Got infected with a Browser Assistant Malware

[ImInSpainWithoutTheS]

It didnt actually start causing problems until recently where it would just decide to change the search engine from google to yahoo. Though im not exactly sure where it came from but most likely from me being a smooth brain and downloading something i shouldnt have (Obviously). So right now im just doing the scans using Malwarebytes and AdwCleaner but im extremely lost from there after the scans are done and i've made the text files.

May i be able to have some help with the deletion of this malware?

[Maurice Naggar]

@ImInSpainWithoutTheS   Please do all the preliminaries on this pinned topic https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/#comment-46166

Only just ATTACH the reports files.  Do not copy-paste into the main body of reply.

[ImInSpainWithoutTheS]

23 minutes ago, Maurice Naggar said:

@ImInSpainWithoutTheS   Please do all the preliminaries on this pinned topic https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/#comment-46166

Only just ATTACH the reports files.  Do not copy-paste into the main body of reply.

Just these right?

MalwarebytesScan.txt AdwCleaner[C01].txt

[ImInSpainWithoutTheS]

7 minutes ago, ImInSpainWithoutTheS said:

Just these right?

MalwarebytesScan.txt 5.04 kB · 0 downloads AdwCleaner[C01].txt 2.63 kB · 0 downloads

And these correct?

FRST.txt Addition.txt

[Maurice Naggar]

I automatically get notified when you make replies. You do not need to ( nor should you) begin a reply by using the Quote spot.  Just type directly into the white reply at the bottom.  T I A

[Maurice Naggar]

Thanks. You must look closely at the displayed results, Plus, you must insure to TICK all lines so that they are really, truly selected for removal. Take your time. 

do a new Threat Scan with Malwarebytes for Windows  and post back the log

 go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[ImInSpainWithoutTheS]

This was the second scan after i did the first one and i checked all the things that were quarantined and they were all things that were revolving around browser assistant Ima do a third scan to see if there anything else left 

MalwarebytesScanAddition2.txt

[Maurice Naggar]

Hello. Thank you. The following is like a mini-cleanup. 

This custom script is for  Iminspainwithoutthes  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. This is really just housekkeping.

We will use FRST64  on the Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will rebuild the Winsock.  It will remove a few leftover null scheduled tasks.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt        <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRST64    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[ImInSpainWithoutTheS]

Sorry for the delay was busy for the past few days cause of things but here you go.

Fixlog.txt

[Maurice Naggar]

Hello. Thank you for the Fixlog report. That custom fix-run was worth doing. It cleaned up some remains of the pest. And the Windows System File Checker did make some corrections.
On your next reply, let me know How the siatuation is.
also,

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  CUSTOM scan  & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[ImInSpainWithoutTheS]

The Situation seemed to have gotten alot better the powershell thing that used to pop up is now gone and the search engines are no longer switching around as well also after i ran the microsoft safety scanner there wasnt a log after it so i just clicked on the report thing and it said it removed after taking like an hour and something minutes didnt double check as i was watching youtube as i waited

[Maurice Naggar]

Thank you for the news. Let us just get fresh reports.

Your machine has the FRST64 report tool on the Downloads folder. We will use that. Go to Downloads folder. RIGHT-click on FRST64 and select 

Run as Administrator

and tap ENTER. And reply YES to allow to proceed.  

•  When the tool opens click Yes to the disclaimer.  And be very sure to TICK the box for Addition.txt
• Press the Scan button.

• It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run
• Have patience since the run may take something like 10 or so minutes  (less depending on your hardware speed)
• Close Notepad IF those show up on Notepad.
• Just please Attach the 2 files FRST.txt +Addition.txt  with your next reply.

[ImInSpainWithoutTheS]

FRST.txt Addition.txt

[Maurice Naggar]

Thank you. very quick first note. Java 8 Update 301 is not supported by Oracle since it is way out of date. Uninstall it now. Windows itself does not need Java. But if you do have an app that does need it, you can get the latest Java release. See how to https://securitygarden.blogspot.com/2022/05/oracle-java-bugfix-update-released.html

[Maurice Naggar]

One more thing: I would recommend getting a readout report as to update the status of some key apps. 

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[AdvancedSetup]

Hello @ImInSpainWithoutTheS

Are you still with us?

Please post a status update

Thank you

 

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you