931C8B79811C1AB, 6B85223B9156076F0B5D203551DBDB9AD604013AB7C1C991631A63000F300761 (end) # ------------------------------- # Malwarebytes AdwCleaner 8.3.0.0 # ------------------------------- # Build: 06-29-2021 # Database: 2021-06-29.1 (Local) # Support: https://www.malwarebytes.com/support # # ------------------------------- # Mode: Clean # ------------------------------- # Start: 07-17-2021 # Duration: 00:00:01 # OS: Windows 10 Home # Cleaned: 23 # Awaiting reboot:1 # Failed: 0 ***** [ Services ] ***** No malicious services cleaned. ***** [ Folders ] ***** Deleted C:\Users\Pimparoo\AppData\Roaming\Tencent ***** [ Files ] ***** No malicious files cleaned. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks cleaned. ***** [ Registry ] ***** No malicious registry entries cleaned. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries cleaned. ***** [ Chromium URLs ] ***** No malicious Chromium URLs cleaned. ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries cleaned. ***** [ Firefox URLs ] ***** No malicious Firefox URLs cleaned. ***** [ Hosts File Entries ] ***** No malicious hosts file entries cleaned. ***** [ Preinstalled Software ] ***** Deleted Preinstalled.HPAudioSwitch Folder C:\Program Files (x86)\HP\HPAUDIOSWITCH Deleted Preinstalled.HPAudioSwitch Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64EF4345-F823-47EF-BDBD-1B79666825AD} Deleted Preinstalled.HPAudioSwitch Registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HPAudioSwitch Deleted Preinstalled.HPAudioSwitch Task C:\Windows\System32\Tasks\HPAUDIOSWITCH Deleted Preinstalled.HPCleanFLC Registry HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|HPSEU_Host_Launcher Deleted Preinstalled.HPCleanFLC Registry HKCU\Software\Microsoft\Windows\CurrentVersion\Run|HPSEU_Host_Launcher Deleted Preinstalled.HPCleanFLC Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|HPSEU_Host_Launcher Deleted Preinstalled.HPCleanFLC Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Run|HPSEU_Host_Launcher Deleted Preinstalled.HPRegistrationService Folder C:\ProgramData\HP\HP REGISTRATION SERVICE Deleted Preinstalled.HPSupportAssistant Folder C:\HP\SUPPORT Deleted Preinstalled.HPSupportAssistant Folder C:\ProgramData\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK Deleted Preinstalled.HPSupportAssistant Folder C:\Users\Pimparoo\AppData\Roaming\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK Deleted Preinstalled.HPSupportAssistant Registry HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSupportAssistant Registry HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSupportAssistant Registry HKLM\Software\Classes\CLSID\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSupportAssistant Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSupportAssistant Registry HKLM\Software\Wow6432Node\\Classes\CLSID\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSupportAssistant Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE} Deleted Preinstalled.HPSureConnect Registry HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{6468C4A5-E47E-405F-B675-A70A70983EA6} Deleted Preinstalled.HPTouchpointAnalyticsClient Folder C:\ProgramData\HP\HP TOUCHPOINT ANALYTICS CLIENT Deleted Preinstalled.HPTouchpointAnalyticsClient Registry HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F} Needs Reboot Preinstalled.HPSureConnect Folder C:\Program Files\HPCOMMRECOVERY ************************* [+] Delete Tracing Keys [+] Reset Winsock ************************* ***** Reboot Required to Complete ***** ***** [ Folders ] ***** Cleaning failed C:\Program Files\HPCOMMRECOVERY Link to post Share on other sites More sharing options...
