windows malware infection

[tg88]

FRST.txtAddition.txtscan.txt

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/23
Scan Time: 1:08 PM
Log File: 7bc66a10-8a5b-11ed-890a-e884a5cbce55.json

-Software Information-
Version: 4.5.19.229
Components Version: 1.0.1860
Update Package Version: 1.0.64140
License: Trial

-System Information-
OS: Windows 10 (Build 19044.1766)
CPU: x64
File System: NTFS
User: DESKTOP-2CL8L9V\tomgr

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 356601
Threats Detected: 13
Threats Quarantined: 0
Time Elapsed: 1 min, 58 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 6
Trojan.MalPack.GO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\CHJubPBUwK, No Action By User, 6789, 1097822, , , , , , 
Trojan.MalPack.GO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{4D09CD94-E5E8-4882-864F-247595A4B853}, No Action By User, 6789, 1097822, , , , , , 
Trojan.MalPack.GO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{4D09CD94-E5E8-4882-864F-247595A4B853}, No Action By User, 6789, 1097822, , , , , , 
Trojan.BitCoinMiner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\GoogleUpdateTaskMachineQC, No Action By User, 556, 1047226, , , , , , 
Trojan.BitCoinMiner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{8C0D5396-F81C-4C4A-B3CD-DCD59A6EB26B}, No Action By User, 556, 1047226, , , , , , 
Trojan.BitCoinMiner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{8C0D5396-F81C-4C4A-B3CD-DCD59A6EB26B}, No Action By User, 556, 1047226, , , , , , 

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 7
Trojan.MalPack.GO, C:\WINDOWS\SYSTEM32\TASKS\CHJubPBUwK, No Action By User, 6789, 1097822, , , , , 069D21CACD509881445E3A635A21DF0A, 511BE898E0B658160648101FB9035409525BFE783509CB044F17F63C93C2D97D
Trojan.MalPack.GO, C:\USERS\LITTL\APPDATA\ROAMING\CHJUBPBUWK\SVCUPDATER.EXE, No Action By User, 6789, 1097822, 1.0.64140, 10D67D5EE8B4883A62B14127, dds, 02105481, 3AFB4573DEA2DBAC4BB5F1915F7A4DCE, 52901DC481D1BE2129725E3C4810AE895F9840E27A1DCE69630DEDCF71B6C021
Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\TASKS\GoogleUpdateTaskMachineQC, No Action By User, 556, 1047226, 1.0.64140, , ame, , 3BE04F9D7C5E70EFB96C0F37340C29AA, A494A4E3FA20889A159AA2DF83485B0A368453785DABACF2A488B24D389D621F
Malware.AI.463480657, C:\USERS\LITTL\APPDATA\ROAMING\GOOGLE\CHROME\UPDATER.EXE, No Action By User, 1000000, 463480657, 1.0.64140, 00000000000004881BA02751, dds, 02105481, 8BD82C462DF24FF04F8B5B0506C0DD8C, 0351E43E4A275D2B6D7AD7B1F3A4788885B8979EB47DACCEAE757F82DBFFB6D6
Trojan.MalPack.GO, C:\USERS\LITTL\APPDATA\LOCAL\TEMP\SMART.EXE, No Action By User, 6789, 1097822, 1.0.64140, 10D67D5EE8B4883A62B14127, dds, 02105481, 3AFB4573DEA2DBAC4BB5F1915F7A4DCE, 52901DC481D1BE2129725E3C4810AE895F9840E27A1DCE69630DEDCF71B6C021
Malware.AI.463480657, C:\USERS\LITTL\APPDATA\LOCAL\TEMP\NETSVC4.EXE, No Action By User, 1000000, 463480657, 1.0.64140, 00000000000004881BA02751, dds, 02105481, 8BD82C462DF24FF04F8B5B0506C0DD8C, 0351E43E4A275D2B6D7AD7B1F3A4788885B8979EB47DACCEAE757F82DBFFB6D6
Malware.AI.3331930301, C:\USERS\LITTL\ONEDRIVE\DESKTOP\STUFF\GALAXYSWAPPERV29.04.27\GALAXYSWAPPERV29.04.27.EXE, No Action By User, 1000000, -963036995, 1.0.64140, 7298F649C90887EEC69938BD, dds, 02105481, 03959112F0C1701AB3A3CF17A1909FE2, D3E84AFBC6A31C732DA5DEE4BF1DA9683DC70B562D073352EED1BAFDA5EBD98A

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Maurice Naggar]

Hello  

There are several line items detected that show that you did not "select" all detections for "removal". See all the many lines marked "No action by user".

In this case, the first thing that needs to be done is to rest the HOSTS file to normal default settings. See this link on how-to

 

Below here, I list how to remedy all that ! I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use this Guide

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan.

Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

As a next step, I suggest the following:

This is for a scan with ESET Onlinescanner (free). ESET is a well-respected, well-known entity and tool.

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run.

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on FULL scan  
• Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"
• and click on Start scan button.

Have patience. The entire process may take an hour or more. There is an initial update download.
There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours.

• At screen "Detections occurred and resolved" click on blue button "View detected results"
• On next screen, at lower left, click on blue "Save scan log"
• View where file is to be saved. Provide a meaningful name for the "File name:"
• On last screen, set to Off (left) the option for Periodic scanning
• Click "save and continue"
• Please attach the report file so I can review

Edited January 2, 2023 by Maurice Naggar
added note

[Maurice Naggar]

There are 2 categories of malware identified by Malwarebytes. Trojan.MalPack.GO and Trojan.BitCoinMiner.
"Trojan.Malpack" is defined here https://www.malwarebytes.com/blog/detections/trojan-malpack
"Trojan.BitCoinMiner" here https://www.malwarebytes.com/blog/detections/trojan-bitcoinminer

There are 7 files identified as threats, and, 6 line entries in the system registry. I will be looking for the report from new scan with Malwarebytes, plus, the result-report after completion of the ESET scan run.

[Maurice Naggar]

In this case, the first thing that needs to be done is to rest the HOSTS file to normal default settings. See this link on how-to

[Maurice Naggar]

Hello @tg88. Good morning. This is the next procedure.
 
Please run the following custom script. Read all of this before you start. Please Close all open work.

Once the script-run has been completed, please attach the file FIXLOG.TXT to your next reply

 

Farbar program location:   C:\Users\tomgr\Downloads\FRST64.exe

 

Please download the attached fixlist.txt file and save it to C:\Users\tomgr\Downloads

Fixlist.txt

 

NOTE. It's important that both files, FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run  FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  Depending on the speed of your computer this fix may take 30 - 40 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with net reply.

[Maurice Naggar]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks