RiskWare.BitCoinMiner keeps returning

[yamyam263]

Hello team,

No matter how many scans or restarts I perform, 

Riskware.BitcoinMiner keeps returning.

I do not know what to do but I want to get rid of this malware.

 

Thanks in advance.

[JSntgRvr]

Hi and Welcome to the forum 
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. 

Let's begin... 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click FRST(64) and select Run as administrator.
• Make sure that under Optional Scans, there is a checkmark on Addition.txt.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The tool will also produce another log (Addition.txt ). Please attach this also to your reply.

[yamyam263]

Thank you, JSntgRvr. I appreciate your volunteered help and I hope we can resolve this together.

 

Have a blessed day.

FRST.txt Addition.txt

[JSntgRvr]

Hi, yamyam263 🙂

 

Please remove Hola VPN 1.187.344 (HKLM\...\Hola) (Version: 1.187.344 - Hola Networks Ltd.). Hola can act as a botnet, and has been abused in the past. That could certainly earn it a classification as "PUP". (Potentially Unwanted Program)

 

 

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

Fixlist.txt

[yamyam263]

Fixlog.txt

Here you go.

Your help is amazing. You're a good person and you deserve goodness, love and happiness.

 

Thank you.

[JSntgRvr]

Hi, yamyam263

 

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

 

Open Malwarebytes Antimalware and update its definitions. Perform a Full scan. Quarantine all it finds, and post its log.

Fixlist.txt

[yamyam263]

3 hours ago, JSntgRvr said:

Hi, yamyam263

 

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

 

Open Malwarebytes Antimalware and update its definitions. Perform a Full scan. Quarantine all it finds, and post its log.

Fixlist.txt 70 B · 0 downloads

 

I have performed the fix, updated Malwarebytes (there was nothing to update), and scanned (no findings)

I have attached the log generated by the scan

 

 

Please notice that as I was scanning, another couple of these BitCoinMiners was detected by Real-Time Protection. 

So while scanner says nothing is found, Real-Time Protection keeps detecting these malicious files.

To the point that I was able to capture this attached screenshot, which is kind of amusing.

 

 

 

Thank you for your support :)

[AdvancedSetup]

Can we please also get the following logs for this

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[yamyam263]

Sorry, forgot to attach the files

 

Fixlog.txt was generated by FRST

Scanlog.txt is the file I have exported from the Malwarebytes scan

 

Thank you

Scanlog.txt Fixlog.txt

[yamyam263]

Sorry, AdvancedSetup we were commenting at the same time, there is no live refresh in this forum. My apologies.

  

Here you go and thank you

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the log @yamyam263

 

[JSntgRvr]

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

Fixlist.txt

[yamyam263]

Fixlog.txt

[JSntgRvr]

The offending file is 65MB large. Let me consult with my colleagues.

[JSntgRvr]

Lets remove those files:

 

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

 

If successful, restart the computer, then re-scan with FRST and post its reports.

Fixlist.txt

Edited August 11, 2021 by JSntgRvr
typo

[yamyam263]

Fixlog.txt

[yamyam263]

Addition.txtFRST.txtHere is the FRST scan result after restarting

[JSntgRvr]

Download the enclosed file and save it in the same location FRST64 is saved. Open FRST64 as an Administrator and click on the Fix button.

When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach the file in your next reply.

 

If successful, restart the computer, then re-scan once again with FRST and post its reports.

Fixlist.txt

[yamyam263]

Addition.txtFixlog.txtFRST.txt

[JSntgRvr]

The logs look clear. How is the computer doing?

[yamyam263]

On 8/13/2021 at 1:01 AM, JSntgRvr said:

The logs look clear. How is the computer doing?

Hey JSntgRvr, for now everything seems to be clear. 

Last time I got the BitCoinMiner to come back was August 11th, 4:03 AM GMT +2. Which is exactly 2 minutes before this message:

Which means the solution is your message right before it.

I'm going to mark it as a solution, for now. If it comes back I'll ping another post here. Is that the correct protocol?

 

Thank you kindly for your help.

Let me know if I need to do anything else.

 

You're the best!

[yamyam263]

Thank you, José. Just realized you have been doing this for at least 19 years. I'm so honored to be blessed with your help. Thank you thank you thank you. Have a blessed day and a blessed life.

[JSntgRvr]

Congratulations. :)

 

Use the following application to remove FRST and its quarantine:

 

 

Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

• Put a check mark next to these items:

- Delete tools
- Delete now

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and  delete itself.

Delete the quarantine in Malwarebytes Antimalware.

Best regards. 🙂

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you