Jump to content

Malwarebytes Reporting Riskware and Trojan through Powershell every second


Go to solution Solved by MKDB,

Recommended Posts

Hi there, I have two systems which seem to have this issue that I cannot seem to resolve.  I will post the details of the first system. 

Malwarebytes has been telling me every second there appears to be an RTP detection riskware and Trojan the PC's. Currently have run scans with Malwarebytes, ESET, Norton Security, SpyBot - and am currently running MS Safety Scanner as I type this. I was hoping someone could help me with a fixlist for Farbar Recovery Scan Tool.

I've attached my FRST files below as well

Here is the malwarebytes report:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 25/08/2022
Protection Event Time: 12:51
Log File: 31c6bb8e-2496-11ed-959e-6c4b9058a767.json

-Software Information-
Version: 4.5.13.208
Components Version: 1.0.1740
Update Package Version: 1.0.59163
Licence: Premium

-System Information-
OS: Windows 10 (Build 19044.1889)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: RiskWare
Domain: wmail-blog.com
IP Address: 185.170.213.96
Port: 80
Type: Outbound
File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

(end)

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 25/08/2022
Protection Event Time: 12:52
Log File: 47a5735a-2496-11ed-a1dc-6c4b9058a767.json

-Software Information-
Version: 4.5.13.208
Components Version: 1.0.1740
Update Package Version: 1.0.59163
Licence: Premium

-System Information-
OS: Windows 10 (Build 19044.1889)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Trojan
Domain: wmail-chat.com
IP Address: 193.239.84.207
Port: 80
Type: Outbound
File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

(end)

Addition_25-08-2022 12.57.20.txt FRST_25-08-2022 12.57.20.txt

Link to post
Share on other sites

Hello @leungalv  and  :welcome:

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

  • Please follow the steps in the given order and post back the log files.
  • Please attach all log files into your post.
  • Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
  • Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
  • Searching, detecting and removing malware isn't instantaneous and there is no guarantee to repair every system.
  • Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
  • Please be patient and stick with me until I give you the "all clear".
  • Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.
  • If you do not respond within 4 days, your topic will be closed. If you are away for a longer time, please let me know.

 

 

 

Step 1

  • Please download the Malwarebytes Support Tool (MBST).
  • Run MBST and accept license agreement.
  • In the left navigation pane of MBST, click Advanced.
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine.
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply.

 

Thank you!

Link to post
Share on other sites

Thank you for those logfiles @leungalv.

 

You have enabled Spybot, Norton and Malwarebytes with realtime protection. That's a bit too much and slows down the system. If possible, I would like you to temporary uninstall Spybot and Norton during the cleanup process here.

 

 

We will remove some orphans and check windows system files with FRST (Step 1). This may take some time (>15 minutes), so please be patient.

After that, I would like you to run another scan with FRST (Step 2).

Thank you!

 

 

Step 1

  • Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\Alvin W. Leung\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  • Close all open programs and save your work.
  • Run FRST again.
  • Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
  • Please note: This Fix will remove all temporary files and empty recycle bin.
  • If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
  • FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
  • Please attach this logfile to your next reply.

 

 

 

Step 2

  • Run FRST again.
  • Do not change any settings.
  • Press the Scan button.
  • FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
  • Please attach these logfiles to your next reply.

 

 

 

fixlist.txt

Link to post
Share on other sites

  • Solution

Thank you @leungalv.

Let's remove some orphans with FRST (Step1) and check with KVRT (Step2).

Do you still get those powershell-blocks from MBAM @leungalv? Please report back regarding this. Thank you.

 

Plese note:

FRST fix (Step1) will create a .zip file like < Date_Time.zip >, for example 20.02.2022_11.33.52.zip, on your desktop. Please upload that .zip file with your next answer as well.
Thank you!

 

 

Step 1

  • Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\Alvin W. Leung\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  • Close all open programs and save your work.
  • Run FRST again.
  • Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
  • If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
  • FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
  • Please attach this logfile to your next reply.

 

 

 

Step 2

Download Kaspersky Virus Removal Tool (KVRT) and save it to your download folder.

  • Select the Windows Key and R Key together, the Run box should open.
  • Copy and paste the following string into the line:

C:\Users\Alvin W. Leung\Downloads\KVRT.exe -dontencrypt

  • Select „Ok“ in the Run box.
  • If the „Windows protected your PC“ window opens, select „More info“. A new windows will open, select „Run anyway“.
  • An EULA window from KVRT will open, tick all confirmation boxes then select "Accept".
  • A window from KVRT will open, select "Change Parameters".
  • In the new window ensure the following boxes are ticked:
    • System memory
    • Startup objects
    • Boot sectors
    • System drive
  • Then select "OK" and „Start scan“.
  • completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
  • Usually, your system needs a reboot to finish the removal process.
  • Logfiles can be found on your systemdrive (usually C: ), similar like this:

C:\KVRT2020_Data\Reports\report_<data>_<time>.klr

  • Right click direct onto those reports, select > open with > Notepad.
  • Save the files and attach them with your next reply.

