Jump to content

Possibly infected, would greatly appreciate assistance.


Recommended Posts

I'm an Unreal developer and my IDE memory/CPU usage has been off the charts this week.

First MBAM scan found and quarantined three Trojan.BitCoinMiner.E registry entries, and failed to remove one file with an unlisted location under the same threat name. Subsequent scans with "Scan for rootkits" enabled have come back clean.

FRST turned up a few "Association" registry entries, similar to the following:
HKU\S-1-5-21-3538385630-2912907386-3182429484-1001\Software\Classes\regfile:  <==== ATTENTION

Initially there were .bat, .cmd entries at the same HKU path. I added them to a fixlist.txt, fixed and scanned again, but upon subsequent restarts the regfile entry returns.

Attaching first and latest MBAM scam reports as well as most recent FRST outputs.
Thank you!

MBAM_LatestScan.txt MBAM_FirstScan.txt Addition.txt FRST.txt

Link to post
Share on other sites

  • Root Admin

Hello  and  :welcome:    @deadward

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

  • Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
  • Please follow all steps in the provided order and post back all requested logs.
  • Please attach all log files to your post, unless otherwise requested.
  • Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
  • Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
  • Before we start, please make sure that you have an external backup of all private data.
  • Do not run online games while your case is ongoing. Do not do any free-wheeling of risky web-surfing.
  • Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you unless requested.
  • Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim.
    Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections. 
    If there are any on the system you should uninstall them before we proceed.  
  • If your system is running Discord, or P2P Torrent software, please be sure to Exit out of it while this case is on-going.


Do these two steps so that ALL Folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.

Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/
 

  • Next, please restart Windows

  • Please be patient and stick with me until I give you the "all clear" or otherwise indicate all is good

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting. This is a report only.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system security.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

 

Link to post
Share on other sites

  • Root Admin

With over 500 apps, and extensions installed I don't doubt the computer is slow.

 

Please follow the steps below

[ 1 ]

Please go to Control Panel, Programs, Programs and Features, Uninstall a program

Then right-click and uninstall the following

  • Bonjour - (not required by most Windows computers, very noisy network sharing app from Apple)
  • Adobe AIR (unless you have a very custom coded need for it, AIR has been discontinued by Adobe)
  • Java 8 Update 191 (64-bit) (old and outdated, possibly compromised)
  • Java 8 Update 191 (old and outdated, possibly compromised)
  • qBittorrent 4.1.4  (up to you it has value purpose for some cases but so many computers infected as well by software theft)  


[ 2 ]

The hosts file appears as though it may be being used to facilitate piracy. We'll ignore it and assume there is no immediate threat to the system

 

[ 3 ]

Windows Firewall is disabled.

Why is the Windows Firewall disabled ? Did you do that on purpose?

 

[ 4 ]

The logs indicate you have no System Restore Points. Please enable System Protection and create a new System Restore Point. Even an infected Restore Point is better than no Restore Point

How to Turn On or Off System Protection for Drives in Windows 10
https://www.tenforums.com/tutorials/4533-turn-off-system-protection-drives-windows-10-a.html

How to Create a System Restore Point in Windows 10
https://www.tenforums.com/tutorials/4571-create-system-restore-point-windows-10-a.html

 

[ 5 ]

The system has Restrictions placed on Windows Defender that do not belong. We'll remove them before we proceed with further clean up work.

Please perform the steps above first, then do the following

 

The Farbar (FRST) program is located here in your downloads folder:  C:\Users\Edward\Downloads\FRSTEnglish.exe    

Please follow the process below to perform a fix in Safe Mode

 

Start in Safe mode:

  • Press the Windows icon on the keyboard together with the letter I, to get into the Settings.
  • Choose Update and Security.
  • From the menu at the left, choose Recovery.
  • Under the title Advanced startup at the right, choose Restart now.
  • From the window that will appear choose Troubleshoot and then Advanced options.
  • Choose Startup Settings and then Restart.
  • Press number 5, for choosing Safe mode with networking.
  • You will know that you are in Safe mode, if the background is black and Safe mode is written at the four corners of the screen.


After that:

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

 

Start::
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction
GroupPolicy: Restriction
End::

 

  • Right-click on FRSTEnglish in your Downloads folder, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in your Downloads folder or where you have the Farbar program located.
  • Attach that log in your next reply.
 
Thank you
 
 
Link to post
Share on other sites

  • Root Admin

Great, it says these were successfully restored

HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiSpyware"="0" => value restored successfully
HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiVirus"="0" => value restored successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => removed successfully

 

Please go ahead and run the following for me again. As you have the Farbar program already you don't need to download it again just run it as shown and grab new logs from Normal Mode

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Link to post
Share on other sites

  • Root Admin

The computer does not look to be infected. We can do a couple other scans to verify.

I wonder if something like this is adding to the slow down?

Task: {D64BCA2A-C2CB-48B9-B7E3-2012A5F9FC8D} - System32\Tasks\P4SyncAndUnrealTask => c:\windows\system32\cmd.exe [289792 2023-10-11] (Microsoft Windows -> Microsoft Corporation) -> /c "F:\sparta\Sparta\BuildScripts\p4_sync_build_DDCFill.bat" <==== ATTENTION

It was recently added and looks like it might be doing some type of build work?

 

 

Please go ahead and run the following scan from Microsoft.

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
  • The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

Link to post
Share on other sites

  • Root Admin

Yes, that helps to confirm that the computer does not appear to be infected at this time. @deadward

 

 

SecurityCheck by glax24              


I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.
CheckSecurity is a utility for quickly checking for the presence of vulnerable applications

  • Temporarily disable Microsoft SmartScreen to download the software
  • Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
  • If SmartScreen blocks the file from running click on More info and Run anyway
  • This tool is safe.   Smartscreen is overly sensitive. You can check the VirusTotal scan of the tool from here
  • Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
  • You can find this file in a folder called SecurityCheckC:\SecurityCheck\SecurityCheck.txt

Checked parameters:

  1. User Account Control (UAC).
  2. Service pack.
  3. IE version.
  4. Automatic OS update. Sets of critical KB patches when updating is disabled.
  5. Antivirus, firewall, other security utilities.
  6. Versions of Java, Oracle Virtualbox.
  7. Version of Adobe Flash Player, Adobe AIR.
  8. Versions of Adobe Reader, Acrobat Reader DC, Foxit Reader.
  9. Versions of media players (iTunes, AIMP, foobar2000).
  10. Versions of messengers (Skype, Pidgin).
  11. Versions of installed browsers (Chrome, Opera, Firefox, Yandex, SeaMonkey).
  12. Versions of mail programs (The Bat, Thunderbird).
  13. Checking running processes and security program services
  14. Searching for installed Adware programs and optimizer programs (More than 5000).

Thank you

 

Link to post
Share on other sites

  • Root Admin

No problem about the work application. @deadward

Please make a NEW, fresh System Restore Point.

 

Then uninstall, update, or otherwise address the following as appropriate for your system.

 

 

Then RESTART THE COMPUTER

Then check for Windows Updates and install any security updates found.

 

Then download the following Malwarebytes installer and reinstall Malwarebytes over the top of what you currently have and restart the computer one more time.

https://downloads.malwarebytes.com/file/mb-windows

 

Let me know if you're still having any signs of infection or other issues

 

Thank you

 

 

 

 

 

Link to post
Share on other sites

  • 2 weeks later...
  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.