Trojan detected by Malawarebytes

[henrymurray]

Hi,

I have Malawarebytes on my PC, not the live paid version. I ran a scan on 30th June and it showed 

Generic Trojan Agent DDS - 6/30/23 12.09 pm - File - C:Users\13103\Downloads\SetupAI_1.14.exe

and I Quarantined it which it say no longer poses a threat. I don't know when it was downloaded. I haven't had any noticeable problems except, before the scan my computer may have shut off once whilst it was running on low power.  Will you suggest how I should proceed now please?

Thank you, Henry.

 

[Porthos]

6 minutes ago, henrymurray said:

Will you suggest how I should proceed now please?

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility or its subsets, please carefully follow these instructions:

 

WARNING: Do Not click the Repair System under Advanced unless requested by a Malwarebytes support agent or authorized helper

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent.

Thank you.

[henrymurray]

I'm running the tool - it says click whether I have an open support ticket or not. Is this an open support ticket or can I just ignore that and just run the Advanced options - Gather Logs

[Porthos]

Just now, henrymurray said:

can I just ignore that and just run the Advanced options - Gather Logs

Yes just gather logs.

[AdvancedSetup]

Hello  and      @henrymurray

 

My screen name is AdvancedSetup and I will assist you with your system issues.

It's past midnight for me and tomorrow is a Federal Holiday in the USA so I'm not officially working, but will do my best to reply as quick as I can.

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow all steps in the provided order and post back all requested logs
• Please attach all log files to your post, unless otherwise requested
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
• Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
• Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim.
• Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections.
• If there are any on the system you should uninstall them before we proceed.
• Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
• If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

Please attach the logs as requested by @Porthos

 

[henrymurray]

Here is the gather logs file:

I also have a file download notification a minute after I downloaded the mb_support file It is named FRSTEnglish.exe is that OK?

mbst-grab-results.zip

[Porthos]

Just now, henrymurray said:

I also have a file download notification a minute after I downloaded the mb_support file It is named FRSTEnglish.exe is that OK?

That is part of the tool.

[Porthos]

@henrymurray Could you please restart the computer.

Quote

Pending Windows Update Reboot
==================================
A reboot is pending

 

Edited July 4, 2023 by Porthos

[henrymurray]

Hi AdvancedSetup,

I am in the US too. Happy 4th July.

Which log files do you refer to that need to be attached. Is that just the gather Logs file which I have posted above? I didn't turn off the Windows Defender when I downloaded them.

I have an external hard drive I can download to. What do you mean by Private Data? Is that just all my files?

I don't have any Cracked, Hacked, or Pirated  programs that I know of. I suspect the download may have come from an attachment from an Indian SEO company my client has just started using. I am a web designer.

Should I avoid making any payments from my computer in the meantime?

Thank you for your help despite the holiday.

Henry.

 

[henrymurray]

Porthos,

What is the reason to restart the computer? Do I need to look for anything in particular when it does?

Henry.

[Porthos]

4 minutes ago, henrymurray said:

What is the reason to restart the computer?

Your log showed a restart is pending/required.

4 minutes ago, henrymurray said:

Do I need to look for anything in particular when it does?

No

Edited July 4, 2023 by Porthos

[henrymurray]

Porthos,

Do I need to send the log again after I restart?

Henry.

 

 

 

[henrymurray]

Porthos,

I'm not getting the alert in Windows 11. Could the restart notice have anything to do with the tojan?

Henry

[Porthos]

Just now, henrymurray said:

I'm not getting the alert in Windows 11.

Please just restart the computer as instructed.

[henrymurray]

Porthos,

Yes have done - there were some windows updates. Thank you.

 

[AdvancedSetup]

@henrymurray

 

[ 1 ]

Please go to Control Panel, Programs, Programs and Features, Uninstall a program 

Then right-click and uninstall the following

• CCleaner (computer experts no longer recommend this program)
• CCleaner Browser (computer experts no longer recommend this program)

 

Why You Shouldn’t Download CCleaner for Windows Anymore
https://helpdeskgeek.com/free-tools-review/why-you-shouldnt-download-ccleaner-for-windows-anymore/

Microsoft Windows 10 is warning users not to install CCleaner
https://www.techradar.com/news/windows-10-is-warning-users-not-to-install-ccleaner

Is CCleaner Safe? Not Quite. And We Show You How to Replace It
https://www.makeuseof.com/tag/stop-using-ccleaner-windows/

 

[ 2 ]

Your current DNS Servers:  209.18.47.62 - 209.18.47.61

Please consider changing your default DNS server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

Pick just one of these 4 providers. And be aware that you need to modify 1 time for IPv4 & a 2nd pass for IPv6

• Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
• Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
• OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
• DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

[ 3 ]

ATTENTION: System Restore is disabled (Total:476 GB) (Free:359.24 GB) (75%)

Please ENABLE System Protection and create a  NEW System Restore Point

 

Enable or Disable System Restore in Windows 11
https://www.elevenforum.com/t/enable-or-disable-system-restore-in-windows-11.15866/

 

 

