Jump to content

Touched “Facebook friend “ email — virus? need ideas


Go to solution Solved by Foolthatrushedin,

Recommended Posts

After my mistake, Win 10 fingerprint entry didn’t work and it claimed I needed me to enter a new password since mine was “lost”.  Instead I did a shift+ restart and gotten to the repair menus. I am able to use a previous restore point to enter windows but about 6 seconds after my desktop shows, a series of command windows (6? 10?) flash access the screen.  When at the repair menus:  Running the startup fix tool fails.  Unloading the last updates fails to execute.  

I am able to run the restore routine multiple times to got back into windows, but I don’t see a way to do the restore automatically and get to safe mode.  Once in windows, restarting to go to safe mode results in some software running during the software shutdown that takes me back to the fake login screen.  I’ve manually got Wi-Fi off.  Malwarebytes and Trend Micro scans show nothing.  Is the a list somewhere that specifies the bare minimum of what must run in task manager to see if I can terminate everything else and prevent that software from executing?  Anyone know what virus I’ve encountered?

 

Link to post
Share on other sites

Hello @Foolthatrushedin and :welcome::

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

  1. Download the Malwarebytes Support Tool.
  2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
  3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
  4. Run the MBST Support Tool.
  5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
  6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper.
  7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

Link to post
Share on other sites

Hello :welcome: @Foolthatrushedin

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

  • Kindly allow me time to review your report. Do not make changes on your own, without first checking with me.
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.
  • The quickest glance at reports shows that Windows 10 is in a normal-mode start.
Link to post
Share on other sites

You mentioned 

Quote

I’ve manually got Wi-Fi off. 

This pc will need to have a connection to the internet in order to do things. IF this machine is directly connected with a cable to the internet router, that is acceptable. If it is -not- then you do need to reconnect the WIFI connection to your network wouter.  We do need internet connection.

These are the next initial steps to do. Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article
Please use this Guide

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first
https://definitionupdates.microsoft.com/download/DefinitionUpdates/safetyscanner/amd64/MSERT.exe

Upon completion of the save, Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well

Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.


This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

It is normal for the Microsoft Safety Scanner to show 'detections' during the scan process on the screen itself.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Link to post
Share on other sites

I tried to open google and brave browsers and they would not.  Firefox was the browser I had to use, which was the one in which I had the email open.  Initially I had no problem being logged in to this thread and could post directly, however somehow my login from the pc doesn’t allow me to post anymore, seems something/someone closes the session.  When I get the completed msert.log, how can I add it to the thread? ( this post is from my tablet)9

Link to post
Share on other sites

Good to know the improvements. Good to see the report from Safety Scanner. There is more to do. Please run the following custom script. Read all of this before you start. 

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers. It will attempt to clear temporary file areas. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

Farbar  FRSTENGLISH program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Link to post
Share on other sites

here is the fixlog. txt file

I noticed that the previously open tabs for firefox did not reopen, which is not how I had it set upIf necessary, may I restore those tabs from the 8/3/2023 session from 8:51 AM from either the primary recovery.jsonlz4 or the backup recovery.baklz4?  I am certain that the virus was downloaded on Thursday at about 8:27 am +/- five minutes which was roughly 20 minutes before these recovery files were created. 

image.thumb.png.7e9ab17fb1a79a2d7da5abf7dc6f8433.pngimage.thumb.png.d44f6fb8d037447e4b12cd02c0ad383b.png

Fixlog.txt

Link to post
Share on other sites

The custom-run hit the time-limit of 60 minutes  and was terminated. I will be sending you a 2nd custom script to do the rest of the taks.
As to restoring any prior webpages, I do not understand why that is needed.

As to pressing matters, like maybe doing must-do banking, yes you could do that.

Link to post
Share on other sites

This is intended to finish up what was not completed by the first run. This is a new custom-script. Please Close all open work before you actually do begin this run.

Farbar  FRSTENGLISH program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt<- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Link to post
Share on other sites

I'd deleted the original fixlist.txt, but I forgot to delete the fixlog.txt and since I hadn't seen farbar running when I came back, I uploaded what I saw.  Looking again, I have two fixlog.txt files with the second one as shown in this directory screenshot. 

I have also uploaded the extra log, and then I will wipe out those files as you requested.

 

image.thumb.png.52c3751b3374dcb6b120fbba02474abe.png

Fixlog-1.txt

Link to post
Share on other sites

I just had an the prompt that shows up after run as administrator pop up on an idle screen requesting permission for an HP smart app to install.  Install/uninstall list shows it to be installed 8/9/2023. The Microsoft Store app was set to automatic update, which I just turned off.  These are the apps that have updated since the infection began.

 

image.thumb.png.d68d82a677b1002be67601f2df5e107f.pngimage.thumb.png.4be807f28c6c5e013913314fedcaed44.png

Link to post
Share on other sites

That last set I do not think are a threat. Likely just a matter of an application needing permission. Let us table that matter. I am focusing on trying to run the parts of the custom-script-fix that have yet to finish.  It is not clear just where exactly the last time-out happened. This next script is a short one. First, recheck your system to insure it has no current Fixlist.txt

Then do a new run. 

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt<- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.