JagenN Posted August 11, 2021 ID:1474191 Share Posted August 11, 2021 Hello, I have been infected with a trojan that keeps coming back: Bitcoin.Trojan.Miner.DDS, can you help me please FRST.txt Addition.txt SCAN01.txt SCAN02.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474192 Share Posted August 11, 2021 Hello. This should only take something less than 15 minutes. Now a new scan with Malwarebytes for Windows. In Malwarebytes for Windows program, we want to do a special scan. Click Settings ( gear icon) at the top right of Malwarebytes window. We want to see the SETTINGS window. Then click the Security tab. Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON 👈 Click it to get it ON if it does not show a blue-color . Next, click the small x on the Settings line to go to the main Malwarebytes Window. Next click the blue button marked Scan. When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical. >>>>>> 👉 You can actually click the topmost left check-box on the very top line to get ALL lines ticked ( all selected). <<<< 💢 Please double verify you have that TOP check-box tick marked. and that then, all lines have a tick-mark Then click on Quarantine button. Then, locate the Scan run report; export out a copy; & then attach in with your reply.See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4 Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474198 Share Posted August 11, 2021 I may have made a mistake, I deleted the files from the quarantine scan.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474199 Share Posted August 11, 2021 There is no need to delete anything from Quarantine. Items in quarantine are permanently NOT able to do anything. I presume you meant just plain deleted permanently. We will be doing a custom script. Please have patience till I next reply here. Meantime do NO web surfing. Minimize any browser use to only this forum and to where I guide you for any other tools. No game playing. No surfing the web. Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474202 Share Posted August 11, 2021 Understood, I'm waiting thank you Link to post Share on other sites More sharing options...
Solution Maurice Naggar Posted August 11, 2021 Solution ID:1474219 Share Posted August 11, 2021 Hello @JagenN Here below is a custom run intended to quash the rogue bitminer. Please take time to read carefully & apply all directions below. If you have a question, stop and ask me first. [ 1 ] As a next basic step, Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html [ 2 ] We will use FRST64.exe on Desktop folder to run a custom script. The system will be rebooted after the script has run. This custom script is for JagenN only / for this machine only. This custom script has some specific things, plus some general aspect to help the system overall. NOTE-1: This script will run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will rebuild the Winsock. It will run the Windows DISM tool to check the system. NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. The following directories are emptied: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. Please be sure to Close any open work files, documents, any apps you started yourself before starting this. If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached, please disconnect any of those. Please save the (attached file named) FIXLIST.txt to the user Desktop folder Fixlist.txt Start the Windows Explorer and then, to the Desktop folder. RIGHT click on FRST64.exe and select RUN as Administrator and allow it to proceed. Reply YES when prompted to allow to run. to run the tool. If the tool warns you the version is outdated, please download and run the updated version. IF Windows prompts you about running this, select YES to allow it to proceed. IF you get a block message from Windows about this tool...... click line More info information on that screen and click button Run anyway on next screen. on the FRST window: Click the Fix button just once, and wait. PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick. If you receive a message that a reboot is required, please make sure you allow it to restart normally. The tool will complete its run after restart. When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run. Please attach the FIXLOG.txt with your next reply later, at your next opportunity Please know this will do a Windows Restart. Just let it do its thing. We will do more after this. Persistence & patience are called for here. After this task has been run, Please do one new scab with Malwarebytes for Windows. My expectation is that "Bitcoin.Trojan.Miner.DDS" will no longer be around. Cheers. 1 Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474220 Share Posted August 11, 2021 I download the file "fixlist" on the desktop and now i just click on fix right ? Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474222 Share Posted August 11, 2021 when is running can i go in web, or firefox must be closed ? Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474224 Share Posted August 11, 2021 i'm just on twitch Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474225 Share Posted August 11, 2021 You say you save the Fixlist. Now click the FIX button on the FRST64 Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474226 Share Posted August 11, 2021 No you should not be browsing with your web browser druing the run. One reason is that the procedure will end all your open apps. Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474229 Share Posted August 11, 2021 Fixlog.txt Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474230 Share Posted August 11, 2021 scan0.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474232 Share Posted August 11, 2021 Thank you. That is a good run with Fixlist. And thanks for the MB scan. That report is good. How is the system now ? 1 Link to post Share on other sites More sharing options...
JagenN Posted August 11, 2021 Author ID:1474233 Share Posted August 11, 2021 The system is fine, i'll see tomorrow if everything is ok and the "Bitcoin.Trojan.Miner.DDS" dont come back. thank you very much for your help and support. Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 11, 2021 ID:1474234 Share Posted August 11, 2021 You are very welcome. Yes, let me know the next day or so. I will keep this open. 1 Link to post Share on other sites More sharing options...
JagenN Posted August 13, 2021 Author ID:1474547 Share Posted August 13, 2021 it's been 2 days and my system is good, thank you again. scan.12.08.21.txt scan.13.08.21.txt 1 Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 13, 2021 ID:1474589 Share Posted August 13, 2021 Hello. Thank you for the scan reports. We can proceed with cleanup of tools we used. To remove the FRST64 tool & its work files, do this. Go to your Desktop folder. Do a RIGHT-click on FRST64.exe & select RENAME & then change it to UNINSTALL.exe . Then run that ( double click on it) to begin the cleanup process. Any other download file I had you download, you may delete. I wish you all the best. Stay safe. I am glad to have worked with you. Sincerely. Maurice 1 Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 13, 2021 ID:1474590 Share Posted August 13, 2021 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Please review the following for Tips to help protect from infection Thank you Link to post Share on other sites More sharing options...
Recommended Posts