wmail-service.com from powershell

[ohenryx]

Any ideas about what is causing this, and how to get rid of it?

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 5/10/22
Protection Event Time: 11:28 AM
Log File: 2fe1c438-d07e-11ec-b27b-005056c00001.json

-Software Information-
Version: 4.5.8.191
Components Version: 1.0.1666
Update Package Version: 1.0.54792
License: Premium

-System Information-
OS: Windows 11 (Build 22000.652)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: RiskWare
Domain: wmail-service.com
IP Address: 104.21.4.86
Port: 80
Type: Outbound
File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

 

(end)

 

problem.txt

[Maurice Naggar]

I am moving this topic to MR sub-forum

[Maurice Naggar]

@ohenryx 

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware (if present)  isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".

[Maurice Naggar]

@ohenryx  

My name is Maurice. I will guide you. 

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones. 

Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

 [   2   ]

• I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply 

[AdvancedSetup]

Just an FYI that this has been associated with a PowerShell coin-miner threat. I was starting to reply but will let @Maurice Naggar continue assisting you.

 

 

[ohenryx]

I always have File Explorer set to show everything.  Here are the results, attached.

mbst-grab-results.zip

[Maurice Naggar]

Thank you. I will dig thru it.  Then I will have a custom script for you to run. Meantime, the Malwarebytes protection is keeping pc safe from harm.

[Maurice Naggar]

This custom script is for  Ohenryx  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. This is really just housekkeping.

We will use FRSTENGLISH  on the Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity.  It will rebuild the Winsock. It will remove the rogue scheduled task which makes use of powershell to exploit a Microsoift VBS script. It will also put the two IP addresses on the Windows firewall block rules.

NOTE-2: This should run a quick scan with MS Defender antivirus and remove outstanding action items, if any.

NOTE-3: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt          <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRSTENGLISH   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

NOTE: For me, it is late night-time. I will check on your case in the morning.

[ohenryx]

I do not have FRSTENGLISH.  I have mb-support01.8.7.918.exe.  Is that what you're talking about?

[Maurice Naggar]

Would you please look closer on the Downloads folder. There should be a executable with the name 

FRSTENGLISH

 

[Maurice Naggar]

It is there at C:\Users\Henry\Downloads\FRSTEnglish.exe

[ohenryx]

I did a quick search for "Farbar Recovery Scan Tool" and downloaded from BleepingComputer.  It is the same file, the sha256sum matches with the one from Downloads.  The reason I didn't see it at first was because I wasn't taking you literally.  I never download to the C: drive, everything goes on the D: drive (small fast SSD versus big slow spinning hard drive).  Everything seemed to go well.  Fixlog.txt is attached.   And on a positive note, on a really fast computer this does not take very long.

Fixlog.txt

[Maurice Naggar]

The Windos System File Checker Windows Resource Protection found corrupt files and successfully repaired them.
The offending IP addresses have been added to the Block rules of Windows firewall.
The offending scheduled task and its exploit have been removed.
+ NEXT Action

Delete the priopr saved file named Fixlist.txt that is at D:\dnl2  folder

This custom script is for  Ohenryx  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. This is really just housekkeping.

We will use FRST64  on the D:\dnl2  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  remove one excluded path on settings of Microsoft Defender antivirus.

• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.
• Please save the (attached file named) FIXLIST.txt   to the   D:\dnl2  folder   folder

Fixlist.txt          <<< - - - - -

Then, Start the Windows Explorer and then, go  to the D:\dnl2  folder   folder.

RIGHT click on FRST64   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
 

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

NOTE: For me, it is late night-time. I will check on your case in the morning.

[ohenryx]

Here is the second fixlog.txt.  I have not seen the pop-up again, seems to be fixed.

Fixlog.txt

[Maurice Naggar]

Thank you. We did not have luck to remove a Temp path from the exclusion-path list of Microsoft Defender. Let us start with one adjustment. 

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

Now, our goal is to remove the path exclusion "C:\Users\Henry\AppData\Local\Temp\MRP_QT" from the Exclusion list of Defender

See this guide at OPTION TWO https://www.tenforums.com/tutorials/5924-add-remove-microsoft-defender-antivirus-exclusions-windows-10-a.html

[Maurice Naggar]

A request please 

I would like to get a copy of what we placed in Quarantine, from the runs I had you do. Please. 

• Using Windows File Explorer, Navigate to C:\FRST folder on your system. Expand the folder so you see all contents.
• Right click on Quarantine > Send to > Compressed (zipped) folder
• Upload the archive in your next reply
• If archive is too big you can upload here > https://wetransfer.com/

Thank you!

[ohenryx]

I appreciate your help, you have been very kind and very helpful, and you may tell your boss I said so. 

 

I had purposefully turned off windows defender as I had read that Malwarebytes was sufficient.  If that isn't so, then I will probably go back to Eset or Kaspersky.  Or maybe Webroot.  In the meantime, here is a copy of the c:\frst\quarantine folder.

quarantine.7z

[Maurice Naggar]

You are very welcome. I am glad to have worked with you. Your choice as to Malwarebytes is fine.

We can proceed with cleanup of tools we used.

To remove the FRSTENGLISH tool & its work files, do this. Go to your on the D:\dnl2  folder. Do a RIGHT-click on FRST64.exe & select RENAME & then change it to

UNINSTALL.exe

.
Then run that ( double click on it) to begin the cleanup process.

Delete mb-support-1.8.7.198.exe
Delete mbst-grab-results.zip on the Desktop.

Any other download file I had you download, you may delete.
Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

I am marking this case for closure.
I wish you all the best. Stay safe.
Sincerely.

Maurice

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you