Infected with Backoor.Remcos.E help

[Leloouch]

Hi, Yesterday I downloaded some file and found out it was virus. I deleted it with malwarebytes but it shows everytime I restart PC. Anyone please help?

[Porthos]

@Leloouch

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

[Leloouch]

AdwCleaner[S00].txtAddition.txtFRST.txtmalwarebytes scan.txtAdwCleaner[C00].txt

I did the steps. 

[AdvancedSetup]

Thank you for the logs @Leloouch

Please temporarily disable the ESET real-time protection and run the following

 

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 

Select the     Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed...   Thank you

 

 

[Leloouch]

report_2024.05.05_14.30.47.klr.txtreport_2024.05.05_02.54.43.klr.txtreport_2024.05.05_12.58.16.klr.txt

Here are the reports from the scan. I cured and deleted the things and last scan found nothing. 

[AdvancedSetup]

Thank you for the logs. It looks like Kaspersky found and removed some items.

Please get me some new, fresh logs

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

 

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

 

 

[Leloouch]

SecurityCheck.txtAddition.txtFRST.txtFSS.txt

Here are the scans. Also did scan with malwarebytes today and it found some learning machine thing. Also i don't know what's going on but when I wanted to send the screen of the malwarebytes scan all screens in that file changed into different files or something like that and some file appeared with the name  read me. Am I being hacked or something? 

[AdvancedSetup]

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\Lelouch\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[AdvancedSetup]

Once you have completed the FIX above, please RESTART the computer one more time and do the following

 

Please uninstall, update, or otherwise address the following as appropriate for your system

 

• AMD Software v.24.3.1 Warning! Download Update
• Discord v.0.0.309 Warning! Download Update
• Java 8 Update 361 (64-bit) v.8.0.3610.9 Warning! Download Update | Uninstall old version and install new one (jre-8u411-windows-x64.exe).
• Java 8 Update 361 v.8.0.3610.9 Warning! Download Update | Uninstall old version and install new one (jre-8u411-windows-i586.exe).
• Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
• Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
• ProtonVPN v.2.4.2 Warning! Download Update
• VLC media player v.3.0.12 Warning! Download Update
• WinRAR 5.90 (64-bit) v.5.90.0 Warning! Download Update

Please uninstall the following

---------------------------- [ UnwantedApps ] -----------------------------
CCleaner v.6.23 (computer experts no longer recommend this program)
IObit Uninstaller 11 v.11.2.0.10 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.

 

Please consider uninstalling and not using any Torrenting software

qBittorrent 4.3.8 v.4.3.8 Warning! Download Update

 

The act of torrenting itself is not illegal. However, downloading and sharing unsanctioned copyrighted material is illegal, and there is always a chance of prosecution if caught by the authorities.
Torrenting non-copyrighted material is perfectly fine and is allowed. However, be aware that we have seen increased malware bundled with software downloads over P2P.

Recent Ransomware infections have been seen to encrypt user data so that no one can decrypt the data without the private key.
When sharing files, please keep in mind that you're increasing your system's attack surface area, which can increase the risk of infection.

Scan all files before running them. https://www.virustotal.com

If you don't need or use the P2P software, you should uninstall it.

P2P File-Sharing: Know the Risks
https://www.bankinfosecurity.com/p2p-file-sharing-know-risks-a-737

 

Hidden risks in pirated software https://news.microsoft.com/apac/2019/01/08/hidden-risks-in-pirated-software/
Why You Shouldn't Use Pirated Software (But Why People Still Do) https://www.computer.org/publications/tech-news/trends/why-you-shouldnt-use-pirated-software

 

 

 

[Leloouch]

Fixlog.txt

Here is the scan. I will do the following steps. Also my windows defender is turned off and I can't turn it on. 

[AdvancedSetup]

Thank you for the log. It ran well and also found and fixed some Windows issues

Windows Resource Protection found corrupt files and successfully repaired them.

Please RESTART the computer and get mew new, fresh set of logs

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

 

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

 

[Leloouch]

SecurityCheck.txtFSS.txtFRST.txtAddition.txt

Here are the scans.

