Can't find trojan!

[plshelpme1903]

Windows 10 found 2 trojans named brocoiner and quarintined 1. I install malwarebytes in order to find and remove the other one too, but it can't find it.

I know the trojan is till there because my cpu reaches 100% randomly and does not let me install of remove some files.

Pls help, I'm really scared.

[Maurice Naggar]

Hello 

Please let me know what name you prefer to go by.

My name is Maurice.  Let me know what name you prefer to go by.  I will guide you.

I need a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply , like displayed here.
• To send  ( upload)   attachments please click the "ADD Files"  link . Then browse to where your file is located and select it and click the Open button.

 

 

The set of data from the report will provide much needed information.

Please always attach reports as we go along.

Cheers.

[plshelpme1903]

mbst-grab-results.zip

[Maurice Naggar]

Thank you. Microsoft Defender Antivirus is the resident antivirus.  It does appear that it had some recent aborts. The most recent Malwarebytes scans reported no active malware, and its Quarantine folder is empty.

Here are the next steps.  I suggest a new scan for viruses & other malware. This may take several hours, depending on number of files on system.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Oce you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.

 

Let me know the result of this.    This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[plshelpme1903]

msert.log

BTW you can call me Raghav

 

msert.log

[plshelpme1903]

 

sadly i cant delete the files in the picture above since it costs money and am not willing to pay.

if there is another way, pls tell.

 

[Maurice Naggar]

The result from the Microsoft Safety Scanner is actually excellent.  No actual infection or virus found.

As to the 3 things tagged by "Grindinsoft anti-malware". First I do not recommend it.

The first line is on a Google Chrome extension & they list it as a adware.

The 2nd line is just a uninstall entry for some program - just a line entry in registry.  This has zero potential as a threat.

The 3rd line seems to be a orphaned line in the registry.  There is no need to fret since we will be running scans with known & reliable scan tools.

Exit out of Grindinsoft.  My suggestion is to uninstall Grindinsoft anti-malware.

>

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[   2   ]

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.   We will do more later.  I will guide you.

By the way, lest we forget, you have not provided the file-name & folder location of what you said that were identified as threats by Microsoft Defender.

>

The Chrome extension tagged by Grindinsort is Read&Write for Google Chrome.   What do you know about that add-on extension ?

Edited November 8, 2021 by Maurice Naggar
added note Read&Write for Google Chrome

[Maurice Naggar]

Hello, Raghav.  I see that this system also has installed Zemana, and that it is running, plus has scheduled tasks.  Has it found any malware?

What about Hitmanpro ?   Did it find anything ?  Curious to know if you have run other tools.

[plshelpme1903]

I used Hitman pro, Malwarebytes, spyhunter 5, zemana, msert. Hitman found 4 peices of adware and removed them. Malwarebytes found nothing. Spyhunter found 1 spyware and I somehow managed to remove it. Zemana found 1 malware too and removed it.

[plshelpme1903]

Read and Write is a extension provided by my school. Its basically Grammarly but way more.

AdwCleaner[C00].txt AdwCleaner[C01].txt AdwCleaner[S00].txt AdwCleaner[S01].txt

[plshelpme1903]

I do not know the file location but Microsoft defender found 2 trojans named brocoiner.

[plshelpme1903]

I deleted chrome when I realised it was infected.

By the way, shouldn't I dissconnect my laptop from wifi and shut it down so the malware or virus doesn't spread to other devices.

[Maurice Naggar]

Thanks for the scan logs from Adwcleaner.  Please stop getting any other 'tools' on your own.  As I noted, I am guiding you here on this case.

The screen grab is on some thing that was in the "cache" of Google Chrome browser.  I would want to remind you that you can clean out all items in the Chrome cache area just by using a section / option in the browser itself - - manually, on demand.

No this sort of thing does not 'spread' to other devices.  You say you "deleted" Chrome.  Did you uninstall it thru the Windows Programs & Features?

You are better off without the Chrome browser.  You can use the built-in EDGE browser in Windows 10.

>

We will use FRSTENGLISH.exe  on your Downloads folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Plshelpme1903  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will rebuild the Winsock.  It will run the Windows DISM tool to check the system. 

It will attempt to get Microsoft Defender updated & to run a quick scan. It will attempt to report back on current status of Microsoft Defender.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

NOTE 3:  It will remove the run key ( a inert leftover) for Adobe\Adobe Creative Cloud Experience CCXProcess

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   C:\Users\detar\Downloads  folder

Fixlist.txt

 

Then, Start the Windows Explorer and then, go  to the  C:\Users\detar\Downloads   folder.

RIGHT click on  FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity, after it has completed.   

Do NOT run any tools on your own.  On a next round, I will guide you to doing a custom Scan on C drive using Microsoft Defender antivirus.

[plshelpme1903]

Fixlog.txt

[plshelpme1903]

Btw I deleted chrome through control panel.

 

[Maurice Naggar]

Thanks.  The good news is that the System File Checker as well as the DISM did not find any system integrity issues.

The not-so-good news is that the Microsoft Defender antivirus does not seem to be ON.  I am not sure why that is .....but it may be because Zemana is installed and active.

