Jump to content

How to remove Trojan.Glupteba.Bitsrst & Trojan.Ranumbot because keep coming


Go to solution Solved by Maurice Naggar,

Recommended Posts

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/7/23
Scan Time: 11:49 PM
Log File: 39062ca2-d564-11ed-88d1-00ff2c75bdee.json

-Software Information-
Version: 4.5.25.256
Components Version: 1.0.1957
Update Package Version: 1.0.67683
License: Free

-System Information-
OS: Windows 10 (Build 19045.2788)
CPU: x64
File System: NTFS
User: DESKTOP-226FP85\Rahmat Family

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 646305
Threats Detected: 41
Threats Quarantined: 0
Time Elapsed: 15 hr, 32 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 41
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, No Action By User, 12490, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe, No Action By User, 12490, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet, No Action By User, 12490, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc, No Action By User, 12490, 781248, 1.0.67683, , ame, , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe\Protection Dir, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb, No Action By User, 13103, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss, No Action By User, 13103, 995472, 1.0.67683, , ame, , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, No Action By User, 12490, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe, No Action By User, 12490, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet, No Action By User, 12490, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc, No Action By User, 12490, 781247, 1.0.67683, , ame, , , 

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

Later, we will do a new proper scan with Malwarebytes. But for this one time, do the following.

This next tool ought to take something in the range of 15 - 25 minutes tops, depending on hardware speed.
get & run the Malwarebytes MBAR anti-rootkit tool to do 1 run with it.
Disregard the title subject of the topic.Run the MBAR tool as listed here 

https://forums.malwarebytes.com/topic/198907-requested-resource-is-in-use-error-unable-to-start-malwarebytes

  • when done, I need the MBAR logs.
  • Upon completion of the scan or after the reboot, two files named mbar-log.txt and system-log.txt will be created.
  • Both files can be found in the extracted MBAR folder on your Desktop.
  • Please attach both files in your next reply.

 

Link to post
Share on other sites

Hello. Thank you for the MBAR reports. I do hope that you did do a Windows RESTART since after running the MBAR tool. It had some cleanup work to do that required a Restart of Windows.

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes sca

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

MB4_scan_tick_ALL.jpg.d5c4071c62ed66534301fbb217b93bc0.jpg

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.6c45445994d4125c0b617ac7c5551e03.jpg

 


Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

😉

Link to post
Share on other sites

yes, i have restarted my pc

here you goo

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/11/23
Scan Time: 3:47 AM
Log File: ddcb776e-d7e0-11ed-8767-00ff2c75bdee.json

-Software Information-
Version: 4.5.25.256
Components Version: 1.0.1957
Update Package Version: 1.0.67833
License: Free

-System Information-
OS: Windows 10 (Build 19045.2788)
CPU: x64
File System: NTFS
User: DESKTOP-226FP85\Rahmat Family

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 322281
Threats Detected: 41
Threats Quarantined: 41
Time Elapsed: 17 min, 38 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 41
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, Quarantined, 12481, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe, Quarantined, 12481, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet, Quarantined, 12481, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\USERS\RAHMAT FAMILY\APPDATA\ROAMING\EPICNET INC, Quarantined, 12481, 781247, 1.0.67833, , ame, , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, Quarantined, 12481, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe, Quarantined, 12481, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet, Quarantined, 12481, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\USERS\RAHMAT FAMILY\APPDATA\LOCAL\EPICNET INC, Quarantined, 12481, 781248, 1.0.67833, , ame, , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe\Protection Dir, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb, Quarantined, 13094, 995472, , , , , , 
Trojan.Ranumbot, C:\USERS\RAHMAT FAMILY\APPDATA\LOCAL\TEMP\CSRSS, Quarantined, 13094, 995472, 1.0.67833, , ame, , , 

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first
https://definitionupdates.microsoft.com/download/DefinitionUpdates/safetyscanner/amd64/MSERT.exe

Upon completion of the save, Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.


