TROJAN VIRUS

[jeriso]

i have lot of trojan virus and other types in my computer, it makes my performance worse and they keep adding viruses even if i delete them they create new ones over and over, pls help.

Malwarebytes Scan Report 2024-10-05 155645.txt

[Porthos]

@jeriso

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please do all of the requested scans in order and attach all of the results in your next reply.<<<<< Important.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point  <<<<< Important.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup   Windows 8 and newer only <<<<< Important.
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes
      RESTART the computer <<<<< Important.
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case. <<<<< Important.

 

Thank you

[MKDB]

Hello  @jeriso  and 

 

My name is MKDB and I will assist you.

 

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please attach all logs into your post.
• Before we start, please make sure that you have an external backup of all private data.
• Only run the tools I guide you to. Please don't run any other scans, don’t download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

Please attach the requested logs and we will be happy to help you

Thank you!

[jeriso]

Malwarebytes Scan Report 2024-10-05 155645.txt Malwarebytes Scan Report 2024-10-05 155645 (1).txt Malwarebytes Scan Report 2024-10-05 181014.txt

[MKDB]

@jeriso

I would like you to follow the instructions from Porthos.

The logs from AdwCleaner and Farbar Recovery Scan Tool (FRST) are missing, we need them as well.

Please attach them in order to help you.

Edited 14 hours ago by MKDB

[jeriso]

Addition.txtFRST.txthere

AdwCleaner[S02].txt

[MKDB]

@jeriso

Thanks a lot.

Please give me some time to review your logs.

[jeriso]

Np, tho i think trojan virus is run by powershell, am not sure, when i restarted i saw powershell appearing and disapearing in the taskbar,if i remenber when i accidently downloaded the fire my cursos was changed its shape like its loading something then i saw a screen appearing and disapearing in a millisecond,i wonder if this info will help.

[jeriso]

downloaded the file my cursor* (correcting my post)

[MKDB]

@jeriso

Thanks for your feedback.

Indeed, your system is infected with a special kind of miner that has the ability to restore itself. Moreover, it manipulates windows services.

So this is not a "one fix and all is good thing". I would like you to stay here with me until I give you the "All is clean".

Please do not download other things while we are working together.

 

We will start with a first fix with FRST. This may take some time. Please be very patient and to not interfere.

 

 

 

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( C:\Users\nsben\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the FIX button only once and wait.
• Please be patient and do not interfere, even if FRST does not respond for some time. That's nothing to worry about.
• Please note: This Fix will remove all temporary files, empty recycle bin and will remove cookies and may result in some websites indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
• Please note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program, agree to the request.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run. Please attach this logfile to your next reply.

 

 

fixlist.txt

Edited 9 minutes ago by MKDB