>

In addition, I would encourage 1 Quick scan & 1 Custom scan of the C drive using MS Defender.

That way you can see the bottom line end results on screen as to whether today & now there are actual "current threats".

This is one way to do a manual scan using the Microsoft Defender antivirus, as well as to visually check protection status.

From the Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

 

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

By the way, when you see a green check-mark on your display, it means a good status and that protection is on.

 

 

On the next display, look at all the options.  Look down the list and see "Check for Updates" which I have highlighted with a blue icon.

You can click on that to have the system check for updates for Windows Defender.

Please also note that the Scan options (all) can be displayed by clicking on Scan options. ( You can do Quick, Full, or Custom).

NOTE: If you have the time / opportunity, select a Custom scan & scan the C drive   ( one time as a safety check ).

 

 

[plshelpme1903]

I think windows security isn't online because of malwarebytes,

[plshelpme1903]

[plshelpme1903]

Could you reccomend some good antivirus's. I am going to by one after my problem is fixed.

[Maurice Naggar]

Hi, Raghav.   First, I believe, that at this point, there is no "infection". Kudos, it appears that you did manage to run a Custom scan with Microsoft Defender antivirus. Notice the lines 

0 threats found

1,599,915 files scanned

Stick with me.  I have some other tips.  and I want to be sure all of Microsoft Defender is on.

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

[   2   ]

Now, from the Windows Start menu, do a Windows RESTART.

[    3   ]

Download   Farbar's Service Scanner utility
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/
and Save to your Desktop.

Right-Click on fss.exe and select Run As Admisnitrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are checkmarked:
Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other services
 
Click on "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Attach  FSS.txt into your reply.

[    4    ]

I would recommend getting a readout report as to update status of some key apps.

Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

and save the tool on the desktop.

•                                If Windows's  SmartScreen block that with a message-window, then

                                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

• This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[plshelpme1903]

Both of them were concidered unsafe but I ran them anyway.

 

FSS.txt

[plshelpme1903]

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 09.11.2021 15:43:06
Path starting: C:\Users\detar\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: detar
VersionXML: 9.26is-31.10.2021
___________________________________________________________________________

Windows 10(6.3.19043) (x64) Core Release: 2009 Lang: English(0409)
Installation date OS: 10.02.2021 23:28:22
LicenseStatus: Windows(R), Core edition The machine is permanently activated.
LicenseStatus: Office 16, Office16O365HomePremR_Grace edition Windows is in Notification mode
Boot Mode: Normal
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.EXE
SystemDrive: C: FS: [NTFS] Capacity: [237.2 Gb] Used: [178.1 Gb] Free: [59.1 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.789.19041.0
User Account Control enabled
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
---------------------------- [ Antivirus_WMI ] ----------------------------
Windows Defender (enabled and up to date)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Defender Firewall (mpssvc) - The service is running
---------------------- [ AntiVirusFirewallInstall ] -----------------------
Malwarebytes version 4.4.10.144 v.4.4.10.144 [+]
--------------------------- [ OtherUtilities ] ----------------------------
Microsoft 365 - en-us v.16.0.14527.20234 [+]
Steam v.2.10.91.91
Epic Games Launcher v.1.1.298.0
------------------------------- [ Backup ] --------------------------------
Microsoft OneDrive v.21.205.1003.0005 [+]
-------------------------- [ IMAndCollaborate ] ---------------------------
Discord v.1.0.9001 Warning! Download Update
-------------------------------- [ Media ] --------------------------------
Spotify v.1.1.71.560.gc21c3367
------------------------------- [ Browser ] -------------------------------
Microsoft Edge v.95.0.1020.44 [+]
------------------ [ AntivirusFirewallProcessServices ] -------------------
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe v.4.0.0.1162
Malwarebytes Service (MBAMService) - The service is running
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe v.3.2.0.1005
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MsMpEng.exe v.4.18.2110.6
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\NisSrv.exe v.4.18.2110.6
Microsoft Defender Antivirus Service (WinDefend) - The service is running
Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) - The service is running
----------------------------- [ End of Log ] ------------------------------
 

[plshelpme1903]

Yesterday, a person from wellington, Nz logged into my account

Should I be worried?

[plshelpme1903]

Is my device safe to use now?

The fact that I have to wait 1/2 hours for you to reply is very annoying. Please help me.

(I am pretty impatient)

[Maurice Naggar]

Hello.  Note that the Discord program needs to be updated.   Discord v.1.0.9001 Warning! Download Update

The 2 reports are good.  As to the system, I was / am planning to have you do some additional checking with Microsoft Defender.

The system is in better state.  However, I do not recommend playing games or online games or free-wheeling websurfing until we close / wrap up this case.

When you say 

Quote

Yesterday, a person from wellington, Nz logged into my account

What account do you mean ?   where, when, how is this "known" or what is stating that ?

As to help on this forum, I am a volunteer and doing this on my own time.  You also have to keep in mind that our time zones are on opposite ends of this planet.  I volunteer here as time permits in my spare time.

Edited November 9, 2021 by Maurice Naggar