Jump to content

Double clicked a .scr (screensaver) malware


Recommended Posts

Hello Malwarebytes team!

 

I write to ask for your help. I've received a fake e-mail which had a malware inside a .RAR file. Long story short, with social engineering I ended up downloading the file. It was a file that disguised itself as an adobe acrobat file, but it was a .scr (screensaver)
and I double-clicked it. Nothing happened, just the loading cursor icon for a few seconds. I realized it was a malware and deleted it, and had done many anti-virus scans from Malwarebytes, Kaspersky, Adwcleaner (malwarebytes software) and even MSERT. Adwcleaner found 13 harmful POP files which were removed. Now I re-scanned my PC many times, and the scans are coming back as clean, but I am afraid if the malware might somehow still be on my system, because I double-clicked it and I assume it ran. I have forwarded the e-mail to reportphishing@apwg.org.

 

Thank you, I await your answer with anticipation!

Best regards,

Sedge

Link to post
Share on other sites

Hello :welcome: 

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review. This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Link to post
Share on other sites

Curious question: Kaspersky Anti-Virus for ASUS Version: 16.0.1.445, is that a paid-for license subscription ? or else, did this Kasperky come pre-loaded from the factory when you bought the machine ?

Note, I am not seeing a blatent, obvious "infection" listed on the Farbar diagnostic report.
You have noted

Quote

had done many anti-virus scans from Malwarebytes, Kaspersky, Adwcleaner (malwarebytes software) and even MSERT. Adwcleaner found 13 harmful POP files which were removed. Now I re-scanned my PC many times, and the scans are coming back as clean

( 1 ) Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

( 2 ) This is more like some rechecking and housekeeping. It is not a "cure" of potential theft of credentials for "gmail".

Please run the following custom script. Read all of this before you start. Please Close all open work.

Farbar program :  is FRSTENGLISH.exe which is already on Downloads

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt < - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRSTENGLISH and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will reset the Winsock. It will attempt to do scans with Microsoft Defender antivirus. It will attempt to clear all Cache and history on web browsers. Depending on the speed of your computer this fix may take 50 minutes or more. 

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

Link to post
Share on other sites

  • 1 month later...

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.