 

 

 

fixlist.txt

Link to post
Share on other sites

Good afternoon, @MKDB, to answer your questions:

1. Since 08/25/2022 15:06, according to Malwarebytes, I have stopped getting the RiskWare and Trojan events

2. Since 08/25/2022 15:48, I was getting compromised Inbound Connection attempt from svchost.exe; however, those have stopped since 08/26/2022 11:04

I have attached the log files as requested -  there are two Kaspersky scan logs - one after scanning, then one after the first one finished and restarted the system.

Fixlog.txt report_2022.08.26_11.15.34.klr.txt report_2022.08.26_11.53.12.klr.txt

Link to post
Share on other sites

@MKDB There now appears to be a continued Inbound Connection Compromised svchost.exe blocked website detection

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 26/08/2022
Protection Event Time: 16:33
Log File: 667ff7da-257e-11ed-a83c-6c4b9058a767.json

-Software Information-
Version: 4.5.13.208
Components Version: 1.0.1740
Update Package Version: 1.0.59225
Licence: Premium

-System Information-
OS: Windows 10 (Build 19044.1889)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\svchost.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Compromised
Domain: 
IP Address: 45.227.254.52
Port: 56601
Type: Inbound
File: C:\Windows\System32\svchost.exe

(end)

Link to post
Share on other sites

It does just mean that a malicious website was blocked, no need to worry. That does not mean that your system is infected.

 

Step 1

  • Run Malwarebytes Support Tool again.
  • In the left navigation pane of MBST, click Advanced.
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine.
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply.
Link to post
Share on other sites

Hi again @leungalv.

Your logfiles look clean to me.

 

The blocks are on addresses that are attempting to do a forced attempt to exploit remote-desktop-protocol.

The Real Time Protection of Malwarebytes for Windows is actively doing it's job to protect the system.

In most cases the attempted probes will automatically stop on their own. If it continues you can add the IP to the local firewall to prevent it from contacting the computer period.
If you wish to do so, here is one how-to guide:
https://www.interserver.net/tips/kb/add-ip-address-windows-firewall/

 

 

Should we have a look on your second system now?

Link to post
Share on other sites

Hi @leungalv.

Yes, we can work for the second system here in this topic as well. 👍

 

 

Please do the following on the second system when you have time for it.

 

Step 1

  • If you already have Malwarebytes Anti-Malware installed, then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
  • If you don't have Malwarebytes installed or if you don't run the newest version yet, please download it from here and install it.
  • Once the MBAM dashboard opens, click on Settings (gear icon).
  • Click on Security tab and make sure that all four Scan options are enabled.
  • Close Settings and click on the Scan button on the dashboard.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
  • If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and paste that log on your next reply.
  • If Malwarebytes won't run, then please skip to the next step and let me know in your next reply that the scanner would not run.

 

 

 

Step 2

Please download AdwCleaner and save it to your desktop.

  • Double-click to run it.
  • Accept the End User License Agreement.
  • Click Scan Now.
  • When finished, if items are found please click Next / Quarantine.
  • Maybe your PC will be rebooted, AdwCleaner will be opened automatically.
  • Click View Log File.
  • AdwCleaner will open one log (AdwCleaner[Cxx].txt).
  • Please paste the log to your next reply.

 

 

 

Step 3

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Check the box in front of Shortcut.txt.
  • Press the Scan button.
  • FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
  • Please attach these logfiles to your next reply.

 

 

 

  • Thanks 1
Link to post
Share on other sites

Hi @MKDB , I have pasted and attached logs from the second computer as requested.  Thank you.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 08/09/2022
Scan Time: 23:49
Log File: 723030ee-2ff2-11ed-85da-482ae3578ade.json

-Software Information-
Version: 4.5.14.210
Components Version: 1.0.1751
Update Package Version: 1.0.59819
Licence: Trial

-System Information-
OS: Windows 10 (Build 19044.1889)
CPU: x64
File System: NTFS
User: LMZ-LAPTOP\Lavinia Zamfir

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 280084
Threats Detected: 37
Threats Quarantined: 37
Time Elapsed: 3 min, 15 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 6
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\NetService\Network\NetServices, Quarantined, 485, 1050593, , , , , , 
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{A8CF1A30-D55C-48ED-B5A8-F5F3F0C3042F}, Quarantined, 485, 1050593, , , , , , 
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\BOOT\{A8CF1A30-D55C-48ED-B5A8-F5F3F0C3042F}, Quarantined, 485, 1050593, , , , , , 
Trojan.Tasker.Powershell, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 cikNp, Quarantined, 5390, 1066621, , , , , , 
Trojan.Tasker.Powershell, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{3C16263F-C57D-4671-8092-FAA9A301770C}, Quarantined, 5390, 1066621, , , , , , 
Trojan.Tasker.Powershell, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{3C16263F-C57D-4671-8092-FAA9A301770C}, Quarantined, 5390, 1066621, , , , , , 

