Having Powersheel.exe Issues ... Need fixlist.txt

[amb0171]

Hello all

 

I am having a bit of an issue and having the Virus... It is creating these two folders and exe files...

 

2024-03-15 18:26 C:\ProgramData\brikyftanlpt
2024-03-19 19:38 C:\ProgramData\iitpbysmgxhg

 

so I removed their access and run FRST64... I need some help.. had no issues in last 10 years; always used Malwarebytes Premium and still using it...

 

Can you please have a look and help..?

 

Thanks a lot...

 

Raj

Addition.txt FRST.txt

[amb0171]

3 minutes ago, amb0171 said:

Hello all

 

I am having a bit of an issue and having the Virus... It is creating these two folders and exe files...

 

2024-03-15 18:26 C:\ProgramData\brikyftanlpt
2024-03-19 19:38 C:\ProgramData\iitpbysmgxhg

 

so I removed their access and run FRST64... I need some help.. had no issues in last 10 years; always used Malwarebytes Premium and still using it...

 

Can you please have a look and help..?

 

Thanks a lot...

 

Raj

Addition.txt 106.89 kB · 0 downloads FRST.txt 98.05 kB · 1 download

VIrus 1.txtVIrus 2.txt It is creating and attmpting different sites with these .exe files...

Thanks

[AdvancedSetup]

Hello @amb0171 and

Lot of issues. Give me some time to write up a fix

 

[AdvancedSetup]

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Please rename FRST.EXE or FRST64.EXE to FRSTEnglish.exe

 

 

[AdvancedSetup]

After downloading and renaming Farbar above.

 

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\Aya\Desktop\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[amb0171]

Fixlog.txtHello Admin / AdvancedSetup

 

Please find the fixlog.txt file for your reference...

 

Just to let you know that windows update is working back again but the malwarebytes is still showing that dialouge every second for the powershell.exe and here is the detail

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 3/19/24
Protection Event Time: 11:06 PM
Log File: a0dbed92-e677-11ee-ae9f-f077c3541699.json

-Software Information-
Version: 4.6.10.316
Components Version: 1.0.2286
Update Package Version: 1.0.82366
License: Premium

-System Information-
OS: Windows 11 (Build 22631.3296)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: RiskWare
Domain: webjava.casacam.net
IP Address: 105.108.112.173
Port: 1973
Type: Outbound
File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

 

(end)

 

Looking forward to get further instruction.

 

Regards

RC

 

 

[AdvancedSetup]

Thank you for the log and update. The fix was able to fix quite a few issues but not all.

Please go ahead and run the following. It's late for me so I'll probably have to check back on you again tomorrow

 

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 

Select the     Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed...   Thank you

 

 

[amb0171]

report_2024.03.19_23.27.14.txtreport_2024.03.19_23.38.38.txtI run the tests; please find the attached files.. Thanks...

[AdvancedSetup]

Thank you for the logs.

Please go ahead and run the following scanner. The canned message is a bit old so the settings my not be exactly right but close enough for you to get the scan completed.

 

 

Sophos Scan & Clean

Download Sophos Free Virus Removal Tool and save it to your desktop.

• If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....
• Please close all other open applications and Do Not use your PC whilst the scan is in progress... This scan is very thorough so it may take several hours to complete, please be patient...

Double click the icon and select Run

Click Next

Select I accept the terms in this license agreement, then click Next twice

Click Install

Click Finish to launch the program

• Once the virus database has been updated click Start Scanning

If any threats are found click Details, then View log file... (bottom left hand corner)

 

Attach the results in your next reply

• Close the Notepad document, close the Threat Details screen, then click Start cleanup

Click Exit to close the program

 

If no threats were found please confirm that result...

• The Virus Removal Tool scans the following areas of your computer:
• Memory, including system memory on 32-bit (x86) versions of Windows
• The Windows registry
• All local hard drives, fixed and removable
• Mapped network drives are not scanned.

Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

 

Saved logs are found under this sub-folder: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs 

Please attach that log on your next reply

Thank you

 

[amb0171]

Thanks for your reply...

It says doesnt require the installation... Just accepted and run.. Have I done it wrong ???

I have attached the logs for some reason it only took 3 minutes to complete....

https://www.sophos.com/en-us/free-tools/virus-removal-tool

 

 

SophosScanAndClean_20240320_1213.log SophosScanAndClean_20240320_1212.log

[AdvancedSetup]

The log indicates it thinks some of the Stardock software is quite possibly pirated software.

If so, that is very risky as you don't know what the code is actually doing at this point. I would recommend uninstall if this is from pirated software.

 

Please run these scans again now.

 

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[amb0171]

Thanks again for your seemless effort...

 

I have attached the files after each scan and removed the fences too...

 

THanks

Addition.txt FRST.txt Malwarebytes logs.txt AdwCleaner[C01].txt AdwCleaner[S01].txt

[AdvancedSetup]

Please restart the computer again. The logs indicate the computer needs another restart.

Then run the following, pleae

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

 

 

Thank you @amb0171

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks