crypto mining virus

[vicius_the_one]

hello i tryed to fix this problem myself but i cannot do it. i have 2 log files of FRST64 pls help

Addition.txt FRST.txt

[Maurice Naggar]

Hello  

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

Gotta have history and all logs from Malwarebytes for Windows. 

 [   2   ]

• I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply 

[ 3 ]

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  CUSTOM scan  & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[vicius_the_one]

mbst-grab-results.zip

mbst-grab-results.zip msert.log

[Maurice Naggar]

Malwarebytes classifies Process Hacker 2 as riskware -- RiskWare.ProcessHacker
See https://blog.malwarebytes.com/detections/riskware-processhacker/
If you do not have a crystal clear legitimate need for Process Hacker 2, I suggest you uninstall it.
*

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

 

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

[vicius_the_one]

cleaner.txt

[vicius_the_one]

waitAdwCleaner[S03].txt 

[Maurice Naggar]

After completing the last tasks ^ ^ ^ then do the following.

This custom script is for  vicius_the_one  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. This is really just housekkeping.

We will use FRSTEnglish  on the Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will clear the cache files on Brave and Edge browsers.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt        <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRSTENGLISH    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

Once the Windows system has settled back in, let me know, How is the situation with issue of clipboard hijack ?

[vicius_the_one]

Thank you that u took ur time!

Fixlog.txt

[vicius_the_one]

iam sorry i did not find FRSTEnglish  only FRST 

[Maurice Naggar]

Thank you. I have the Fixlog. Let me know later today,

How is the situation as far as your being able to properly copy > paste

, If and only If there is still a issue, you should tell me which web browser is being used ( if any) at the time of the problem.

[Maurice Naggar]

Launch Malwarebytes for Windows.
Cick the gear-like Settings icon on the top-right bar.
On the General tab
look down to "Manual scan perfoirmance" impact
click the selection "Manual scans take less priority ( less performamnce impact"

click the Security column tab
Look down to "Scan options"
on the line "Scan for rootkits) set that to the left-side ( off position)
That is the normal default position.

Now, click the small x on the second bar at top
Now, click the blue Scan button on the Scanner section.
After the scan has finished, Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

[vicius_the_one]

Okay wait

[vicius_the_one]

here

malwarebytes.txt

[vicius_the_one]

and im using brave

[Maurice Naggar]

The Malwarebytes scan reports no malware. By the way, do you see that this build of the Operating system is very very out of date ! It reports as Windows 10 (Build 19041.264)
By my math, that is especially out of support.
I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative upates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

Edited May 3, 2022 by Maurice Naggar

[vicius_the_one]

thanks

[Maurice Naggar]

You are welcome. The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  CUSTOM scan  & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. When you next reply, Kindly tell me How is the system at that point.

[AdvancedSetup]

Hello @vicius_the_one

Are you still with us?

Please post a status update

Thank you

 

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you