Jump to content

Hijack.AutoConfigURL.PrxySvrRST + Backdoor.Farfli


Recommended Posts

After running a scan and quarantining, several items keep coming back after the requested restart by the app for the removal process. It appears I have been affected by a Trojan of sorts and even after quarantining the items, I keep getting pop-ups from the Malwarebytes app informing that different websites are being blocked due to either Riskware or Trojan, all coming from C:\Windows\System32\svchost.exe . I have tried using other anti-virus/malware protection methods but they don't seem to detect anything at all. I'm looking for advice on how to remove the seemingly unremovable items and stop having the malware attempt to access various websites.

 

image.png

image.png

trolled.txt

Link to post
Share on other sites

Hello @Destro and :welcome::

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, please carefully follow these instructions:

  1. Download the Malwarebytes Support Tool.
  2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
  3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
  4. Run the MBST Support Tool.
  5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
  6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
  7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file in your next reply to this topic.

Thank you.

Link to post
Share on other sites

As requested by the reply above, I have ran the Malwarebytes Support Tool. You will find that I have attached 2 mbst-grab-results.zip folders, one was made as soon as I restarted my computer, the other one was when I tried scanning and quarantining the items on my device, although I am not sure how much of a difference it is between the 2.mbst-grab-results pre quarantine.zipmbst-grab-results.zip

  • Thanks 1
Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

 

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use this Guide

I will be posting the steps / action to take after this. Please wait.

Edited by Maurice Naggar
Link to post
Share on other sites

Hello. @Destro Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Then click the Security tab.  Scroll down and lets be sure the line in SCAN OPTIONs for

"Scan for rootkits" is ON 👈   Click it to get it ON if it does not show a blue-color .
 

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

MB4_scan_tick_ALL.jpg.d5c4071c62ed66534301fbb217b93bc0.jpg

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.6c45445994d4125c0b617ac7c5551e03.jpg

 


Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Link to post
Share on other sites

I did the scans and quarantine as was stated on all of my previous attempts, with the exclusion of "Scan for rootkits" option. I did enable it just now, ran the scan again, but it does not detect anything new in the rootkits, I still get the same items from the memory scan. Before restarting, I tried running another scan after the initial scan and quarantine of the 10 items, and it usually seems to end up detecting around 3 or 5 new items, after quarantining those and running yet another scan, Malwarebytes does not detect anything new, but the website blocks still keep happening. Every time after pressing Yes on the image posted below and restarting my computer, all of the things mentioned previously come back up again, meaning that none of quarantined items were able to removed during the restart.

image.png

Scan Report.txt Scan Report after restart.txt Scan Report after quarantine.txt

Link to post
Share on other sites

Hi, Thanks.
There is a sticky persistent "goober" on this system. Much patience is needed. There is not a magical single-shot quick fix.
The "Block" notice (s) are keeping the machine safe from  further harm.
 
I will custom guide you. We will be doing several things, over a few different passes. Please have lots of patience.
This next part is just the next pass. It will not take a whole lot of time. It should be under 15 minutes or even less.
Just only do this, and report back with the log, and kindly, please, wait for next reply from me.

Let's do one special run  with Malwarebytes Adwcleaner. 
 
It will not take much time, Read over all lines before starting so that you have a good understanding of the whole method. Take your time and go careful. I ant to make sure you select all of what I list below - before- pressing the "scan" button.
 
First download & save it
 
Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. There are a few first choices to set as I have listed below.
 
Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.
 
When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status
Delete IFEO keys
Delete tracing keys
Delete Prefetch files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock
Reset HOSTS file
 
ADW-s-1.png.c32838f45f840beb2b835ad51f0a1b7c.png
 
 
ONLY after you have set the selections above ....only after that .....
Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.
 
 
 
This can take several minutes.
When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.
 
AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean.
Click on the “Continue” button to finish the removal process.
 