[ 4 ]

Windows Update Automatic Update Client Core is faulting which can cause update failures

Application errors:
==================
Error: (07/03/2023 12:44:22 PM) (Source: Application Error) (EventID: 1000) (User: NT AUTHORITY)
Description: Faulting application name: wuaucltcore.exe, version: 923.330.111.0, time stamp: 0x2ea39e49
Faulting module name: ntdll.dll, version: 10.0.22621.1485, time stamp: 0xb7f0154a
Exception code: 0xc0000005
Fault offset: 0x0000000000033aba
Faulting process id: 0x0x4ab8
Faulting application start time: 0x0x1d9ade671c699dd
Faulting application path: C:\WINDOWS\uus\AMD64\wuaucltcore.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 0094a13b-cb44-428a-810c-b961bec4f23e
Faulting package full name:
Faulting package-relative application ID:

 

[ 5 ]

It looks like you have at least about 6 profiles on Google YouTube

You also have Push Notifications enabled. You may wish to read the following and decide if you really want that enabled or not.

Are you sure you want this enabled or allowed? Push Notifications on your browser appear to be enabled.

https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

Turn notifications on or off - Google Chrome

Web Push notifications in Firefox

 

[ 6 ]

Please run the following fix

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\13103\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed in most, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Edited July 4, 2023 by AdvancedSetup
Updated information

[henrymurray]

Thank you very much Advanced Setup. A couple of initial points.

1] I uninstalled the CC cleaner files

2] These DNS servers are Spectrum my internet provider. 

I use a Netgear router rather than the Spectrum router

Which items do I change:

Just the IPv4 DNS Servers and the IPv6 DNS Servers

Connection-specific DNS Suffix: socal.rr.com
Description: Realtek PCIe GbE Family Controller
Physical Address: ‎14-CB-19-BF-37-A0
DHCP Enabled: Yes
IPv4 Address: 192.168.0.2
IPv4 Subnet Mask: 255.255.255.0
Lease Obtained: Tuesday, July 4, 2023 2:03:09 AM
Lease Expires: Tuesday, July 4, 2023 4:33:41 AM
IPv4 Default Gateway: 192.168.0.1
IPv4 DHCP Server: 192.168.0.1
IPv4 DNS Servers: 209.18.47.62, 209.18.47.61
IPv4 WINS Server: 
NetBIOS over Tcpip Enabled: Yes
IPv6 Address: 2603:8000:b801:3900:514a:4685:d180:5f49
Temporary IPv6 Address: 2603:8000:b801:3900:e828:29d6:f130:f94a
Link-local IPv6 Address: fe80::236b:1a1a:1b15:6aa9%7
IPv6 Default Gateway: fe80::bea5:11ff:fed2:e52f%7
IPv6 DNS Servers: 2001:1998:f00:1::1, 2001:1998:f00:2::1

3] The new restore point: should it be before the recently downloaded files for these changes? Or will it just have to go where it is when I turn it on?

4] Can I do anything about these Application errors

6] I don't know about the firewall - does that mean it probably doesn't have any custom settings?

I have two discs -  SSD and HDD. All registry stuff is on SSD. Will this be working with just one of them or both and do I need to tweak anything because of the two discs? 

Thank you very much for your help.

Henry.

 

 

 

[AdvancedSetup]

Yes, I understand that your DNS Servers are from Spectrum. You do not have to change them it's just recommended as the others are generally considered faster and better DNS servers.

You don't change your router. Look at the YouTube video if needed. You simply make the changes inside Windows network settings.

Yes, make a New Restore Point now, after enabling the service.

You don't need to do anything about the Firewall. Please run the posted FIX and it will reset it for you.

Cheers @henrymurray

 

[henrymurray]

Hi, I have  been getting info together about logins etc so I don't lose too much. I have turned off Chrome allow programs to run in background when Chrome is turned off. Is that a good idea or is running in the background needed for the fix? 

Thank you, Henry.

[henrymurray]

Hi, I ran the scan and here is the Fixlog. 

Thank you, Henry.

 

Fixlog.txt

[henrymurray]

Should I be doing anything like changing passwords or some such now?

Henry.

 

[AdvancedSetup]

Thank you for the log @henrymurray

No, please don't change passwords just yet. Let's finish with scans and verify the computer is safe before making password changes.

The log run was good and it also found and fixed some other issues.

Windows Resource Protection found corrupt files and successfully repaired them.

 

Please run the following scan.

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

[henrymurray]

Thank you. Can I take part in a Zoom call before I run the scan? 

[AdvancedSetup]

Sure, no problem. Any time you're ready @henrymurray

Cheers

 

[henrymurray]

Thank you for the scan instructions. When you say "web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well" does that mean it is OK to close the web browser or does fully exited mean something extra. And for messenger programs (I have facebook messenger) "exited and closed" does that mean signed out? I tried clicking 'exit' on one Chrome window and all instances open were closed is that what I should do. Exit on Facebook too? And I have some Vivaldi should those be closed and exited? Although I can't find the login info for them to start them up from exit.

Thank you Henry.