I have a trojan -- Wmail-chat.com popping up every minute

[Zesty]

I've been trying to get rid of this Trojan in my powershell.exe recently. 

Before coming onto the forum, I did a custom scan on Malwarebytes -- that took a little over 10 hours and it showed 0 detections.  Doing threat scans pops up with 0 detections. 

I did a microsoft safety scanner this morning and it supposedly stopped the wmail trojan from popping up every minute, but as soon as I turned off my computer and turned it on, the wmail trojans continually pop up in the corner every minute.  I'm at a loss of what to do.

Addition.txt FRST.txt Threat Scan.txt wmail export.txt

[MKDB]

Hello @Zesty  and 

 

My name is MKDB and I will assist you.

 

 

Some ground rules:

• Please follow the steps in the given order and post back the log files.
• Please attach all log files into your post.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting and removing malware isn't instantaneous and there is no guarantee to repair every system. Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Please be patient and stick with me until I give you the "all clear".
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.

 

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\zesty\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the Fix button only once and wait. Please be patient.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

 

Step 2

• Run FRST again.
• Do not change any settings.
• Press the Scan button.
• FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

 

 

 

fixlist.txt

Edited June 24, 2022 by MKDB

[Zesty]

I made an effort to start FRST yesterday.  It didn't work and kept freezing and saying (Not Responding), but ever since I temporarily turned off my security, I'm not getting the pop-ups anymore.  Did the trojan infest my system and it's hiding or is it actually gone?

[MKDB]

Hi,

please be patient while FRST is processing the fix... "not responding" may appear, but that is normal. Did you follow my instructions from Step 1?

If so, FRST should have created a file called fixlog.txt. Please attach it with your next answer.

Thank you again @Zesty.

[Zesty]

I followed only Step 1 this time, and it finished scanning and gave me the file.  I don't want to go through with step 2 until I get approval from you on your end.  I'm sorry for the delay, I usually operate later in the day and I'm from the United States.

 

Fixlog.txt

[Maurice Naggar]

<<pardon this momentary intrusion>>  @Zesty The script run completed. Go ahead and do Step 2 that MKDB listed before.  and also, let him know whether the Block notices on "wmail" have ceased.

[Zesty]

20 minutes ago, Maurice Naggar said:

<<pardon this momentary intrusion>>  @Zesty The script run completed. Go ahead and do Step 2 that MKDB listed before.  and also, let him know whether the Block notices on "wmail" have ceased.

Thank you Maurice, I will let MKDB know and run Step 2.  I will add the log file later.

[Zesty]

I'm sorry if I'm being complicated, but the second scan is not producing a FRST.txt and an 'addition.txt'. 

I keep having to download the initial fixlist.txt since FRST keeps asking for that document when I try to do the 'Fix' in general.  Whenever I finish doing a scan with FRST, it makes 'fixlist.txt' disappear and I have to redownload it again.  Is there something I'm doing wrong?

[Maurice Naggar]

<<pardon>> @Zesty You have finished with the Fixlist run.  You no longer run a 'fix'. Because it has been completed. Now you only need to generate brand new reports.  Only reports.  Close FRST64 if it is on at this point.

Your machine has the FRST64 report tool on the Downloads folder. You will use that. Go to Downloads folder. RIGHT-click on FRST64 and select 

Run as Administrator

and tap ENTER. And reply YES to allow to proceed.  

•  When the tool opens click Yes to the disclaimer.  And be very sure to TICK the box for Addition.txt
• Press the Scan button.

• It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run
• Have patience since the run may take something like 10 or so minutes  (less depending on your hardware speed)
• Close Notepad IF those show up on Notepad.
• Just please Attach the 2 files FRST.txt +Addition.txt  with your next reply. Hope this helps.  😉

[Zesty]

My bad for misunderstanding.  I have attached the files after being able to do step 2.

Addition.txt FRST.txt

[MKDB]

Thank you very much @Zesty and @Maurice Naggar.

I'm looking into your logfiles now.

[MKDB]

@Zesty Please do not download, install or run programs on your own until we have finished our work here.

Thank you.

 

We are going to check windows system files (Step 1) and double check your system with ESET (Step 2).

Please be patient whil Step 1 is running... this may take several minutes to complete.

 

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\zesty\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the Fix button only once and wait. Please be patient.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

 

Step 2

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

• It will start a download of "esetonlinescanner.exe".
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes.
• When prompted for scan type, Click on Full scan. 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.  (e.g. their standard program). You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  (in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

 

 

 

fixlist.txt

[Zesty]

I finished the ESET scan and it has removed the threats.  I am going to attach the Scan Results from ESET in addition to the fix list that you requested.

Fixlog.txt Scan Results.txt

[MKDB]

Thank you for your cooperation, we're done @Zesty 🙂

 

Final Step

• Right-Click on FRST64 and choose Rename.
• Rename FRST64 into Uninstall.
• Run Uninstall.
• FRST and it’s files/folders will be deleted.
• If the tool needs a restart, please make sure you let the system restarts normally.

 

 

 

 

A few final recommendations:

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes.

 

 

[Zesty]

Thank you for the help MKDB, I really appreciate it!

 

I also appreciate your input as well Maurice!

 

Have a good day now!!!

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you