This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

It is normal for the Microsoft Safety Scanner to show 'detections' during the scan process on the screen itself.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Link to post
Share on other sites

Hello. Thank you for the MSERT log. The Safety Scanner did not find a actual infection or malware. But it did correct one setting for Windows Defender for the anti-spyware protection. It has re-enabled the anti-spyware protection. As a next step, I suggest the following:

This is for a scan with ESET Onlinescanner (free). ESET is a well-respected, well-known entity and tool.

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run.

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"

  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started.

 

  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes
  • When prompted for scan type, Click on CUSTOM scan  and select C drive to be scanned
  • Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"
  • and click on Start scan button.

Have patience. The entire process may take an hour or more. There is an initial update download.
There is a progress window display. You may step away from machine &. Let it be. That is, once it is under way, you should leave it running. It will run for several hours.

  • At screen "Detections occurred and resolved" click on blue button "View detected results"
  • On next screen, at lower left, click on blue "Save scan log"
  • View where file is to be saved. Provide a meaningful name for the "File name:"
  • On last screen, set to Off (left) the option for Periodic scanning
  • Click "save and continue"
  • Please attach the report file so I can review
Link to post
Share on other sites

This here is for AFTER you have finished all the tasks listed from before  (which I had listed on my earlier reply above)
First, please be sure to EXIT out / Close any open work you may have open at this point. We want the next runs to have sole use.

Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

I would like you to run a custom cleanup script that will do the following
look for any remains of the EpicNet pest & if found cleanup the folder remains
cleanup a specific sub-folder of user-TEMP folder that has / or may have other associated threats
it will do housekeeping to empty out temporary file areas
It will attempt to do 3 scans with Windows Defender antivirus to check for trojans & viruses
It will set Windows Defender to best setting for security.
It will make a log file on the Desktop named Klearemlog.txt

Save the attached zip file to your system. If possible save it to the Desktop.

Klearem.zip < --- -
Then with File Explorer find the Klearem.zip

Next, with that zip file, Extract all content to the Desktop

Then with File Explorer, go to Klearem.txt and do a RIGHT-click with the mouse & select

Rename


and rename it to

Klearem.ps1

Once that is confirmed, then do a RIGHT-click on

Klearem.ps1

& select the option

Run with Powershell

.
It will / should display as the 2nd choice on the option menu. Pick "Run with Powershell" and tap Enter.

Next, you may be questioned with "Execution Policy Change" prompt. If so, respond with/ type  

Y

and tap Enter.
From then on, the script will automatically run.
When it has finished you should see a on-screen display

End of run. Please look for 'Klearemlog.txt' on the Desktop. Press Enter to exit

Next step right after that, please

I would like a report set for review. This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply.

Also look on the Desktop for file named

Klearemlog.txt

Attach that too with your reply. Thank you. Sincerely..

Edited by Maurice Naggar
Link to post
Share on other sites

The ESET onlinescanner found & removed 14 threats. 9 of those were in the Recycle bin. 
2 P U P s were in the Chrome cache. Overall, a lot of the whole bunch were downloaded copies of LDPlayer 4 & LDPLAYER 9.
Please STOP downloading games or anything else that are "tempting stuff" off the internet.

I would urge you highly to stay far away from hack / cracked software of any sort. Whether a so called free program or free game, or whatever.
Hidden risks in pirated software
https://news.microsoft.com/apac/2019/01/08/hidden-risks-in-pirated-software/

Why You Shouldn't Use Pirated Software
https://www.computer.org/publications/tech-news/trends/why-you-shouldnt-use-pirated-software

Torrenting & filesharing. Try to not do that, as a general security matter. All it takes is one malicious file to lead to tragedy & loss.
https://informationsecuritybuzz.com/articles/torrenting-know-risks-take/

DON'T FALL FOR THE MONEY-SAVING LURE OF CRACKED SOFTWARE
https://scambusters.org/crackedsoftware.html

I note, unfortunately, that the recent Malwarebytes scan of 2023-04-10   T20:47:11Z  found threats.
I appreciate your sending the reports & log. I will have a new other procedure for you soon.
Meanwhile, please do this run. Now a different scan with another security scanner. 