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 6
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\_metadata\generated_indexed_rulesets, Quarantined, 5891, 1082968, , , , , , 
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\_metadata, Quarantined, 5891, 1082968, , , , , , 
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0, Quarantined, 5891, 1082968, , , , , , 
Trojan.BitCoinMiner.ShrtCln, C:\USERS\LAVINIA ZAMFIR\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\DEFAULT\EXTENSION\POKNMEMNEFANECEDMJAAEFPAIPMRJQEF, Quarantined, 5891, 1082968, 1.0.59819, , ame, , , 
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0, Quarantined, 5891, 1082968, , , , , , 
Trojan.BitCoinMiner.ShrtCln, C:\USERS\LAVINIA ZAMFIR\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\DEFAULT\EXTENSION\NAKCAMACFEFANIEELKQCOLDNODQNQAOL, Quarantined, 5891, 1082968, 1.0.59819, , ame, , , 

File: 25
Trojan.BitCoinMiner.ShrtCln, C:\USERS\LAVINIA ZAMFIR\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\DEFAULT\EXTENSION\POKNMEMNEFANECEDMJAAEFPAIPMRJQEF\8.1.9._0\RULES.JSON, Quarantined, 5891, 1082968, 1.0.59819, , ame, , 4FB6F22DE4F9A3056773E6A39827B547, 1D6845C7B92D6EB70464A35B6075365872C0AE40890133F4D7DD17EA066F8481
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\_metadata\generated_indexed_rulesets\_ruleset1, Quarantined, 5891, 1082968, , , , , 96CD8447C2055A5C002F8F47706D97D2, 126203311363ACC2DB796999DF99FB3ADD785F909F8E68B45DF1CAB55AD07F01
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\128.png, Quarantined, 5891, 1082968, , , , , 913064ADAAA4C4FA2A9D011B66B33183, AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\content.bootstrap.js, Quarantined, 5891, 1082968, , , , , 6B3CC104B0FE21A2F2B752B4790BE576, E79BF18E142195DEEE507EED5F834C304677D6F5972D1EACBB56A5965C292C48
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\manifest.json, Quarantined, 5891, 1082968, , , , , 59CF96C6B5C8C1FDDF2071B912A7EBE4, 0DE9A23F88B9B7BDA3DA989DCE7AD014112D88100DCEAABCA072D6672522BE26
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_block.js, Quarantined, 5891, 1082968, , , , , 491A6D688B00B7DFDA399DC6F12AB691, 73842DF22A6A0DD8DD4DD4DBD55658B26537F761DDCCD005F3C3B98D2F38927A
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_bnb.js, Quarantined, 5891, 1082968, , , , , 1491B659010E9E455013558AEBD1C5C3, 49F2DF6C2D0DE6D2F004DCCDEDB86E8BCC649243C95E8EC14A571ED654060AE8
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_cb.js, Quarantined, 5891, 1082968, , , , , 282902E1DEC7DCD8BB42591B2849417F, 0FC346F54559DB0C8F5E3617F5797EDC05D67E8AC0EF25F44162CE7428F39C6B
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_common.js, Quarantined, 5891, 1082968, , , , , 8893E4609B9B08E774EE42AC93AC03FB, 55D8BD76489A4D0C3EE417EFF026FA0F7AD95621C2A9E684F1892BB617C4199F
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_content.js, Quarantined, 5891, 1082968, , , , , B03EB64537BE0D57890B6A78D9020F74, F53445926CDCA950ED04C8A3C995C035C51A28A6EB57593D600618533A9AB112
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_gt.js, Quarantined, 5891, 1082968, , , , , 1D4A0AFD584305709DC22532A7D50614, F3BC294628CA51FA72704680C0250CFC2174182878589283AAE3B95056B63997
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\poknmemnefanecedmjaaefpaipmrjqef\8.1.9._0\webpack_kuc.js, Quarantined, 5891, 1082968, , , , , F241C8065ED75E34ECFC41D1732C49A1, B3EC1ED1E761E5A492BEC56D6652B02AD0B11F737277B02B7B96B4C098D1B8EE
Trojan.BitCoinMiner.ShrtCln, C:\USERS\LAVINIA ZAMFIR\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\DEFAULT\EXTENSION\NAKCAMACFEFANIEELKQCOLDNODQNQAOL\8.2.3._0\RULES.JSON, Quarantined, 5891, 1082968, 1.0.59819, , ame, , 4FB6F22DE4F9A3056773E6A39827B547, 1D6845C7B92D6EB70464A35B6075365872C0AE40890133F4D7DD17EA066F8481
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\128.png, Quarantined, 5891, 1082968, , , , , 913064ADAAA4C4FA2A9D011B66B33183, AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\content.bootstrap.js, Quarantined, 5891, 1082968, , , , , 6B3CC104B0FE21A2F2B752B4790BE576, E79BF18E142195DEEE507EED5F834C304677D6F5972D1EACBB56A5965C292C48
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\manifest.json, Quarantined, 5891, 1082968, , , , , 59CF96C6B5C8C1FDDF2071B912A7EBE4, 0DE9A23F88B9B7BDA3DA989DCE7AD014112D88100DCEAABCA072D6672522BE26
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_block.js, Quarantined, 5891, 1082968, , , , , 491A6D688B00B7DFDA399DC6F12AB691, 73842DF22A6A0DD8DD4DD4DBD55658B26537F761DDCCD005F3C3B98D2F38927A
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_bnb.js, Quarantined, 5891, 1082968, , , , , 1491B659010E9E455013558AEBD1C5C3, 49F2DF6C2D0DE6D2F004DCCDEDB86E8BCC649243C95E8EC14A571ED654060AE8
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_cb.js, Quarantined, 5891, 1082968, , , , , 282902E1DEC7DCD8BB42591B2849417F, 0FC346F54559DB0C8F5E3617F5797EDC05D67E8AC0EF25F44162CE7428F39C6B
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_common.js, Quarantined, 5891, 1082968, , , , , 8893E4609B9B08E774EE42AC93AC03FB, 55D8BD76489A4D0C3EE417EFF026FA0F7AD95621C2A9E684F1892BB617C4199F
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_content.js, Quarantined, 5891, 1082968, , , , , B03EB64537BE0D57890B6A78D9020F74, F53445926CDCA950ED04C8A3C995C035C51A28A6EB57593D600618533A9AB112
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_gt.js, Quarantined, 5891, 1082968, , , , , 1D4A0AFD584305709DC22532A7D50614, F3BC294628CA51FA72704680C0250CFC2174182878589283AAE3B95056B63997
Trojan.BitCoinMiner.ShrtCln, C:\Users\Lavinia Zamfir\AppData\Local\Microsoft\Edge\User Data\Default\Extension\nakcamacfefanieelkqcoldnodqnqaol\8.2.3._0\webpack_kuc.js, Quarantined, 5891, 1082968, , , , , F241C8065ED75E34ECFC41D1732C49A1, B3EC1ED1E761E5A492BEC56D6652B02AD0B11F737277B02B7B96B4C098D1B8EE
Trojan.Agent, C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\NetService\Network\NetServices, Quarantined, 485, 1050593, 1.0.59819, , ame, , 5D354C93963F93AB7E3395B2215D604F, 6B990F034142A416173AA8164537195B8BED98D6D81D5CA743A599D8803B7263
Trojan.Tasker.Powershell, C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 cikNp, Quarantined, 5390, 1066621, 1.0.59819, , ame, , CD22915C899CF6334AAA98455A3A5874, 7A71130DC064F68672AB70751CB5DDE317249834F4BD473FADDDFF0C4F0A25B9

