Trojan was mining in my PC and I'm very worried

[FabioHPL]

Hello there, I hope you are doing great today.

As I was migrating from Google Backup n Sync to the new Google Drive desktop my Windows Defender was going crazy with threats alerts,

so I download Malwarebytes and other malware removal programs to investigate more.

Windows defender detected a "Trojan:Win32/CoinMiner!MSR" and I want believe it was properly handled so here I am to double check it with your kind help...

Besides it, I'm struggling with the removal of an old chrome extension I used to download instagram stories for work because it keeps coming back in the HitmanPro log everytime I open chrome.

I'm not savvy in that matter and I'm very worried.

So, I really appreciate your time and kindness in looking my case.

Log-malwarebytes-2021-12-08_1215pm.txt Addition.txt FRST.txt

[Maurice Naggar]

Hello     

Please let me know what name you prefer to go by.

My name is Maurice.   I will guide you.

This system runs on Windows 10.  The Malwarebytes for Windows reported no malware.   Lets start with what follows below.

>

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

>

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.

 

Let me know the result of this.    This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[Maurice Naggar]

Question for later about a specific folder & sub-folder on the D drive.  The Microsoft Defender antivirus had mentioned issues on contents of 

D:\HD-EXT-3.6-TB\.tmp.drivedownload

What is that sub-folder ?  I am curious.

[Maurice Naggar]

From the reports, I notice that in addition to Hitmanpro this machine also has ZHPCleaner.  I need to inquire, Are you getting other help from another help-source ?  another forum ?

[FabioHPL]

44 minutes ago, Maurice Naggar said:

Please let me know what name you prefer to go by.

My name is Maurice.   I will guide you.

Hello there, Maurice! I'm super glad for your help.

You can call me Fabio, it's all good :)

----

29 minutes ago, Maurice Naggar said:

Question for later about a specific folder & sub-folder on the D drive.  The Microsoft Defender antivirus had mentioned issues on contents of 

D:\HD-EXT-3.6-TB\.tmp.drivedownload

What is that sub-folder ?  I am curious.

My D Drive contains old backups from almost 10 PC's from my old advertising agency I owned, and the ".tmp.drivedownload" folder is empy 0 byte that seems to be a hidden one (the icon is brighter/less visible), with no files inside (unless proven otherwise).

__

20 minutes ago, Maurice Naggar said:

From the reports, I notice that in addition to Hitmanpro this machine also has ZHPCleaner.  I need to inquire, Are you getting other help from another help-source ?  another forum ?

I was kinda desperate before finding this forum in google and did download and tried running ZHPCleaner but it was kinda stuck and I stoped the scan with it...

So, the answer to your second question is: no, I'm only being assisted here with your help, in which I'm super glad btw and I did not post anywhere else :)

[FabioHPL]

I forgot to mention, the full scan as you instructed me is already being made :)

[Maurice Naggar]

Thank you. The MS Safety Scanner is likely to run for many hours.  Just simply let it run.

[FabioHPL]

You were no joking ^^ 😅

Will post the log when finished :)

 

[Maurice Naggar]

Let the Safety Scanner run finish.  You do not have to watch it as it runs.  But do ignore that display of "infected".  Those are not confirmed & its just presumption. Only the final report is what matters.

By the way, about what you "saw" on intermediate displays of the Microsoft Safety Scanner,  I would like you to review the remarks by AndyDavid about all that on this Microsoft community venue https://docs.microsoft.com/en-us/answers/questions/326108/mar-1721-msert-detects-items-during-scan-but-at-en.html

Also, the post by EricYin of Microsoft  ( just below that section)
 

if nothing reported in %SYSTEMROOT%\debug\msert.log, that means no infections.

It may well take several more hours till finish.

