Jump to content

A Very Confusing Virus or Infection HELP


Go to solution Solved by Maurice Naggar,

Recommended Posts

I'm in dire need of help, basically I've recently have had an issue with Microsoft PowerShell opening and closing by itself, along with that google chrome closing itself and reopening with an new tab that isn't my usual chrome home page. Every time i searched something on google it would redirect the search through bing. I tried scanning my computer with my virus scanning software Webroot and it picked up nothing, so I decided to install Malwarebytes, afterwards I scanned my Pc and it picked up nothing BUT, every other minute or so I would get an alert that it would block a website with these credentials(pic of it below too): domain: dispatch.integrate.drivethelife.com, IP Address: 209.58.131.173, Category: PUP, Type: Outbound Connection, Port:3801 . It would block the same website every minute or so. After that I tried downloading SymDiag and I let it can my computer and it picked up some suspicious files that I ended up deleting (I have a picture below). I tried doing some research on the files and it was suggested for me to try using a spyware detector, so I ended up using Super AntiSpyWare which picked up some files that were suspicious and i deleted them too, unfortunately I don't have pictures of the files. It was also suggested for me to give Farbar Recovery a try and it scanned through and it created two txt files(listed down below). I'm kind of at a loss for what to do.

Screenshot (38).png

Screenshot (39).png

Screenshot (40).png

Addition.txt FRST.txt

Link to post
Share on other sites

Hello     :welcome:

My name is Maurice.  I will guide you.  The first thing I need is to get a set of reports about the condition of the system.

That is the first step.  I will then review and use that to guide us along.

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

 

I would like a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

  • Please attach  mbst-grab-results.zip    to your reply , like displayed here.
  • To send  ( upload)   attachments please click the "ADD Files"  link . Then browse to where your file is located and select it and click the Open button.

 

_mb_attach.jpg

 

The set of data from the report will provide much needed information.

Please always attach reports as we go along.

Cheers.

Link to post
Share on other sites

Remarks and request.  While this case is on-going, please do not play any online games.   and no freewheeling web-surfing.

I suggest that you uninstall DriverUpdate .   There are other means to keep your machine updated.  I will have other steps for you later on.

Link to post
Share on other sites

We will use FRST64.exe  on the Downloads    folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Uraverageganer  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall. This run hopefully will be under one hour run-time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows  DISM to check the system integruty.  It will reset the Winsock.

NOTE-2:  It will remove a scheduled task called Chromeloader that is the source of the odd / suspect invocation of powershell.

NOTE-3: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome,  and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the   Downloads  folder   

Fixlist.txt


Start the Windows Explorer and then, to the  Downloads  folder


RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   


Please know this will do a Windows Restart.   Just let it run and finish.   I will look forward to getting the log.

Link to post
Share on other sites

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

Link to post
Share on other sites

  • Solution

Thanks.  I only needed the C-series report from Adwcleaner.  did not need the screen grab.  Adwcleaner did a nice cleanup of several adwares.

What follows is a followup custom script.  First, delete the older one named Fixlist.txt  that I had you save on Downloads.

We will use FRST64.exe  on the Downloads    folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Uravergeganer  only / for this machine only.

This custom script has some specific things, plus some general aspect to help the system overall. This run hopefully will be under one hour run-time.

NOTE-1:  This script will  re- run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run the Windows  DISM to re-check the system integruty.  

NOTE-2:  It will remove traces of what look like a Trickbot infection. This included removing a few folders related to that. It also involves attempting to remove mentions of folders excluded from scanning on Microsoft Defender.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 
If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

Please save the (attached file named) FIXLIST.txt   to the   Downloads  folder   

Fixlist.txt


Start the Windows Explorer and then, to the  Downloads  folder


RIGHT click on  FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

frst-fix.jpg.f6a25291b39a03d418acc9a3b7136900.jpg

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   


Please know this will do a Windows Restart.   Just let it run and finish.   I will look forward to getting the log.

There will be more to do.  This is not a cure-all.  Please do not do any online games or web surfing on this machine.

Edited by Maurice Naggar
  • Thanks 1
Link to post
Share on other sites

Good morning.  Thank you for the report.

would suggest that you do this next scan. This is a known respected tool. It will scan for viruses as well as for potentially unwanted applications.   ( P U A  or  P U P ).

I would suggest a free scan with the ESET Online Scanner.  This will be another check for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

  • Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.

You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else.

  • When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
  • Click The blue Save scan log to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at bottom).

Press Continue when all done. You should click to off the offer for “periodic scanning”.

Please make sure you attach the log report.     

Link to post
Share on other sites

Hello @UrAvergeGaner    When you get some quiet time.  I would like to collect copies of 2 folders from your machine.

Can you please zip the C:\FRST\Quarantine  folder and attach for me so that our Research Team can review?

I'd also like to get this folder too ( in a ZIP file )

C:\Users\aiden\AppData\Local\chrome

Thank you very much.   :cool:

Link to post
Share on other sites

  • 5 weeks later...
  • 2 weeks later...

I hope you are ok. If you can run this scan overnight, just start it & look to see if is under way, you can start this scan before you retire for an evening ... the ESET scan I suggested at this post https://forums.malwarebytes.com/topic/282452-a-very-confusing-virus-or-infection-help/?do=findComment&comment=1496164

 

Once under way, you can leave it to run by itself. It will make a report when it finishes.

Link to post
Share on other sites

  • 3 weeks later...

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.