Remote acess through NetSupport Manager Trojan using client32.exe

[Zackuna]

Hi Malwarebyte Forum,

Just before anything else i just want to thank anyone for spending your time to read this post. I Just wondering if someone can help me with my current issue where someone remoted access my laptop, trying to use my paypal while i'm away from it. I'm not sure how long this person have acess to my laptop or if he have install anything malicious on my system but the one thing i know is that malwarebyte detect that someone trying to use Netsupport Manager specifically "Client32.exe" to remote acess my laptop. I came to this conclusion because this is not a new issue on this forum because i stumble upon an old posting:

To futher give you guys more context to this issue malwarebyte also notify me ever 5-10 minute that my computer is pinging or somone is pinging my computer from this specific domain and IP through "Client32.exe".

Here the attachment that i follow from the last posting about thiss issue where i need to provide a few attachment which i will link down below.

Addition.txt AdwCleaner[C00].txt FRST.txt Malwarbytes Scan.txt

[Maurice Naggar]

Hello  

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

The last run of Malwarebytes has removed lots of P U P's. As to the Block notices, Malwarebytes is keeping pc safe from harm. 

{change from original}  Please do this next. 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  FULL scan  

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. We will do more later.

Edited July 5, 2022 by Maurice Naggar
change from first reply

[Zackuna]

Hi Maurice Naggar,

Thank you reply and help me with my issue. Down below you will find the the attachment that you are looking for. Also sorry for taking so long because the scaning taking quite abit of time. Again thank you.

msert.log

[Zackuna]

Sorry this is the right one.🙏🏾🙏🏾

msert.log

[Maurice Naggar]

Good morning. Thank you for the Safety Scanner report. This system is a Windows 11 system. And it has Kaspersky Total Security. Please use Kaspersky to do a new scan. Let me know that result.

[Zackuna]

I know this not what you looking for but i do a quick scan with the highest security srtting in kapersky because i don't want you wait for too long. Don't worry while you analyse this log i will do a full scan with kapersky. 🙏🏾🙏🏾

Kapersky Quick Scan.txt

[Zackuna]

Here the full Scan. Again thank you.

Kapersky Full Scan.txt

[Maurice Naggar]

Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

What follows below is a next step. There will still be more to do after this. 

This custom script is for  Zackuna  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. . 

We will use FRST64  on the Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt       <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRST64   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. 

1. Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[Zackuna]

Here the log that you've ask for. Also I don't know if i'm in the clear yet but i like to thank you for your effort. I don't have much but i can pay you at least something, so just shoot me your paypa or somthing. Again thank you so much for the patient and time.🙏🏾🙏🏾

Fixlog.txt

[Maurice Naggar]

Thank you for your compliment, remarks. I am a volunteer here.
I need to know from you whether "the Block notices by Malwarebytes" have stopped.

I would recommend getting a report on the update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[Zackuna]

Here the Sercurity check logs that you've ask for and i been observe the malwarebyte notification but it seem that the noticee have stop. Thank you so much.🙏🏾🙏🏾

SecurityCheck.txt

[Maurice Naggar]

Hello. There are some programs that are out-of-date & one that should be Uninstalled. 

• Discord v.0.0.309   Warning! Download Update
• Microsoft Teams v.1.4.00.19572   Warning! Download Update
• Zoom v.5.5.2 (12494.0204)   Warning! Download Update
• Mozilla Firefox 67.0.1 (x64 en-US) v.67.0.1   Warning! Download Update
• Bonjour v.3.0.0.10 you should Uninstall. It is not needed.

A request please 

I would like to get a copy of what we placed in Quarantine, from the runs I had you do. Please. 

• Using Windows File Explorer, Navigate to C:\FRST folder on your system. Expand the folder so you see all contents.
• Right click on Quarantine > Send to > Compressed (zipped) folder
• Upload the archive in your next reply
• If archive is too big you can upload here > https://wetransfer.com/

Also, Let me know how the situation is at this point as to any new "block" notices, or some other active security issue.
Also, please do one new Scan with Malwarebytes.

Thank you!

[Zackuna]

Here is all the file that you ask for. Thank you.🙏🏾🙏🏾

Quarantine.zip Malwarbytes Scan 1007.txt Malwarbytes Scan 10071.txt

[Maurice Naggar]

Hello. Thank you. These here are the next steps since your PC has the Google CHROME browser.

Using just the Chrome browser, sign-in to your Google account ( if not signed in already)  https://chrome.google.com/
Then go to https://chrome.google.com/sync?
Scroll down the page, press the "CLEAR DATA" button, to clear the Chrome data from your Google account.

[   2   ]

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history"

Check mark the line "Download history"

Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )

[   3   ]

After that, make real sure that Chrome is "NOT" set to reload the pages from the last session

Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the adress bar

Then look deeper in SETTINGS

Make real sure it is "NOT" set to "continue where you left off"

.

[   4   ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

[   5   ]

I suggest you install the Malwarebytes Browser guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

 

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

Then proceed with the setup.

[Zackuna]

Thank you so much i follow all the step. 

[Maurice Naggar]

This here is for tools cleanup.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log may open in Notepad titled kprm-(date).txt.  I do not need it. Just close Notepad if it shows up.

I would recommend that you get Malwarebytes Premium to protect all your devices.

[Zackuna]

Ok, I finish runnning Kprm. Thank you for the recommendation and yes i will get malwarebyte after my kapersky licence is expired because to me it just feel like malwarebyte are more robust compare to others AV just from using the free trial. I mean it on the expensive end of AV but i feel like it worth the purchase just to protect my Laptop. I know i say it many times but thank you so much for spending your time and effort to help me with my problem. Also thank you for being so patient with me and the time difference.🙏🏾🙏🏾🙏🏾

[Maurice Naggar]

You are very welcome. Stay safe. 👍😎

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you