[FabioHPL]

Hello there! I just wake up and the scan was finished :)

I'm posting the "view detailed results of the scan" part and the msert.log below:

 

Thanks in advance, again, Maurice

msert.log

[FabioHPL]

And just in case it might be useful, I'm uploading a fresh log that I just did with Farbar FRST64

I find it curious that Windos Defender is flagging a GoogleDriveFS as High severity potential threath and other things

And I regreat I installed AutoKMS, I don't find a way to remove it, especially because I did buy a oficial windows license sometime after using AutoKMS...

Will patiently wait for your next guidance, thanks :)

Addition.txt FRST.txt

[Maurice Naggar]

Thanks for the reports.  To best of my knowledge, "AutoKMS" is not something that Microsoft asks consumers to use any of it. Matter of fact, they classify it as a hacktool. See https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win32%2fAutoKMS 

As far as "GoogleDriveFS, no idea there.

We will be doing some other additional scans.  This here is one of those.

Download Sophos Free Virus Removal Tool   and save it to your desktop.

• If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....
• Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...

 

Double click the icon and select Run

Click Next

Select I accept the terms in this license agreement, then click Next twice

Click Install

Click Finish to launch the program

• Once the virus database has been updated click Start Scanning

If any threats are found click Details, then View log file... (bottom left hand corner)

 

Attach the results in your reply

• Close the Notepad document, close the Threat Details screen, then click Start cleanup

Click Exit to close the program

 

If no threats were found please confirm that result....

• The Virus Removal Tool scans the following areas of your computer:
• Memory, including system memory on 32-bit (x86) versions of Windows
• The Windows registry
• All local hard drives, fixed and removable
• Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

 

Saved logs are found under this sub-folder: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs 

Let me know what Sophos reports.   

[FabioHPL]

Thanks for the info, Maurice.

I will start the scam from Sophos Free Virus Removal Tool right now and will close google chrome and other things to let it run alone

Will get back here with the log when finished,

tysm

[FabioHPL]

Hello Maurice, I hope everything is good with you.

The scan finished, I'm uploading the log.

I couldn't confirm weather those items you've listed were scaned or not. I'm sorry about that. My knoledge here is a bit limited.

Looking forward to hear more from you :)

SophosVirusRemovalTool.log

[Maurice Naggar]

Good morning.  Thank you for the Sophos scan report.

We are done with Sophos VRT tool.  Now to uninstall it.

1. Press & hold  the Windows key on keyboard & then tap the R key   to open the Run box-window.
2. Type 

appwiz.cpl 

and tap Enter.
The Programs and Features window will appear.   Locate on the list "Sophos Virus Removal".

Do a right-click on it.  Then choose Uninstall.   Let it proceed.

Exit Programs and Features, when done.

>

3.  Now do a Windows Restart.

>

Let's do one scan with  Malwarebytes Adwcleaner  to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

[FabioHPL]

Good morning, Maurice! :)

I've just followed all the steps you instructed me.

Here's the log.

Thanks, again

AdwCleaner[S12].txt

[Maurice Naggar]

Thank you.

Additional suggestion.  Should not take a lot of time.

From the Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Microsoft Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.
Do a QUICK scan.
Let me know the end result of what the Microsoft Defender reports.

Also, please, advise me about the overall situation on this system, at that point.  and, Is there any other help you need ?

[FabioHPL]

I'm struggling with the removal of this hidden chrome extension... an alternate antimalware detects it, deletes it but it actually not because it comes back after every windows restart.

Actually, I've tried removing while in windows safe mode with internet, but, same thing.

When scaning with Google Chrome closed it isn't detected, but when I open google chrome and do a scan it is detected but the other antimalware can't actually remove as I said...

 

Potential Unwanted Programs _________________________________________________

   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\ (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\000003.log (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\CURRENT (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\LOCK (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\LOG (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\LOG.old (Stories.for.Instagram)
   C:\Users\Windows\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nilbfjdbacfdodpbdondbbkmoigehodg\MANIFEST-000001 (Stories.for.Instagram)

 

 I've tried this below and with a fresh crome install the PUP's listed above isn't detected anymore. The problem is that I really need all my history and synced data from the "chrome.bak" shown below, which I remove the .bak from the folder name in order to use chrome with all my things in it as usual:

Chrome Malware
Chrome is often a vector for malware, if you are facing a stubborn infection do the following.

