Jump to content

Please help with ongoing malware issue


JMT
 Share

Go to solution Solved by kevinf80,

Recommended Posts

Many thanks to anyone who can please help with this; I'd truly appreciate it.

The organisation that I work for was recently hit by a ransomware attack. I live at my workplace (literally), so my personal PC is not a networked computer, but was using the same wifi.

My PC hasn't been locked by the hackers like all the others have, but I have noticed some very odd things with it.

I have run a full virus scan using Malwarebytes and Norton (paid for packages), but am still not convinced it's ok...

 

1) Malwarebytes prevented me from opening some Office documents I had been working on, which were saved in my OneDrive. First time that's ever happened.

I then signed out of Microsoft Office and could open them ok.

2) I noticed OneDrive syncing some files that I didn't recognise earlier (unless I'd just forgotten about them).

3) I have had massive issues connecting to the internet lately. First, my phone worked as a hotspot, then stopped working. Then, a dongle worked, then stopped working. Then, another dongle worked, and still is AFTER I removed my memory stick from my PC (was that just interference, or is it infected?).

4) It looks like some apps were downloaded last week that I definitely didn't actively download, unless they just downloaded in the background (e.g. Microsoft Edge - just an automatic update??).

5) I've noticed some weird Wifi networks pop up recently that I don't recognise; very strange where I live.

6) Weird possibly related thing: I keep getting messages from my cell phone provider saying I've exceeded my data allowance, despite the fact I'm a long way from doing so (as confirmed over the phone with them). I also got an email from the cell phone provider saying they've removed the age restricted content filter from a number I don't even have. Looks like a legit email.

 

I'd probably just dismiss most of these on their own, but altogether and given the context, I'm very worried....please help!

What should I do?

Thanks.  

Link to post
Share on other sites

Hello JMT and welcome to Malwarebytes,

Run the following scan, lets see if anything shows up:

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English

 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
    user posted image
     
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


You may need to do the following:

Disable smart screen if it interferes with software we may have to use:

https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8

Please remember to enable when we are finished....

Next,

Disable any Anti-virus software you have installed if it stops software we may use from working:

https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

Please remember to enable AV software when we are finished running scans....

Thank you,

Kevin
Link to post
Share on other sites

  • Solution

Hiya JMT,

Thanks for those logs, continue:

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.

NOTE. It's important that both files, FRST or FRSTEnglish, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed.

The following directories are emptied:
 
  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin


Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

user posted image

The system will be rebooted after the fix has run.

Next,

Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab.

Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on....

Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab......

When the scan completes quarantine any found entries...

To get the log from Malwarebytes do the following:
 
  • Open Malwarebytes
  • Click on the Detection History tab > from main interface.
  • Then click on "History" that will open to a historical list
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply


Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download "Microsoft's Safety Scanner" and save direct to the desktop

Ensure to get the correct version for your system....

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download


Right click on the Tool, select Run as Administrator the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.


Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\msert.log

The log will include log details for each time MSRT has run, we only need the most recent log by date and time....

Let me see those logs in your reply...

Thank you,

Kevin.

fixlist.txt

Link to post
Share on other sites

And the next part...

 

# -------------------------------
# Malwarebytes AdwCleaner 8.3.0.0
# -------------------------------
# Build:    06-29-2021
# Database: 2021-08-09.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    08-24-2021
# Duration: 00:00:00
# OS:       Windows 10 Home
# Cleaned:  4
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

Deleted       Preinstalled.HPUsageTrackingLEDM   Folder   C:\Program Files (x86)\HP\HP UT LEDM\BIN
Deleted       Preinstalled.HPUsageTrackingLEDM   Registry   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|HPUsageTrackingLEDM
Deleted       Preinstalled.HPUsageTrackingLEDM   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Run|HPUsageTrackingLEDM
Deleted       Preinstalled.HPUsageTrackingLEDM   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{DA6CC3A5-1F5B-4068-8BFF-C597BB6B8158}


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1895 octets] - [24/08/2021 23:20:36]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 

Link to post
Share on other sites

Here's the final piece of the puzzle. Looks like it removed something - I'll be very interested to know what you make of this.

Huge thanks again.


---------------------------------------------------------------------------------------
Microsoft Safety Scanner v1.347, (build 1.347.336.0)
Started On Tue Aug 24 23:36:42 2021

Engine: 1.1.18500.9
Signatures: 1.347.336.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode

Quick Scan Results:
-------------------
Threat Detected: VirTool:Win32/DefenderTamperingRestore and Removed!
  Action: Remove, Result: 0x00000000
    regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware
        SigSeq: 0x0000055555C57273

Results Summary:
----------------
Found VirTool:Win32/DefenderTamperingRestore and Removed!
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Tue Aug 24 23:40:15 2021


Return code: 6 (0x6)

Link to post
Share on other sites

Hiya JMT,

Thanks for those logs, how do you feel your PC is responding now: any remaining issues or concerns..?

Regarding the MS log, nothing to be concerned about with those results. When you install McAfee Windows Defender is turned off, likewise the same happens with malwarebytes. That can be a bit puzzling, Defender is not compatible with McAfee and cause issues, Malwarebytes will run with McAfee without issue.. Personally I have Malwarebytes Premium and Windows Defender working together. Couple of links follow:

https://support.malwarebytes.com/hc/en-us/articles/360039024293-Malwarebytes-for-Windows-as-an-Anti-Virus-software-replacement

https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

https://www.malwarebytes.com/pdf/reviews/avtestingreport.pdf

Thank you,

Kevin.

Link to post
Share on other sites

Thanks so much, Kevin. Really helpful and reassuring, and I'll be clicking that Paypal button shortly.

Just 3 last quick things to mention, if you can spare another minute:

1) Since running those checks/fixes last night, Malwarebytes now says 'unable to contact license server' - any idea of an easy fix?

2) Internet (via a 3G/4G dongle) is still very hit and miss. Hasn't been working for the last few hours, despite my phone on 3G being fast (same network), and yet now is fine. Probably nothing malicious, just weird and frustrating.

3) I'm not sure if I should be concerned with my memory stick being infected. Is there a check you could recommend that wouldn't put the rest of my PC at risk?

Thanks!

Link to post
Share on other sites

Hiya JMT,

The Malwarebytes issue with the server maybe down to your connection, if the dongle is not reliable can you try using your phones hotspot for connectiong your laptop, see if that helps...

Regarding USB memory stick have a read at the following link:

https://www.pandasecurity.com/en/mediacenter/products/panda-usb-and-autorun-vaccine/

Thanks,

Kevin..

Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.