Had trojan - not sure if false positive, how can I be sure it's gone?

[F0rceofnature]

19 minutes ago, JSntgRvr said:

very well

Thank you very much for your assistance, btw! 

Addition.txt FRST.txt

[JSntgRvr]

Your computer still full of hidden files. Lets query the attributes. 

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

[F0rceofnature]

2 hours ago, JSntgRvr said:

Your computer still full of hidden files. Lets query the attributes. 

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

requested file attached

Fixlog.txt

[JSntgRvr]

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

[F0rceofnature]

3 hours ago, JSntgRvr said:

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

 

Fixlog.txt

[F0rceofnature]

Just now, F0rceofnature said:

 

Fixlog.txt 8.41 kB · 0 downloads

iirc, cortex xdr has higher permissions than me on my own device :-) I asked responsible IT-Department to get rid of it, since it was only a temporary solution anyway.

 

However, to come to my very first initial question: How can i be absolutely, 100% sure that my PC is not infected with any trojan? MLB doesnt show me any more warnings etc., is that a negative regarding trojans?

[JSntgRvr]

Those hidden files and folders took me out.

Let's begin again... 

 

This Fix will empty the following folders:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

[F0rceofnature]

On 5/3/2024 at 6:20 AM, JSntgRvr said:

Those hidden files and folders took me out.

Let's begin again... 

 

This Fix will empty the following folders:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

Im currently in touch with company regarding the removal of cortex XDR - I think it's the easiest way to get rid of it :-) After that, I'll update here!

[F0rceofnature]

Cortex should be uninstalled now, should I re-start the steps with FRST?

[JSntgRvr]

The uninstall string is as follows:

MsiExec.exe /X{7D8D4FBA-B63A-4476-A5BD-2906650164DD}

It can be ran at a command prompt as an Administrator.

[F0rceofnature]

1 hour ago, JSntgRvr said:

The uninstall string is as follows:

MsiExec.exe /X{7D8D4FBA-B63A-4476-A5BD-2906650164DD}

It can be ran at a command prompt as an Administrator.

tells me that i can only run this command for prodcuts installed on my pc, seems clear now :)

[JSntgRvr]

Were you able to remove it?

[F0rceofnature]

12 hours ago, JSntgRvr said:

Were you able to remove it?

cortex seems to be completely removed yeah!

[JSntgRvr]

On 5/3/2024 at 12:20 AM, JSntgRvr said:

Those hidden files and folders took me out.

Let's begin again... 

 

This Fix will empty the following folders:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

• Download the enclosed file Fixlist.txt
• Save it in the same location FRST64.exe is saved (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges 
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply. If too large, use an online upload service and post the link. www.wetransfer.com is a good site.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

Glad to know. Complete these instructions to complete the malware scan.

[F0rceofnature]

3 hours ago, JSntgRvr said:

Glad to know. Complete these instructions to complete the malware scan.

ty!

Fixlog.txt cureit.log

[JSntgRvr]

The fix ran well.

Windows Resource Protection found and successfully repaired corrupted files. There are no infected objects detected
 

How is the computer doing?

[F0rceofnature]

2 hours ago, JSntgRvr said:

The fix ran well.

Windows Resource Protection found and successfully repaired corrupted files. There are no infected objects detected
 

How is the computer doing?

Its doing good, no real issues on my end left :D

[JSntgRvr]

Congratulations. 

Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

• Put a check mark next to these items:

- Delete tools

- Create Restore Point

- Delete now

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and delete itself.

A few final recommendations:
 
The following information will help you to keep your computer and data safer as well as improve your overall privacy

• Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
  https://www.howtogeek.com/780233/best-password-manager/
• Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
• Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
• Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
• Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/
• Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

Cybersecurity basics & protection
 
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity
 
Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/
 
Please review the following to help you better protect your computer and privacy
 
Tips to help protect from infection
 
Hopefully, we've been able to assist you with correcting your system issues.
 
Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal.

Regards.