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

 

# -------------------------------
# Malwarebytes AdwCleaner 8.3.2.0
# -------------------------------
# Build:    03-23-2022
# Database: 2022-08-22.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    09-08-2022
# Duration: 00:00:01
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   1


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\Users\Lavinia Zamfir\Documents\Coupons

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Not Deleted   searchenginewatch.com

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [2502 octets] - [08/09/2022 23:57:54]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

 

Shortcut.txt FRST.txt Addition.txt

Link to post
Share on other sites

Well done @leungalv.

MBAM has already deleted some elements of BitCoinMiner trojan.

 

Please run the following FRST fix as well as ESET. Thank you.

 

 

Step 1

  • Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\Lavinia Zamfir\Desktop\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  • Close all open programs and save your work.
  • Run FRST again.
  • Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
  • Please note: This Fix will remove all temporary files and empty recycle bin.
  • If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
  • FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
  • Please attach this logfile to your next reply.

 

 

Step 2

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

  • It will start a download of "esetonlinescanner.exe".
  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started. 
  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes.
  • When prompted for scan type, Click on Full scan
  • Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
  • Have patience.  The entire process may take an hour or more. There is an initial update download.
  • There is a progress window display.
  • You should ignore all prompts to get the ESET antivirus software program.  (e.g. their standard program). You do not need to buy or get or install anything else.
  • When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
  • Click The blue “Save scan log” to save the log.
  • If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  (in blue, at the bottom).
  • Press Continue when all done.  You should click to off the offer for “periodic scanning”.

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

 

 

 

fixlist.txt

  • Thanks 1
Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.