I keep detecting the same Trojan.Bitcoinminer.

[Pinewleaf]

My scan report always shows the same 4 Bitcoinminers.
There is malware on my device, it prevents me from updating windows.
I have no idea how to fix this and its really a problem. 

Attached is a lof of it (I named it malware, didnt think Id actually post it) 

malware.txt

[1PW]

Hello @Pinewleaf and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

[Pinewleaf]

mbst-grab-results.zip

[MKDB]

Hello @Pinewleaf  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please copy and paste all log files into your post.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

Please give me some time to review what you have posted.

Thank you!

[MKDB]

@Pinewleaf

 

Please note:

We will use Farbar Recovery Scan Tool (FRST) to run a fix. FRST was downloaded together with MBST and should be located in your download folder.

The fix may take some time, please be very patient and do not interfere.

The malware has damaged some windows services as well. We need to repair them later. But for now, we are focusing on the removal of the malware.

 

 

 

Step 1

• Please download the attached fixlist.txt file and save it to your download folder, which is C:\users\pinew\Downloads\ in your case.
• You will find the file FRSTEnglish.exe (FRST) as well in this folder.

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST.
• Press the Fix button only once and wait. Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and my result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
• Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

 

fixlist.txt

[Pinewleaf]

Fixlog.txt

[MKDB]

Well done @Pinewleaf.

 

Please give KVRT a try.

 

 

Step 1

Download Kaspersky Virus Removal Tool (KVRT) and save it to your Desktop.

• Select the Windows Key and R Key together, the Run box should open.
• Copy and paste the following string into the line:

C:\Users\pinew\Desktop\KVRT.exe -dontencrypt

• Select „Ok“ in the Run box.
• If the „Windows protected your PC“ window opens, select „More info“. A new windows will open, select „Run anyway“.
• An EULA window from KVRT will open, tick all confirmation boxes then select "Accept".
• A window from KVRT will open, select "Change Parameters".
• In the new window ensure the following boxes are ticked:
  • System memory
  • Startup objects
  • Boot sectors
  • System drive

• Then select "OK" and „Start scan“.

• completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
• Usually, your system needs a reboot to finish the removal process.
• Logfiles can be found on your systemdrive (usually C: ), similar like this:

C:\KVRT2020_Data\Reports\report_<data>_<time>.klr

• Right click direct onto those reports, select > open with > Notepad.
• Save the files and attach them with your next reply.

 

 

Edited September 17, 2023 by MKDB

[MKDB]

@Pinewleaf

Updated last post, mixed up ESET with KVRT.

Sorry for the mistake.

Edited September 17, 2023 by MKDB

[Pinewleaf]

I run the command and it doesnt work on RUN
As you can see its on my desktop 

[Pinewleaf]

found the issue, the directory was "C:\Users\pinew\OneDrive\Desktop\" 
IDK why onedrive is  thing

[Pinewleaf]

My screen is black with just a cursor. 

Do I just wait now? 

This is after clocking the restart on KVRT

[Pinewleaf]

report_2023.09.17_14.48.21.txt

[MKDB]

@Pinewleaf

I've never seen this a black screen due to KVRT.

Have you shutdown your system and rebooted it manuelly? Does it start?

 

 

 

Step 1

• If you already have Malwarebytes Anti-Malware installed, then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed or if you don't run the newest version yet, please download it from here and install it.
• Once the MBAM dashboard opens, click on Settings (gear icon).
• Click on Security tab and make sure that all four Scan options are enabled.
• Close Settings and click on the Scan button on the dashboard.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
• If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run, then please skip to the next step and let me know in your next reply that the scanner would not run.

 

 

 

Step 2

• Run FRSTenglish from your download folder again.
• Do not change any settings.
• Press the Scan button.
• FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

[MKDB]

Hi @Pinewleaf,

do you still need help? If so, please follow my instructions and post the logfiles.

Thank you.

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.