This with Kaspersky KVRT tool.

Download Kaspersky Virus Removal Tool (KVRT) from here: https://www.kaspersky.com/downloads/thank-you/free-virus-removal-tool and save to your Desktop.

Next, Select the Windows Key and R Key together, the "Run" box should open.

user posted image

Drag and Drop KVRT.exe into the Run Box.

user posted image

C:\Users\Rahmat Family\DESKTOP\KVRT.exe will now show in the run box.

user posted image

add
-dontencrypt

Note the space between KVRT.exe and -dontencrypt

C:\Users\Rahmat Family\DESKTOP\KVRT.exe -dontencrypt 

should now show in the Run box.

user posted image

That addendum to the run command is very important.


To start the scan select OK in the "Run" box.



The Windows Protected your PC window "may" open, IF SO then select "More Info"

user posted image

A new Window will open, select "Run anyway"

user posted image

A EULA window will open, tick both confirmation boxes then select "Accept"

user posted image

In the new window select "Change Parameters"

user posted image

 
  • In the new window ensure the following boxes are ticked:
    • System memory
    • Startup objects
    • Boot sectors
    • System drive
  • Then select "OK" and „Start scan“.

The Kaspersky tool is very thorough so will take a considerable time to complete, please allow it to finish. Also while Kaspersky runs do not use your PC for anything else..

  • completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
  • Usually, your system needs a reboot to finish the removal process.
  • Logfiles can be found on your systemdrive (usually C: ), similar like this:

Reports are saved here C:\KVRT_data\Reports and look similar to this report_20230412_103000.klr

  • Right click direct onto those reports, select > open with > Notepad.
  • Save the files and attach them with your next reply
Link to post
Share on other sites

Hello. Thank you. The Kaspersky KVRT result is perfectly fine. No threats detected. 

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

Link to post
Share on other sites

this is with Malwarebytes scan

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/15/23
Scan Time: 3:48 AM
Log File: c81850ae-db05-11ed-953b-00ff2c75bdee.json

-Software Information-
Version: 4.5.26.259
Components Version: 1.0.1976
Update Package Version: 1.0.68023
License: Free

-System Information-
OS: Windows 10 (Build 19045.2846)
CPU: x64
File System: NTFS
User: DESKTOP-226FP85\Rahmat Family

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Cancelled
Objects Scanned: 266310
Threats Detected: 41
Threats Quarantined: 41
Time Elapsed: 22 min, 59 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 41
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, Quarantined, 12469, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe, Quarantined, 12469, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Roaming\EpicNet Inc\CloudNet, Quarantined, 12469, 781247, , , , , , 
Trojan.Glupteba.BITSRST, C:\USERS\RAHMAT FAMILY\APPDATA\ROAMING\EPICNET INC, Quarantined, 12469, 781247, 1.0.68023, , ame, , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe\Protection Dir, Quarantined, 12469, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet\cloudnet.exe, Quarantined, 12469, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\Users\Rahmat Family\AppData\Local\EpicNet Inc\CloudNet, Quarantined, 12469, 781248, , , , , , 
Trojan.Glupteba.BITSRST, C:\USERS\RAHMAT FAMILY\APPDATA\LOCAL\EPICNET INC, Quarantined, 12469, 781248, 1.0.68023, , ame, , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe\Protection Dir, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxscan-1003-2.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\obfs4proxy.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64install_in.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\winboxls-1008-2.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor\tor.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd\i2pd.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\tor.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\scheduled.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\cloudnet.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb\e7.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\lsa64.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy\Tor, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\mrt.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\al.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\vc.exe, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\proxy, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\i2pd, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\Users\Rahmat Family\AppData\Local\Temp\csrss\smb, Quarantined, 13082, 995472, , , , , , 
Trojan.Ranumbot, C:\USERS\RAHMAT FAMILY\APPDATA\LOCAL\TEMP\CSRSS, Quarantined, 13082, 995472, 1.0.68023, , ame, , , 

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

Please run the following custom script. Read all of this before you start. Please Close all open work.

