Malwarebytes Reporting Riskware through Powershell

[Exthax]

Hi,

So it's been a day that i have recurrent riskware detection from the powershell. Tried scanning and all but malwarebytes can't find the rogue task. And i've found that thread : 

 I have exactly the same issues (wmail-chat.com Outbound connection). But all the links are unavailable so i can't use them. If someone could just give the custom script so i can get rid of that riskware.
 

Thanks a lot

Here is my report : 

 

Malwarebytes
www.malwarebytes.com

-Détails du journal-
Date de l'événement de protection: 18/11/2022
Heure de l'événement de protection: 12:03
Fichier journal: aaf95020-6730-11ed-81f3-80325303deae.json

-Informations du logiciel-
Version: 4.5.17.221
Version de composants: 1.0.1806
Version de pack de mise à jour: 1.0.62452
Licence: Premium

-Informations système-
Système d'exploitation: Windows 10 (Build 19044.2251)
Processeur: x64
Système de fichiers: NTFS
Utilisateur: System

-Détails du site Web bloqué-
Site Web malveillant: 1
, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Bloqué, -1, -1, 0.0.0, , 

-Données du site Web-
Catégorie: Cheval de Troie
Domaine: wmail-chat.com
Adresse IP: 193.239.84.207
Port : 80
Type: En sortie
Fichier: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

(end)

[1PW]

Hello @Exthax and :

 While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run one or more of its following procedural steps, please carefully follow the instructions within the following:

I am infected - What do I do now?

  Remember, please be certain to attach (not Copy and Paste) the three (3) resultant report files in your next reply to this topic.

Thank you.

[Exthax]

Malwarebytes analyse 221118 12h48.txt 

Here is all the files that you need i think

Addition.txt FRST.txt

[Exthax]

I've managed to delete it with Kaspersky Virus Removal Tool by doing an full full scan. So it's all good for me thx

[AdvancedSetup]

So you're all set now @Exthax

 

[Exthax]

Yes exactly. I don't know if it's me that have to close the thread or it's you (if it's me i don't know how). Thanks again and have a nice week end

[AdvancedSetup]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks