Trojan.agent.vbs infection + PUP bundler

[krimmy]

Hello, I have recently been having problems ever since after running the DriverEasy program and updating some drivers my computer has been very weird when trying to watch any sort of videos online. It goes out of sync with the audio and I have no clue how to fix it or what has happened. I have also ran a Malwarebytes threat scan and it was saying my windows update service is malware and some other things too. I would like some help and for someone to check what was happened. I will include the Malwarebytes scan text file as well as the FRST and Addition files together.

Patiently waiting for a reply!

Thanks in Advance!

Addition.txt FRST.txt ThreatScan.txt

[Maurice Naggar]

Hello @krimmy    

My name is Maurice.  I will guide you.  You must TICK all lines that are flagged by Malwarebytes so that they are removed.  and by the way too, the entries for the so-called Windows Update are a threat that needs removal.  Plus in addition, I would stay away from Driver Easy and any other such 'app'.

Next I would suggest to insure to Update Malwarebytes & then do a new special scan with it.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan.

Then click the Security tab.  Scroll down and lets be sure the line in SCAN OPTIONs for 

"Scan for rootkits" is ON 👈   Click it to get it ON if it does not show a blue-color .

 

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

😉

[krimmy]

Okay I just did another Malwarebytes scan and quarantined all of the threats that have popped up. Yeah I realized that about it soon after so I have uninstalled DriverEasy. I have also done the check for any updates and installed an update for Malwarebytes, then checked for the "rootkits" in settings and have enabled that also! I then ran a new scan with the option enabled and the outcome was that no new threats were found so does that mean my computer should be all clean or is there more scans I should do? I have attached the txt file for the scan with this reply.

ThreatScan2.txt

[Maurice Naggar]

Thanks.  Yes, there is a bit more to do since this machine had had a Trojan.agent.vbs infection.

Please do not be using other apps or web browsers during these next procedures. Only use web browser for purpose to get to this forum.

[    1    ]

As a next basic step, Please  make very very sure to  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[    2    ]

We will use FRST64.exe  on Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  KRIMMY  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows 10 DISM to check the system integruty. It will also rebuild the Winsock.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the  Downloads  folder   

Fixlist.txt

Start the Windows Explorer and then, to the Downloads folder

RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it run and finish.

[krimmy]

Alright I have ran the fix using FRST, it took a bit of time but not as long as I expected! It seems to have worked fine and there were no error messages, It told me it needed to reboot at the end and it restarted after clicking "Ok". 

I have attached the Fixlog txt with this reply, hopefully it all went smoothly!

Just one thing, I have realized that not all websites need to be signed back into and my passwords seem to be saved. Is this bad or did something go wrong?

Thanks!

Fixlog.txt

[Maurice Naggar]

Thanks for the report.

Nothing unusual as to web browsers.  Nothing bad nor anything to be concerned about.  Saved passwords remain just as they were before.

As to the Windows System File Checker it found sone issues and made corrections.

>

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

 

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

[krimmy]

Ah okay good to know, thought something didn't properly clean out. I did the scan with Adwcleaner and it finished very quickly. It found some threats so i quarantined them.

AdwCleaner[C00].txt

[Maurice Naggar]

Thank you.  That found & removed some adware pests.

Here are the next steps.  I suggest a new scan for viruses & other malware. This will not take much time.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select QUICK scan.

Then start the scan. Have lots of patience. It may take several hours.

• Oce you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.

 

Let me know the result of this.    This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[krimmy]

Alright just completed the quick scan with MSERT. Didn't take long and found no new malware or anything like that. I have attached the MSERT log with this reply.

msert.log

[Maurice Naggar]

Hello.  Thank you. That is good.

>

I would suggest that you do this next scan.

I would suggest a free scan with the ESET Online Scanner.  This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

• When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

Press Continue when all done. You should click to off the offer for “periodic scanning”.

Please make sure you attach the log report.

[krimmy]

Okay it has finally finished scanning and it found quite a lot of threats. Most of them being on my old HDD that I don't use anymore but i have removed all of them.

esetscan.txt

[Maurice Naggar]

Allow me to suggest one other scan.