Luther2343 Posted July 17, 2021 Author ID:1469877 Share Posted July 17, 2021 35 minutes ago, kevinf80 said: Hello Luther2343 and welcome to Malwarebytes, Disable smart screen if it interferes with software we may have to use:https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8 Please remember to enable when we are finished.... Next, Disable any Anti-virus software you have installed if it stops software we may use from working:https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/ Please remember to enable AV software when we are finished running scans.... Next, Lets grab some logs and see whats going on, continue with the following: If you do not have Malwarebytes installed do the following: Download Malwarebytes version 4 from the following link:https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. When the install completes or Malwarebytes is already installed do the following: Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab. Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following: Open Malwarebytes Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.htmlNote: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin.... Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Solution kevinf80 Posted July 18, 2021 Solution ID:1469912 Share Posted July 18, 2021 Hello Luther2343, How does your PC respond now, any issues or concerns..? Run the following please: Download "Microsoft's Safety Scanner" and save direct to the desktop Ensure to get the correct version for your system....https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Right click on the Tool, select Run as Administrator the tool will expand to the options Window In the "Scan Type" window, select Full Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\msert.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time... Thank you, Kevin Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469938 Share Posted July 18, 2021 I'm fine besides the fact that I get a Malwarebytes notification every 5 minutes about them putting viruses into quarantine. And thinking what would I do if I don't get a Malwarebytes member ship and that nothing would quarantine the virus? msert.log Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469939 Share Posted July 18, 2021 These it? Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469948 Share Posted July 18, 2021 6 hours ago, kevinf80 said: Hello Luther2343, How does your PC respond now, any issues or concerns..? Run the following please: Download "Microsoft's Safety Scanner" and save direct to the desktop Ensure to get the correct version for your system....https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Right click on the Tool, select Run as Administrator the tool will expand to the options Window In the "Scan Type" window, select Full Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\msert.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time... Thank you, Kevin I'm fine besides the fact that I get a Malwarebytes notification every 5 minutes about them putting viruses into quarantine. And thinking what would I do if I don't get a Malwarebytes member ship and that nothing would quarantine the virus msert.log Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18, 2021 ID:1469949 Share Posted July 18, 2021 ( Needs to be pointed out, so that there is not unintended over-stepping). @Luther2343 There are 2 separate Topic-cases for your same issue.https://forums.malwarebytes.com/topic/276675-updateexe-inside-my-windows-startup-list/ with Nasdaq +https://forums.malwarebytes.com/topic/276676-updateexe-inside-my-windows-startup-list/ with Kevinf80 Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469950 Share Posted July 18, 2021 Just now, Maurice Naggar said: ( Needs to be pointed out, so that there is not unintended over-stepping). @Luther2343 There are 2 separate Topic-cases for your same issue.https://forums.malwarebytes.com/topic/276675-updateexe-inside-my-windows-startup-list/ with Nasdaq +https://forums.malwarebytes.com/topic/276676-updateexe-inside-my-windows-startup-list/ with Kevinf80 Yes i noticed i tried to make another topic for another problem but for some reason renamed the other one srry. Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18, 2021 ID:1469952 Share Posted July 18, 2021 So, these are 2 different machines ? Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469954 Share Posted July 18, 2021 2 minutes ago, Maurice Naggar said: So, these are 2 different machines ? Same machine 2 different problems. Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18, 2021 ID:1469956 Share Posted July 18, 2021 You must tell that to both Kevin & Nasdaq. There should be only one helper for this one machine. Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469957 Share Posted July 18, 2021 5 minutes ago, Maurice Naggar said: You must tell that to both Kevin & Nasdaq. There should be only one helper for this one machine. Alright I'll tell Nasdaq but can I get help when Kevin is done? Link to post Share on other sites More sharing options...
kevinf80 Posted July 18, 2021 ID:1469968 Share Posted July 18, 2021 Hiya Luther2343, I see that you`ve told Nasdaq that you will continue with this thread, is that correct..? Continue: Uninstall Discord reboot when complete. It would appear the version you have installed is exploited... Next, Run another scan with Malwarebytes, post the produced log... Next, Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Thank you, Kevin. Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469971 Share Posted July 18, 2021 1 hour ago, kevinf80 said: Hiya Luther2343, I see that you`ve told Nasdaq that you will continue with this thread, is that correct..? Continue: Uninstall Discord reboot when complete. It would appear the version you have installed is exploited... Next, Run another scan with Malwarebytes, post the produced log... Next, Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Thank you, Kevin. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted July 18, 2021 ID:1469972 Share Posted July 18, 2021 Did you run a scan with Malwarebytes before FRST...? Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469973 Share Posted July 18, 2021 I think i did malwarebytes only picked up the thing NasDaq was helping me with. Link to post Share on other sites More sharing options...
kevinf80 Posted July 18, 2021 ID:1469974 Share Posted July 18, 2021 Can I see the log please... Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469975 Share Posted July 18, 2021 7 minutes ago, kevinf80 said: Can I see the log please... 7 18 2021 AV.txt Link to post Share on other sites More sharing options...
kevinf80 Posted July 18, 2021 ID:1469976 Share Posted July 18, 2021 Does this file return after you reboot...? C:\USERS\PIMPAROO\APPDATA\LOCAL\VEGAS\KERNEL BROKER.EXE Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469977 Share Posted July 18, 2021 1 minute ago, kevinf80 said: Does this file return after you reboot...? C:\USERS\PIMPAROO\APPDATA\LOCAL\VEGAS\KERNEL BROKER.EXE This is a file that comes back after deletion 6 minutes later. Link to post Share on other sites More sharing options...
kevinf80 Posted July 18, 2021 ID:1469979 Share Posted July 18, 2021 Did you uninstall Discord before running Malwarebytes scan Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469980 Share Posted July 18, 2021 Yes I did Link to post Share on other sites More sharing options...
Luther2343 Posted July 18, 2021 Author ID:1469981 Share Posted July 18, 2021 And is it safe to reinstall discord? If not when? 18 minutes ago, Luther2343 said: Yes I did 23 minutes ago, kevinf80 said: Did you uninstall Discord before running Malwarebytes scan Link to post Share on other sites More sharing options...
Recommended Posts