Farbar program :  is FRSTENGLISH.exe which is already on Downloads

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . 

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will reset the Winsock. It will attempt to do scans with Microsoft Defender antivirus. It will attempt to clear all Cache and history on web browsers. Depending on the speed of your computer this fix may take 50 minutes or more. 
The system will be rebooted after the fix has run.

Attach FIXLOG.txt with next reply.

Link to post
Share on other sites

Thank you for the report. This will be a short quick new run.

Please run the following  NEW custom script. Read all of this before you start. Please Close all open work.

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . 

Note: If the tool warned you about an outdated version please download and run the updated version.

Attach FIXLOG.txt with next reply.

Edited by Maurice Naggar
Link to post
Share on other sites

Thanks. 

Next action step:
Disable ( turn OFF ) Fast Startup

https://www.windowscentral.com/how-disable-windows-10-fast-startup
Then restart the computer.  Settings >> Shutdown >> Restart

This Windows system is reported to have installed Kaspersky Total Security 21.3

Therefore, Launch Kaspersky Total Security & do a Full scan

Link to post
Share on other sites

It is great to see that K T S reports 

No threats

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

Link to post
Share on other sites

Thanks. Adwcleaner run is very, very beneficial. It removed a threat sub-folder  named C:\Windows\rss

Dr.Web CureIt is a free stand-alone tool to check for viruses, trojans, and other malware.

At the initial link you will need to consent to their terms and provide a email address ( to which they send you a download link.)

Link for Dr.Web CureIt . 

You will need to provide a email address & tick the box to agree to their terms. you may abbreviate your name on box for first name, last name. Do provide a valid email address because the download link will be emailed to it.

Once you get a Email from Dr.Web and see the download link, click it to begin. Then on next prompt agree to terms & Download.

drweb1.png.0085a5448973b303da323fb7d2e900b4.png
The download is nearly 265  MB in size. The EXE file will have a series of random letters-number.

IF Edge or Windows Smartscreen prompts you at the download, select KEEP and be sure to SAVE

 

After the download is completed, then close the browser and all other web browsers too.

Use the Windows File Explorer to go to the Downloads folder.

doubleclick on  the download file file to start the tool.     ( drweb will randomize the name of the file when you download it )


⦁    You will see a screen similar to this:

 

drweb2.png.2d58001af661cd95da8669f8ed5f4bc5.png
 
Click the checkboxes to participate & consent, and then click on Continue button.


⦁    Next

 

drweb3.png.e1d9f25bfd74c215ef03705d1a7991ee.png
 
Click on Select objects for scanning
⦁    Next

drweb4.png.c4945d2d713c2bd965377a75ba6f9d67.png
 
Put a checkmark by clicking on all the boxes    EXCEPT for

"Temporary files"

"System restore points"


Do not select Temporary files or System Restore points.


Then click on Start scanning button

⦁    The scan in progress will be shown like this

drweb5.png.4f7449b49a4666b101c4d5078d815f9a.png

 


⦁    IF something is detected, you will see a screen similar to this

 

image.png.75d975285e7cd0b1ea4d39b61fca8f9a.png


 
For each item "detected", click on the Action column down arrow, like this
 

image.png.5c1e515f37a43ca9a954c0ee5f4b0f4c.png

Your options will be Cure or Ignore

IF you see an item that you are very sure is ok, then un-check the checkbox for that item.
Typically, you will keep the Cure default.

Then click on the Neutralize button.

 

⦁    When the actions are completed, you will see this

image.png.248b34e853c772318a415fb88ef452b4.png


 
⦁    Click on the green Open Report line. It will pop-up the report in NOTEPAD.
Save the report to your desktop. The report will be called Cureit.log
⦁    Close Dr.Web Cureit. 
⦁    Reboot your computer to allow files that were in use to be moved/deleted during reboot. 
⦁    After reboot, attach the log Cureit.log you saved previously in your next reply. 

 

Have patience in all this

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.