 
 
Attach the clean log from Adwcleaner when all completed. There is much more to do even after this.
Edited by Maurice Naggar
Link to post
Share on other sites

  • AdvancedSetup changed the title to Hijack.AutoConfigURL.PrxySvrRST + Backdoor.Farfli

I have done every step as listed above. One odd thing I want to point out is that after the scans with AdwCleaner it notes that it detects more items than are shown in the items tab of the app itself, an example is shown in the image below. I want to ask if this an unusual occurrence or not? There also doesn't seem to be a difference in the detected items if I do the scan pre or post Malwarebytes app scan and quarantine, suggesting that the AdwCleaner detects completely different items (various Lenovo software items it looks like) in comparison with Malwarebytes. I have also put out multiple logs of the subsequent scans and quarantines I ran as it seems that one of the items is unable to be cleaned with each concurrent reboot, as shown in the AdwCleaner[C02-04] logs:

Cleaning failed   C:\Windows\LENOVO\IMCONTROLLER

OnPaste.20230116-101744.png

AdwCleaner[C00].txt AdwCleaner[C01].txt AdwCleaner[C02].txt AdwCleaner[C03].txt AdwCleaner[C04].txt

Link to post
Share on other sites

Hello. Got your Adwcleaner logs. We only needed just 1 run. ( In future, do not run a tasked-run more than one time, without first asking me about it. The main thing we wanted from the Adwcleaner is the special-section cleanup.
The removal of manufacturer add-ons ( Lenovo ) are add-ons that the system does not needed. We are done with Adwcleant.
 
Now we need to do a significant special-custom cleanup run. This machine still has a persistent, pesky malware infection.
 

Please run the following custom script. Read all of this before you start. Please Close all open work.

Once the script-run has been completed, please attach the file FIXLOG.TXT to your next reply

 

Farbar program location:   C:\Users\Vartotojas\Downloads\FRSTEnglish.exe

 

Please download the attached fixlist.txt file and save it to C:\Users\Vartotojas\Downloads

Fixlist.txt

 

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run  FRSTENGLISH and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run scans with MD Defender antivirus. Depending on the speed of your computer this fix may take 30 minutes or more. It will remove all Windows firewall permissions.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with net reply.

Link to post
Share on other sites

Alright. Thank you for the log. Windows System File Checker / Windows Resource Protection found corrupt files and successfully repaired them.
I am going to list here a few next steps. Just remember to have patience & the fact that we will be needing to run a serious of different scans.

Step 1
Next action step:
Disable ( turn OFF ) Fast Startup

https://www.windowscentral.com/how-disable-windows-10-fast-startup

Then restart the computer
Step 2
Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use this Guide

Step 3
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>
Step 4

This next tool ought to take something in the range of 15 - 25 minutes tops, depending on hardware speed.
get & run the Malwarebytes MBAR anti-rootkit tool to do 1 run with it.
Disregard the title subject of the topic.Run the MBAR tool as listed here 

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes

  • when done, I need the MBAR logs.
  • Upon completion of the scan or after the reboot, two files named mbar-log.txt and system-log.txt will be created.
  • Both files can be found in the extracted MBAR folder on your Desktop.
  • Please attach both files in your next reply.

 

Step 5

This is for a scan with ESET Onlinescanner (free). ESET is a well-respected, well-known entity and tool.

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run.

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on FULL scan  
  • Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"
  • and click on Start scan button.

Have patience. The entire process may take an hour or more. There is an initial update download.
There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours.

  • At screen "Detections occurred and resolved" click on blue button "View detected results"
  • On next screen, at lower left, click on blue "Save scan log"
  • View where file is to be saved. Provide a meaningful name for the "File name:"
  • On last screen, set to Off (left) the option for Periodic scanning
  • Click "save and continue"
  • Please attach the report file so I can review
Edited by Maurice Naggar
Link to post
Share on other sites

There seems to be a persistent trojan that keeps reappearing in new guises. Please do not do any web surfing. No banking. No shopping. I want you to re-run a special run with Malwarebytes again. Launch Malwarebytes. 

click the Security tab.  Scroll down and lets be sure the line in SCAN OPTIONs for

"Scan for rootkits" is ON 👈   Click it to get it ON if it does not show a blue-color .
 

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

MB4_scan_tick_ALL.jpg.d5c4071c62ed66534301fbb217b93bc0.jpg

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.6c45445994d4125c0b617ac7c5551e03.jpg

 


Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

Link to post
Share on other sites

I have done the scan and quarantine with the reboot. It seems that the mbar anti-rootkit app has managed to clean half of the items that kept reappearing in malwarebytes, including the file that was located in the System32 folder. However, judging by the new Malwarebytes scan logs, it seems that some items still pop-up in the scan after the quarantine and reboot from Malwarebytes app. 

Scan report 1.txt Scan report 2.txt

Link to post
Share on other sites

Also the pop-up from the Malwarebytes app saying that a website has been blocked is limited to only 1 address instead of the usual 3, but instead of the file being svchost.exe, instead it is coming from brave.exe, the browser I'm using to write these replies from my device.

