Windows Powershell Virus/Trojan

[squatcho]

Hi there. I seem to have a trojan or other virus that is trying to use Windows Powershell to access 'xboxwindows.com' seemingly continuously. After having scanned with Malwarebytes and earlier in the week removing about 75 trojan/bitminers all seemed clear but Malwarebytes keeps popping up with a notice that a website was blocked due to riskware. It's continuous so if I click close it just pops back up again. I have scanned with MBAM and FRST and the logs are provided below. Thanks in advance for the help.

Malwarebytes Scan Report 2024-07-11 044423.txt FRST.txt Addition.txt

[MKDB]

Hello  @squatcho  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please attach all log files into your post.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

Please give me some time to review what you have posted!

Thank you!

[MKDB]

@squatcho

First, we will use FRST in order to remove the malware.

More steps will follow.

Thank you!

 

 

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( H:\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the FIX button only once and wait.
• Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
• Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply.

 

 

fixlist.txt

[MKDB]

Hi @squatcho,

do you still need help? If so, please follow my instructions and post the logfiles.

Thank you.

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.