Downloaded a Virus.

[Kades]

So I wasn't sure if the file I downloaded was a virus or not but after extracting it from zip,  I scanned it with Malwarebytes, didn't show as anything, opened it, nothing happened and then after deleting it I got the following pop up but 4 times from Malwarebytes , only attached one but the rest are the same just different names 

Then when I go to temp folder I see 2 more as pictured. I did microsoft scan thing in safe mode and that found nothing

When I use the online virus tool with it, it flags on these ones;

    AhnLab-V3Malware/Win.ExploitX-gen.C5592095

BitDefenderTrojan.GenericKD.71841831

Bkav ProW64.AIDetectMalware.CS

ElasticMalicious (moderate Confidence)

EmsisoftTrojan.GenericKD.71841831 (B)

eScanTrojan.GenericKD.71841831

GDataTrojan.GenericKD.71841831

IkarusTrojan-Downloader.MSIL.Agent

MAXMalware (ai Score=89)

MicrosoftTrojan:Win32/Wacatac.B!ml

RisingMalware.Obfus/MSIL@AI.81 (RDM.MSIL2:WWWFQHB3p6AjzGI0EvhRrA)

SecureAgeMalicious

SentinelOne (Static ML)Static AI - Suspicious PE

SymantecML.Attribute.HighConfidence

Trellix (FireEye)Trojan.GenericKD.71841831

VIPRETrojan.GenericKD.71841831

& the rest are fine. I'm running the kaspersky virus removal right now.

Malwarebytes Malware Blocked Report 2024-03-06 032246.txt

Edited March 7 by AdvancedSetup
Corrected font issue

[shadowwar]

This doesnt look like a false positive. But i would need the file zipped and attached here to investigate. 

[Kades]

Thank you, I should of known better after looking at the file but the malware scan finding nothing threw me off a bit 
Here's the files attached 

Temp.rar

[Kades]

I should add the original virus file was an exe with multiple folders made to look like a game but the exe looked odd, after deleting it thats when these files popped up in temp folder.
Kaspersky virus scan has been ran and didn't pick anything up, the two exes I attached in the rar are still in my temp folder, should I just delete them? 

[Porthos]

@Kades When you posted this topic were you looking for help cleaning the system?

[Kades]

Yes, I was just in the middle of posting that, I didn't realise where I posted 😅 I need this thread moved 😅😅

Just now, Porthos said:

@Kades When you posted this topic were you looking for help cleaning the system?

 

[Porthos]

@Kades

Please respond to all future instructions from your helper in a timely manner.

Please do the following so that we may take a closer look at your system for any possible infections.

Do these 2 steps FIRST so that files and folders are set to SHOW, plus also, Turn OFF Windows Fast Start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and then do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• 
• 
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
  Then be patient for the next expert to take your case.

Thank you

[shadowwar]

Just to add this file is currently detected. 

[Kades]

13 minutes ago, shadowwar said:

Just to add this file is currently detected. 

Am I safe then? The two leftover files that didn't get automatically detected/deleted,  I just manually scanned with Malwarebytes and it picked them up and quarantined them both. 
Those websites that have the 'download button' then usually have the real download button somewhere else on the page, I've clicked on the spam one.  How dangerous was the file I opened?  I'm just considering doing a full reset. 

[shadowwar]

I would recommend you have someone in the forums check your machine and run a frst log on it. 

[AdvancedSetup]

Hello @Kades

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[Kades]

Adwcleaner just picked up on a bunch of totalav stuff etc.
I downloaded sophos and it picked up the same folder I was suspicious of as it was created when I opened the virus
Although scanning it with MWB shows nothing, I've also scanned it with Bit and it shows as clean too. 

 

==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2024-03-06 03:21 - 2024-03-06 03:21 - 000000000 ____D C:\Users\-\AppData\Roaming\mci32

^ 

SophosScanAndClean_20240306_2342.log

[Kades]

https://www.virustotal.com/gui/file/ebeac292b25b285ef98a02e91b24cc8058a15f0f5123e50c0d948fa4cc2b6f4e/relations

I done the wbxtrace.dll into virustotal and noticed it has relations with the zip file I think [can't remember the name but it seems similar]
What should I do now? just delete the folder or? 

[AdvancedSetup]

Let's go ahead and run another AV scanner @Kades

 

 

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

 

 

 

[Kades]

Thank you, it didn't find anything of concern, I've put the mci32 folder into a rar and used file shredder on the mci32 folder in roaming.
So the mci32 folder whitelisted itself in roaming when I opened the original virus zip file and tried running the exe? 😕
I dislike posting all my information.. so that probably doesn't help 😅

[AdvancedSetup]

Please run the following scan from Microsoft

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

[ 1 ]

Please make the following system changes.

• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed.
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

[ 2 ]

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

[Kades]

It was one of my first scans I done, it didn't pick up on the mci32 folder. 
The zip file that contained the virus that I ran did create the mci32 folder in roaming as its linked on virustotal.

I'm just going to do a new fresh install today, I've already moved txtfiles and pictures that I need to keep
Just to be extra safe 😅

msert.log

[Kades]

So turns out the virus was active, whats the chances it stored itself on another drive after windows reinstall? I disconnected my spare SSD and Harddrive 

It gained access to my Reddit 2days ago from recent activity and just about 30mins ago reddit locked my account due to suspicious activity.. just now 5mins ago I noticed it joined r/cucold and r/legalteens and a whole other bunch...
 

[Kades]

Anywhere to submit the virus link to get it checked out properly? I notice some version of the WFAFrance.exe hash has been detected but my version wasn't detected by malwarebytes after I scanned it

[Kades]

My logs.
 

mbst-grab-results.zip Addition.txt FRST.txt

[AdvancedSetup]

You can upload any file to VirusTotal to have it scanned.  https://virustotal.com

 

 

 

[Kades]

41 minutes ago, AdvancedSetup said:

You can upload any file to VirusTotal to have it scanned.  https://virustotal.com

 

 

 

Yeah I don't wanna put those databasefiles into virustotal - I found out its normal to have them but when I seen that the WFAFrance virus writes them I assumed they were part of it. 
If my logs look okay, I'll assume that my PC is clean unless WFAFrance.exe is known to somehow hide lol. 
 

[AdvancedSetup]

Okay, up to you.

I'll go ahead and close your topic the.

Take care