Persistent script/trojan (ttdinject.exe?)

logicforward · June 29, 2022

Hello All!

So this has been running me in circles for about 2 weeks. I first noticed the virus when my pc came to a crawl during gameplay. Observing the system at boot and then safe mode with HWMONITOR. I could see that my PC GRAPHICS was at 100% utilization. I narrowed it down to a program I had installed and removed it and the problem seemed to actually go away. Upon reboot the problem came back as another app, It seems the malware is good at disguising itself as other software. Well, fast forward through a week of Malwarebytes and other software scan tools it seems like everything was removed but now what I get is constant popups about blocked websites.

image.png.b2e8048be271994522c6ee8a301e4fb4.png

Multiple scans come up clean. Did a registry search but couldn't find anything specific, checked out task scheduler and there seemed to be some oddities all named "lkjlkjasdf," or some variant, that I removed still with no change. Searching through logs I did see a particular odd .exe in the system32 folder called "ttdinject.exe" and looked it up.

image.png.7dc88b8430d6c926c264bf9b9674dd78.png

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior:Win32/Ttdinject.A&ThreatID=2147781124

I am unsure if this is actually the culprit. found a website that called it a "Coin Miner Trojan" and their description certainly describes my initial issues.

here are my logs:

scanreport2022-06-22.txt

FRST.txt Addition.txt

AdvancedSetup · June 29, 2022

Are you running this VBE file on startup on purpose?

Startup: C:\Users\antho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updatadif.vbe [2022-06-26] () [File not signed]

Please temporarily disable Avast real-time protection and run the following fix. Failure to disable Avast will cause this fix not to run.

https://helpdeskgeek.com/how-to/how-to-turn-off-or-disable-avast-temporarily/

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

Windows Temp
Users Temp folders
Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
Recently opened files cache
Discord cache
Java cache
Steam HTML cache
Explorer thumbnail and icon cache
BITS transfer queue (qmgr*.dat files)
Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

logicforward · June 29, 2022

Hello AdvancedSetup!

First thank you for the quick response and assistance. I do NOT have any VBE's running at boot and is actually part of the same problem I noticed myself. When I delete the file it recreates itself with a different name. overnight I let two things run, a full MalwareBytes Scan plus a Microsoft Safety Scanner.

Microsoft Scanner removed some items but they didn't seem serious (just unsigned code) and here is the removal for MalwareBytes:

image.png.aa9d36a2aeb22133666c59064719adb9.png

I had uninstalled Avast some time ago, not sure why there is anything running under their name. I followed up with Avast uninstall tool, hopefully it's gone entirely now.

I then ran your filefix, here is the log:

Fixlog.txt

checked MalwareBytes log and this is what I see (same issue):

image.png.997e7568faf8b318a73588bf6503811c.png

AdvancedSetup · June 29, 2022

Okay, good to know you're not running the VBE

Please run the Farbar scanner again and click on SCAN and attach back both new logs

FRST.TXT
ADDITION.TXT

Thanks @logicforward

logicforward · June 29, 2022

Here are the new log files:

Addition.txt FRST.txt

AdvancedSetup · June 29, 2022

Please uninstall the outdated versions of these programs

Java(TM) SE Development Kit 17 (64-bit)
Java(TM) SE Development Kit 17.0.3.1 (64-bit)

Then run this updated FIXLIST as before and post back the new FIXLOG when it's done.