Jump to content

I have a powershell trojan that i cant get rid of, please help!

Linkster400
 Share

Recommended Posts

Linkster400

Linkster400

Posted
Posted

Been fighting with this little bugger for a while, not 100% where it came from but randomly powershell windows will pop up and start using resources and ill kill them with task manager, do a scan, usually something gets quarantined, but a few days later its always back.

Link to post
Share on other sites
Porthos

Porthos

Posted
Posted

@Linkster400

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

  • If you have not done so already - Enable System Protection and create a NEW System Restore Point
  • Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
  • Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
  • Disable-Fast-Startup
  • Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

  1. Click the following link and run a  Scan with AdwCleaner
  2. Click the following link and run a  Scan with Malwarebytes 
       RESTART the computer
  3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

image.thumb.png.e208c182ff570799c53bcf57

Then be patient for the next expert to take your case.

 

Thank you

Link to post
Share on other sites
MKDB

MKDB

Posted
Posted

Hello  @Linkster400  and  :welcome:

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

  • Please follow the steps in the given order and post back the log files.
  • Please attach all log files into your post.
  • Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
  • Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
  • If you do not respond within 4 days, your topic will be closed.
  • Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

Please attach the requested logfiles and we will be happy to help you.

Thank you!

Link to post
Share on other sites
MKDB

MKDB

Posted
Posted

@Linkster400

First, we will run a fix with FRST.

This may take some time, please be very patient.

 

 

  • Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\simon\OneDrive\Desktop\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  • Close all open programs and save your work.
  • Run FRST again.
  • Press the FIX button only once and wait.
  • Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
  • Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
  • Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
  • If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
  • FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply.

 

 

fixlist.txt

Link to post
Share on other sites
MKDB

MKDB

Posted
Posted

@Linkster400

Have the powershell pop ups stopped?

 

Let's do another scan with FRST to check the results.

 

  • Run FRST again.
  • Do not change any settings.
  • Press the Scan button.
  • FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.

Please attach these logfiles to your next reply.

Link to post
Share on other sites
MKDB

MKDB

Posted
Posted

@Linkster400

Thank you very much for your feedback as well as for the logfiles.

Unfortunately, I can't follow your descriptions regarding windows defender and Microsoft Tasks.

 

1)

We did not really touch Windows Defender with this fix.

There was only a restriction listed in FRST: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION

I've removed that restriction as those are usually added by malware. But this can not be the reason for windows defender not working correctly.

Which problem do you exactly have with the defender?

 

2)

We have deleted a lot of malicious tasks with FRST and some task leftovers (disabled tasks where the file was already missing). No active, legit task was touched by FRST.

That's why I don't understand which Tasks you are talking about.

 

3)

According to the newest FRST logfiles, Windows Defender services and all listed tasks look ok. We can do a more closer look with FSS.

Moreover, I suggest to run KVRT for a second opinion.

Thank you!

 

 

1️⃣

Please follow these instructions and attach the requested logfile FSS.txt:

 

 

2️⃣

Download Kaspersky Virus Removal Tool (KVRT) and save it to your Desktop.

  • Select the Windows Key and R Key together, the Run box should open.
  • Copy and paste the following string into the line:

C:\Users\simon\OneDrive\Desktop\KVRT.exe -dontencrypt

  • Select „Ok“ in the Run box.
  • If the „Windows protected your PC“ window opens, select „More info“. A new windows will open, select „Run anyway“.
  • An EULA window from KVRT will open, tick all confirmation boxes then select "Accept".
  • A window from KVRT will open, select "Change Parameters".
  • In the new window ensure the following boxes are ticked:
    • System memory
    • Startup objects
    • Boot sectors
    • System drive
  • Then select "OK" and „Start scan“.
  • completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
  • Usually, your system needs a reboot to finish the removal process.
  • Logfiles can be found on your systemdrive (usually C: ), similar like this:

C:\KVRT2020_Data\Reports\report_<data>_<time>.klr

  • Right click direct onto those reports, select > open with > Notepad.
  • Save the files and attach them with your next reply.

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Pardon the intrusion, but can you also please provide the following log

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

  • Thanks 1
Link to post
Share on other sites
MKDB

MKDB

Posted
Posted

@Linkster400

Well done.

 

We will run another fix in order to remove some leftovers.

Moreover, I would like you to run SecurityCheck to have a look onto your installed programs.

Thanks again.

 

 

1️⃣

  • Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\simon\OneDrive\Desktop\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

  • Close all open programs and save your work.
  • Run FRST again.
  • Press the FIX button only once and wait.
  • Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
  • Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
  • Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
  • If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
  • FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply.

 

 

2️⃣

Please follow these instructions and attach the requested logfile SecurityCheck.txt:

 

 

 

fixlist.txt

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please uninstall, update, or otherwise address the following as appropriate for your computer.

  • AMD Software v.23.5.2 Warning! Download Update
  • Audacity 2.4.2 v.2.4.2 Warning! Download Update
  • Discord v.0.0.310 Warning! Download Update
  • Git v.2.42.0.2 Warning! Download Update
  • GNU Privacy Guard v.2.2.21 Warning! Download Update
  • Google Chrome v.124.0.6367.63 Warning! Download Update
  • Gpg4win (3.1.12) v.3.1.12 Warning! Download Update
  • Microsoft SQL Server 2012 Express LocalDB  v.11.4.7001.0 Warning! This software is no longer supported.
  • Microsoft SQL Server 2012 Native Client  v.11.4.7001.0 Warning! This software is no longer supported.
  • Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
  • Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
  • Microsoft Visual Studio Code (User) v.1.87.2 Warning! Download Update
  • NVIDIA GeForce Experience 3.27.0.120 v.3.27.0.120 Warning! Download Update
  • Python 3.12.0 (64-bit) v.3.12.150.0 Warning! Download Update
  • QuickTime 7 v.7.79.80.95 Warning! This software is no longer supported. Please uninstall it and use another software.
  • Signal 6.38.0 v.6.38.0 Warning! Download Update
  • TreeSize Free V4.7.1 (64 bit) v.4.7.1 Warning! Download Update
  • WinRAR 6.10 beta 1 (64-bit) v.6.10.1 Warning! Download Update
  • Zoom v.5.17.7 (31859) Warning! Download Update

 

Please uninstall the following

---------------------------- [ UnwantedApps ] -----------------------------
Bonjour v.3.0.0.10 (rarely needed on Windows but often causes networking issues) 


Then RESTART the computer and check for Windows Updates and install any updates found


Restart one more time and let us know if there are still any signs of infection or any other unresolved issues.

Thank you

 

 

  • Thanks 1
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

We're glad that we were able to assist you.

The following information will help you to keep your computer and data safer as well as improve your overall privacy

  1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
    https://www.howtogeek.com/780233/best-password-manager/
  2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
  3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
  4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
  5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
  6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

uBlock Origin

 

Imagine a world without malware. We do
https://www.malwarebytes.com/why-upgrading-matters-ceo

 

Cybersecurity basics & protection
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity

 

Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal

 

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.