This is a  different special tool to check your pc for viruses, trojans & other malware.

Download Sophos Free Virus Removal Tool   and save it to your desktop.

• If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....
• Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...

 

Double click the icon and select Run

Click Next

Select I accept the terms in this license agreement, then click Next twice

Click Install

Click Finish to launch the program

• Once the virus database has been updated click Start Scanning

If any threats are found click Details, then View log file... (bottom left hand corner)

 

Attach the results in your reply

• Close the Notepad document, close the Threat Details screen, then click Start cleanup

Click Exit to close the program

 

If no threats were found please confirm that result....

• The Virus Removal Tool scans the following areas of your computer:
• Memory, including system memory on 32-bit (x86) versions of Windows
• The Windows registry
• All local hard drives, fixed and removable
• Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

 

Saved logs are found under this sub-folder: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs 

Let me know what Sophos reports.   PLUS update me on whether or not the "Block" notices have re-appeared.

Edited November 7, 2021 by Maurice Naggar

[krimmy]

I have tried to download this virus removal tool but I had to type in my name and email for some reason so I did it and afterwards it said I wasn't allowed to download it and my request was put on hold? Im not sure what this means or why.

[Maurice Naggar]

Hopefully you typed in your email address all perfectly.   Recheck the spam or junk folder of your email account, to see if their email is there/

If you still find nothing there from Sophos. try one other time & this time triple check your typing of the email address, including the dot and the domain of your email address.  It only takes 1 single character to be off that leads to failure.  The tool is free to get.  and to run and it does remove what it finds as a threat.

[krimmy]

Alright I tried again after receiving the email about being accepted and it has allowed me to download it finally. I will run the scan later tonight when I don't need to use it for anyting anymore if thats okay.

[Maurice Naggar]

Alright.  Good to know.

[krimmy]

Okay the tool is finally done fully scanning my computer and has found a single threat which has been removed. I have attached the log with this reply.

SophosVirusRemovalTool.log

[Maurice Naggar]

Thank you.   

Alright. We are done with Sophos VRT tool.  Now to uninstall it.

1. Press & hold  the Windows key on keyboard & then tap the R key   to open the Run box-windoww.
2. Type 

appwiz.cpl 

and tap Enter.
The Programs and Features window will appear.   Locate on the list "Sophos Virus Removal".

Do a right-click on it.  Then choose Uninstall.   Let it proceed.

Exit Programs and Features.

[    2     ]

Advise me, How is your system at this point ?   Do you need more help ?

[krimmy]

My system is running better now and im seeing less CPU usage but theres one problem, the video issue still is happening slightly. Im not sure why as a couple days ago it was perfectly fine but has now seemed to have gone back to being weird and being out of sync slightly which is very annoying. Any ideas of what I could check or any tools to run to diagnose maybe? Thanks!

[Maurice Naggar]

What app is used to watch video ?   Is it thru a web browser ?  or perhaps some app like Netflix app or some other branded app?

[krimmy]

Mostly through web browser I think have not tried through any apps but anything like twitch or youtube that has holder videos it slowly goes out of sync. Its very weird and so annoying.

[krimmy]

longer videos**

[Maurice Naggar]

Be sure you clear ( delete ) the Cache & history in the web browser.

for Chrome, while Chrome is running:

Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line "Browsing history"
Check mark the line "Download history"
Check mark the lined "Cached images and files"
and press Clear Data button ( in blue )

For most all other browsers, the same 3-key on keyboard shortcut Press & hold SHIFT+CTRL+Del keys  on keyboard 

so that you get their Clear menu.   Doing this housekeeping is a good practice.

 

[krimmy]

Okay I have cleared the cache for Chrome we'll see if that helps anything. Is there anything else I could try in the meantime?

[Maurice Naggar]

I encourage you to use PatchMyPC, to insure all your software up-to-date - https://patchmypc.com/home-updater#download

+

Double check each web browser to insure each one is up-to-date

+

Look at each web browser and see about all the Extensions present on it.  See which ones you do not need

+

Do a Windows Update run to insure Windows is up-to-date