Uninstall Chrome
Rename the chrome directory in %LocalAppData%\Google\ to chrome.bak
Install Chrome, do not log into chrome
See if issue persists.
Once you sign in, the issue may come back. This points to a synced extension being the issue.

 

The thing that is bugging me out is I'vee tried deleting the "nilbfjdbacfdodpbdondbbkmoigehodg" folder which corresponds to the PUP chrome extension (that for a while isn't listed as a installed chrome extension because I've deleted from the chrome extension list) but somehow the folder from this PUP still is in my pc...

I don't know if I'm thinking outloud here or trying to bring more information for you that might be helpful 

 

Again, thanks for your time, effort and patience, Maurice

[FabioHPL]

11 minutes ago, Maurice Naggar said:

Thank you.

Additional suggestion.  Should not take a lot of time.

From the Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Microsoft Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.
Do a QUICK scan.
Let me know the end result of what the Microsoft Defender reports.

Also, please, advise me about the overall situation on this system, at that point.  and, Is there any other help you need ?

 

Just did it :) My windows defender was already up to date

Here's the Windows Defender log of the quick scan (and I have no idea how there's a lot of threats inside that "\.tmp.drivedownload" folder that for me appears as empty)

 

MPDetection-20211110-133731.log

[Maurice Naggar]

Thank you. The Chrome browser on this machine has a super duper very large number of extensions.  I will leave your suspected Chrome extension / folder for later on.

This here is a custom run with a custom script.  Read over all of this before taking action. One of the aims of this run is to (attempt) to empty the contents of D:\HD-EXT-3.6-TB\.tmp.drivedownload

We will use FRST64.exe  on  Downloads    folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  FabioHPL

  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows 10 DISM to check the system integruty. 

NOTE-2:  It will attempt to remove the contents of folder D:\HD-EXT-3.6-TB\.tmp.drivedownload

It will also attempt to run a batch mode Quick scan of Microsoft Defender antivirus.

NOTE-3: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the  Downloads  folder   

Fixlist.txt

Start the Windows  File Explorer and then, to the Downloads  folder

RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
                                            IF Windows prompts you about running this, select YES to allow it to proceed.

                                             IF you get a block message from Windows about this tool......
                                                      click line More info information on that screen
                                                      and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it run and finish.   I will look forward to getting the log.

[FabioHPL]

Hello Maurice,

done 😀

I will look forward you looking the log ^^

Thank you

 

Fixlog.txt

[Maurice Naggar]

The System File Checker and the DISM tool checks are fine.  No issues.

The Microsoft Defender antivirus looks to be in good state.  The run is good.

I had had you scan with the MS Safety Scanner & Sophos.  It looks like you had scanned on your own with ESET Online Scanner & Hitmanpro.

as to Chrome extensions, you should be able to manually look at all extensions on the Chrome browser.

in Chrome, press ALT+F then Settings

Click Extensions on the left.

Closely review the browser extensions that are listed. Disable any that you are not familiar with or that you do not trust.

 

[FabioHPL]

Good morning, Maurice! Sorry my delay.

I'll review all my chrome extensions.

Somehow, unfortunately Windows Defender still finds threat files inside that D:\HD-EXT-3.6-TB\.tmp.drivedownload 😕

I'll start a travel today and just will be back in 7-8 days, so, forgive me if don't respond in this period.

I'm very grateful for all your effort and your time with my case

[Maurice Naggar]

Good morning.  I appreciate your letting me know ahead of your trip.  Do have a safe one.  Of course, you may reply after your return.   

[Maurice Naggar]

Hello @FabioHPL    Good morning.  How is the Windows pc situation ?  I had not heard back from you in a long time.