Malware appears every day on my PC then Malwarebytes cleans it

[StarshipCaptain68]

My computer is infected with Malware.  Everyday a malware appears on my PC.  How do I get rid of it permanently?

Here was the last scan:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/22/22
Scan Time: 5:17 PM
Log File: 22c08746-7bd1-11ec-966b-dc85de43806c.json

-Software Information-
Version: 4.5.0.152
Components Version: 1.0.1538
Update Package Version: 1.0.50167
License: Premium

-System Information-
OS: Windows 10 (Build 19042.1466)
CPU: x64
File System: NTFS
User: GREGPOWER10\gfinz

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 372773
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 5 min, 23 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Malware.Sandbox.23, C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\40C94F7B\E19B902D\MMINISTUB.EXE, No Action By User, 23, 0, 1.0.50167, 23, dds, 01609697, 5186BCC8874196CC72D22B9CA9A65615, AE025A59DE0C13E081BF57E48C81A2D0CE78324ACEB1C87C22F8A702A66565D0

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

 

[AdvancedSetup]

Hello @StarshipCaptain68 and

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[StarshipCaptain68]

Thank you for your rapid response.  On December 26th I formatted my hard drive and reinstalled everything that I normally use.  I was hoping the Malware would go away but it did not.  I have attached all the logs requested plus the logs from December 26th up until today.  I did a scan 5:17pm and another scan at 6:08pm today with Malwarebytes and the Malware appeared again.  I also scanned with ESET, System Mechanic, ClamWin Portable, Emsisoft, Kapersky TDSSKiller, McAfee Stinger Portable, and Spybot Search & Destroy.  MalwareBytesLog2022-01-22 6pm.txtMalwareBytesLog2022-01-22 5pm.txtMalwarebytesLog2022-01-21.txtMalwareBytesLog2022-01-18 9am.txtMalwareBytesLog2022-01-18 2am.txtMalwareBytesLog2022-01-08.txtMalwareBytesLog2022-01-01.txtMalwareBytesLog2021-12-26.txtFRST.txtAdwCleaner[S00].txtAddition.txt

[AdvancedSetup]

What is this folder for? What is contained in it?

C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE

I would recommend that you scan that folder structure and then upload any files that end in .EXE or .DLL and have VirusTotal scan them.

https://virustotal.com

 

The computer does not appear to be infected. Those files are probably a false positive and one or more of our rules is probably triggering on something there when they read them.

These are the current ones shown from your logs that need to be scanned by VirusTotal

 

C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\33CCC9D1\CCE14ED2\PARCH.EXE
C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\40C94F7B\E19B902D\MMINISTUB.EXE
C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\75E9D181\4E2DB588\PDRM.EXE
C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\7DD32F41\7546EF1F\PPCH.EXE
C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\9A09B0E5\BCFCE05B\MTRANSLATOR.EXE
C:\PROGRAMDATA\{ACE7E14E-7AD0-4D8A-8D1B-E5435EA760F2}\OFFLINE\BCA0E484\BCFCE05B\MTRANSLATOR.EXE

 

 

[StarshipCaptain68]

The files above were already cleaned by Malwarebytes.  There are thousands of dlls and exes.  Attached is the directory listing.  

The reason for my concern is that within the past year:
1.  My identify was stolen
2.  Someone opened up credit to buy $3000 worth phones on Samsung
3.  Someone committed unemployment fraud on both my wife and I
4.  On Christmas Eve someone hacked my Best Buy account and purchased three Apple AirPods
5.  Yesterday afternoon someone logged on to my password manager in another state and has access to all my passwords.

ExeLog.txtDllLog.txt

 

[AdvancedSetup]

Thank you.

This appears to be from the program InstallAware

Do you do programming or use this program for creating installation packages, etc?

https://www.installaware.com/

 

We can run some other scans to make sure the system is clean but it looks like you've already done that before?

 

If you're really concerned you might want to consider backing up all your personal data to an external USB drive and then formatting the drive and doing a clean, fresh install of Windows 10?  If possibly interested in that let me know and I can provide more steps and methods on that.

 

[StarshipCaptain68]

Yes I am a developer using InstallAware.  I am going to temporarily uninstall Installaware and see if I have the same issue after an hour.  Thanks for your help.

[StarshipCaptain68]

Good news.  There were no Malware files appearing after uninstalling Installaware 14.  After re-installing InstallAware and immediately running Malware Bytes then the false positives appeared.  Please fix these false positives.  See the log attached and the Virus Total links below.  

https://www.virustotal.com/gui/file/2a08ca9e4dc5ce5693b0cb66bb8fcfaf78f5467fa101a7479ebc23340b830264
https://www.virustotal.com/gui/file/a94a87750d2de384405923d271a8a5b0effded347c3cd801d5ce1a1d12661844?nocache=1

MalwareBytesLog2022-01-23.txt

[AdvancedSetup]

Due to the sheer amount of these files and a very specific old program the best thing to do is add that entire folder to exclusion from within Malwarebytes.

Exclude detections in Malwarebytes for Windows
https://support.malwarebytes.com/hc/en-us/articles/360038479234-Exclude-detections-in-Malwarebytes-for-Windows

Video: Add Exclusions in Malwarebytes for Windows
https://support.malwarebytes.com/hc/en-us/articles/360040199013-Video-Add-Exclusions-in-Malwarebytes-for-Windows

Thank you @StarshipCaptain68

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you