OnPaste.20230116-183605.png

Link to post
Share on other sites

Do not freak out about the "Block" notices from Malwarbytes. Even with Malwarebytes in Trial-mode, it is keeping your computer safe from worse harm. Just let the block notice time-out, or else just hit the X button to Close that mini-window.
I do not need any more screen-grabs of the "Block" window.
BY THE WAY, if you could, please force a CLOSE / EXIT all the way out of BRAVE. ONLY use the EDGE web browser going forward.

The Block notice is not the enemy. The enemy are the trojans on-board that keep changing.

See the article titled

Run Farbar Recovery Scan Tool - FRST from Recovery Mode on Windows 10


Guide article

In short summary:
Make a USB-flash with the Media creation tool for Windows 10 from Microsoft.
Add to that USB the Farbar FRST64
reboot / restart the machine so that it gets to the "Windows Recovery Environmet"


You need a USB-flash-thumb drive of at least 8 GB capacity. One that is re-usable or new. It will be over-written, so it must be one USB that has nothing of permanent value to you. And then this USB ( after it has been populated by the Media Creation Tool from Microsoft) it will be something you want to keep and protect.
Before you insert this USB into the computer, be sure to press and Hold the SHIFT-key on keyboard during the moments when inserting it into USB drive. Remember this.

See and study and understand the whole article above. So that you know what is involved.
With the Media Creation tool from Microsoft you will make the contents onto the USB-flash.
You will then download and SAVE a copy of Farbar FRST64 onto the same USB. Be sure to remember where you saved it on that USB.

I need you to do that, so we can have a new report from FRST64 ( that hopefully shows all details on the current system.)
One other thing to point out,
When the system display shows on the monitor

x:\sources


that is when you know that you have the machine in the "Windows Recovery Environment"

Link to post
Share on other sites

42 minutes ago, Maurice Naggar said:


BY THE WAY, if you could, please force a CLOSE / EXIT all the way out of BRAVE. ONLY use the EDGE web browser going forward.

It seems that whenever I open up the browser, the trojan wants to access some site, and it's not exclusive with Brave, as it happens when I open the Edge web browser as well, even showing the file to be edge.exe

45 minutes ago, Maurice Naggar said:

 

The Block notice is not the enemy. The enemy are the trojans on-board that keep changing.

Yes, I completely understand that, I was just trying to point out the behavior of the malware.

 

I have completed the steps that were shown in the article, the FRST.txt is posted down below

FRST.txt

Link to post
Share on other sites

I can see that the report was run while in Windows Recovery Environment. That the USB with the Media Creation was drive D at that time.
BUT
A C drive is shown with the volume-label BOOT but is only 0.5 GB in size
and the contents of the FRST64 report is very very short.

Let us go ahead, and remove/ unplug  the USB-flash-drive, put it away, and keep it safe.
POWER OFF the machine.

wait for like one minute. Then power ON and let Windows load up as per normal.
Then get a new report. 

Your machine has the FRSTENGLISH report tool on the Downloads folder. We will use that. Go to Downloads folder. RIGHT-click on FRSTENGLISH and select 

Run as Administrator

and tap ENTER. And reply YES to allow to proceed.  

  •  When the tool opens click Yes to the disclaimer.  And be very sure to TICK the box for Addition.txt
  • Press the Scan button.

_frst_scan.jpg

  • It will make a log (FRST.txt & Addition.txt) in the same directory the tool is run
  • Have patience since the run may take something like 10 or so minutes  (less depending on your hardware speed)
  • Close Notepad IF those show up on Notepad.
  • Just please Attach the 2 files FRST.txt +Addition.txt  with your next reply.
Link to post
Share on other sites

Thank you. Let’s do a special search.
We need to search for a few things with SystemLook:
Please download SystemLook (64-bit) by jpshortstuff and save it to your desktop
http://images.malwareremoval.com/jpshortstuff/SystemLook_x64.exe

Right-click SystemLook_x64.exe and select Run as Administrator to start the tool.
If prompted by Windows  UAC, please allow it  to run.
If you receive an "Open file - security warning"... asking "Do you want to run this file?", press the Run button.COPY & paste the entire text into the main text box of SystemLook:
  
 

:regfind
appservice
nlasvc
:filefind
appservice
c:\windows\system32\*.tmp
:service
appservice
nlasvc
:folderfind
appservice

Click the Look button to start the scan
When finished, a notepad window will open with the results of the scan.
A file will be created (on the same folder where you saved SystemLook with the results of the scan, named SystemLook.txt
Please attach  this log in your next reply.

Edited by Maurice Naggar
modified
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.