[AdvancedSetup]

Thank you for the logs

The Volume Shadow Copy Service (VSS) has been damaged as well as other important Windows services.

We can attempt to repair them but considering the damage done to the system from this infection I would recommend you backup your personal data to an external USB hard drive and reinstall Windows

Clean Install Windows 10 & 11 (2023)
https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587

Also, please review the following topic

Bypass Microsoft Online Account Creation during installation of Windows 11
https://forums.malwarebytes.com/topic/296613-bypass-microsoft-online-account-creation-during-installation-of-windows-11/

Thank you again

 

 

[Leloouch]

So it's done? That virus is gone? Also don't really understand what it damaged, I would rather not reinstall windows. So is it that important? For example my windows defender is off now and don't have the option to turn it on, is it also because of this? 

[AdvancedSetup]

No the computer is not fixed. That's what I said above.

The infection has damaged the computer quite a bit. We've already repaired many issues and Windows still has a LOT of damage to fix.

If you don't want to reinstall Windows then try the following in place repair

 

How to Do a Repair Install of Windows 10 with an In-place Upgrade
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

 

Thanks

 

[Leloouch]

Alright I will try to do that. One last maybe stupid question. The virus is gone and if I do the Repair Install of Windows 10 with an In-place Upgrade it should be somehow ok and I won't have anymore problems with the virus in the future? That's all. Thanks for you're work. 

[AdvancedSetup]

The logs don't appear to indicate an ongoing infection. Once Windows itself is repaired we should still scan it again to ensure all issues have been fixed or removed.

 

[Leloouch]

Alright I'll write you once I do the repair.

[Leloouch]

@AdvancedSetup

I did the repair. What scans do you want from me? 

[AdvancedSetup]

Please restart the computer one more time.

Then get me the following new, fresh logs

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

 

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

 

 

[Leloouch]

SecurityCheck.txtFSS.txtFRST.txtAddition.txt

Here are the scans. 

[AdvancedSetup]

Yes, that looks to have repaired the broken services.

Please uninstall, update, or otherwise address the following as appropriate for your computer.

• Discord v.0.0.309 Warning! Download Update
• VLC media player v.3.0.12 Warning! Download Update
• WinRAR 5.90 (64-bit) v.5.90.0 Warning! Download Update

Using P2P Torrent software greatly increases your risk of possible attack. If at all possible I would highly recommend uninstalling and not using Torrenting software.

qBittorrent 4.3.8 v.4.3.8 Warning! Download Update

 

The act of torrenting itself is not illegal. However, downloading and sharing unsanctioned copyrighted material is illegal, and there is always a chance of prosecution if caught by the authorities.
Torrenting non-copyrighted material is perfectly fine and is allowed. However, be aware that we have seen increased malware bundled with software downloads over P2P.

Recent Ransomware infections have been seen to encrypt user data so that no one can decrypt the data without the private key.
When sharing files, please keep in mind that you're increasing your system's attack surface area, which can increase the risk of infection.

Scan all files before running them. https://www.virustotal.com

If you don't need or use the P2P software, you should uninstall it.

P2P File-Sharing: Know the Risks
https://www.bankinfosecurity.com/p2p-file-sharing-know-risks-a-737

 

Hidden risks in pirated software https://news.microsoft.com/apac/2019/01/08/hidden-risks-in-pirated-software/
Why You Shouldn't Use Pirated Software (But Why People Still Do) https://www.computer.org/publications/tech-news/trends/why-you-shouldnt-use-pirated-software

 

 

Please temporarily disable your real-time protection with ESET antivirus and run the following Microsoft Safety scanner.

 

 

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

[ 1 ]

Please make the following system changes.

• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed.
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

[ 2 ]

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

[Leloouch]

msert.log

Here is the log.

[AdvancedSetup]

That log came back clean.

How is the computer running now?

Are there still any signs of infection or any other unresolved issues @Leloouch

 

[Leloouch]

It seems to be working fine. Thank you very much.