Crypto Address copy/paste virus

[hikmet111]

Hello, whenever I try to copy my Crypto address it pastes a wrong one.

[MKDB]

Hello @hikmet111  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please copy and paste all log files into your post.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

 

Step 1

• If you already have Malwarebytes Anti-Malware installed, then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed or if you don't run the newest version yet, please download it from here and install it.
• Once the MBAM dashboard opens, click on Settings (gear icon).
• Click on Security tab and make sure that all four Scan options are enabled.
• Close Settings and click on the Scan button on the dashboard.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
• If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run, then please skip to the next step and let me know in your next reply that the scanner would not run.

 

 

Step 2

Please download AdwCleaner and save it to your desktop.

• Double-click to run it.
• Accept the End User License Agreement.
• Click Scan Now.
• When finished, if items are found please click Next / Quarantine.
• Maybe your PC will be rebooted, AdwCleaner will be opened automatically.
• Click View Log File.
• AdwCleaner will open one log (AdwCleaner[Cxx].txt).
• Please attach the log to your next reply.

 

 

Step 3

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• If your computer language is other than English, right click on the FRST icon and rename it to FRST64english.
• Double-click to run it.
• If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option.
• When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• FRST will create two logs (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

[hikmet111]

Addition.txt AdwCleaner[C00].txt FRST.txt report.txt

[MKDB]

Thank you @hikmet111.

Please give me some time to review your log files.

[MKDB]

Please run the following steps and attach both logfiles @hikmet111.

Moreover, you have run ESET Online Scanner on your own. Please attach that logfile as well with your next answer.

Thank you.

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\HK\Downloads\Programs\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the FIX button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files and empty recycle bin.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

Step 2

Please follow these two instructions and reboot your system:

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

 

 

Step 3

Download Kaspersky Virus Removal Tool (KVRT) and save it to your Desktop.

• Select the Windows Key and R Key together, the Run box should open.
• Copy and paste the following string into the line:

C:\Users\HK\Desktop\KVRT.exe -dontencrypt

• Select „Ok“ in the Run box.
• If the „Windows protected your PC“ window opens, select „More info“. A new windows will open, select „Run anyway“.
• An EULA window from KVRT will open, tick all confirmation boxes then select "Accept".
• A window from KVRT will open, select "Change Parameters".
• In the new window ensure the following boxes are ticked:
  • System memory
  • Startup objects
  • Boot sectors
  • System drive

• Then select "OK" and „Start scan“.

• completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
• Usually, your system needs a reboot to finish the removal process.
• Logfiles can be found on your systemdrive (usually C: ), similar like this:

C:\KVRT2020_Data\Reports\report_<data>_<time>.klr

• Right click direct onto those reports, select > open with > Notepad.

Save the files and attach them with your next reply.

 

 

 

fixlist.txt

Edited March 21 by MKDB

[hikmet111]

After using FRST  i can cpoy and paste without any changes

 

Fixlog.txt

[MKDB]

@hikmet111

well done.

 

Please follow Steps 2 and 3 and report back.

Thank you!

[hikmet111]

report_2023.03.22_12.37.48.klr.txt

[MKDB]

Well done @hikmet111.

As a final step, please run SecurityCheck.

Thank you!

 

 

Step 1

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

• Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• If Microsoft SmartScreen blocks the download, click through to save the file
• This tool is safe.   Smartscreen is overly sensitive.
• If SmartScreen blocks the file from running click on More info and Run anyway
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[MKDB]

Hi @hikmet111,

do you still need help? If so, please follow my instructions and post the logfiles.

Thank you.

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.