KevinG316 Posted October 7 ID:1665217 Share Posted October 7 Few days ago my laptop start to have a slow performance and heavily influence to my wifi until yesterday, window defender have notice a trojan under this name: trojan:JS/Obfuse.HNAT!MTB. The trojan have been move to quarantined and i have removed it. I also did couple full scan and offline scan and there are no threats identify. But im afraid the trojan may lurking somewhere and not completely go away. Is there anything i can do. Please help me... I have attached a image below when window defender identify the trojan. Link to post Share on other sites More sharing options...
Porthos Posted October 7 ID:1665219 Share Posted October 7 @KevinG316 Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following. Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please do all of the requested scans in order and attach all of the results in your next reply.<<<<< Important. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point <<<<< Important. Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Windows 8 and newer only <<<<< Important. Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer <<<<< Important. Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Then be patient for the next expert to take your case. <<<<< Important. Thank you Link to post Share on other sites More sharing options...
KevinG316 Posted October 9 Author ID:1665591 Share Posted October 9 Hi im sorry for the long reply, here's is the txt doc after using the three app Please let me know if you need anything else. Thank you so much for helping me ! Addition.txt FRST.txt Malwarebytes Scan Report 2024-10-09 022144.txt AdwCleaner[C01].txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 9 Root Admin ID:1665616 Share Posted October 9 Hello @KevinG316 The logs don't indicate an obvious infection. You appear to be using the Cốc Cốc Web browser which is not detected as a default browser and the .js JavaScript file it is or was using could possibly have been a False Positive from Microsoft. However, I also cannot seem to find any current information such as history of updates, etc. The last posting on their main website looks to be almost 2 years old. If a web browser is not constantly being updated it is heavily at risk or compromise. Unless there is a good, strong reason to be using that browser I would recommend you switch over to either Firefox or Brave browser as they're updated by very large teams around the clock. You also appear to have Kaspersky antivirus installed. Please open Kaspersky and check for updates. Then do a Full system scan and let me know if it finds anything or not. Thank you Link to post Share on other sites More sharing options...
KevinG316 Posted October 9 Author ID:1665623 Share Posted October 9 Hi @AdvancedSetup thank you for replying ! I want to explain a bit more about this situation. As soon as Window Defender notify me about this trojan, i immediately removed the trojan by using Window Defender as well as uninstalling Coc coc and switched to Edge as a temporary browser. After that i do a couple full scan and offline scan before downloading Kaspersky to do full scan again. In the end there are no threat or virus identify on both off the AV. Is there anything else i need to do ? Thank you ! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 9 Root Admin ID:1665626 Share Posted October 9 The choice is yours. If you don't live in the United States then you can keep Kaspersky installed if you like. @KevinG316 However, if you live in the United States you should uninstall it Kaspersky will shutter US operations after software is banned by Commerce Department, citing risk https://apnews.com/article/cybercrime-kaspersky-ban-russia-6171421f4efe18f0c45528fbcb581ce9 Russian cyber firm Kaspersky to shut down US operations after ban https://www.cnn.com/2024/07/15/tech/russian-firm-kaspersky-lab-ban/index.html We can do some generic clean up if you like, but as far as any malware threats the system looks to be okay at this time. If you would like to do some generic clean up, please RESTART the computer and get me some NEW, fresh logs. Scan with Farbar Recovery Scan Tool https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/ Scan with FSS Farbar Service Scanner https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/ Scan with SecurityCheck by glax24 https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/ It's late for me now, but I'll assist you further tomorrow. Cheers Link to post Share on other sites More sharing options...
KevinG316 Posted October 9 Author ID:1665628 Share Posted October 9 Thank you for the quick reply ! @AdvancedSetup As long as there are no malware in my laptop. My concern have been solved ! However, just in case can i do a clean install for a peace of mind ? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 9 Root Admin ID:1665630 Share Posted October 9 Yes, you can but that seems a bit aggressive. Clean Install Windows 10 & 11 (2024) https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587 Link to post Share on other sites More sharing options...
KevinG316 Posted October 9 Author ID:1665631 Share Posted October 9 And how can i remove Farbar Recovery Scan Tool ? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 9 Root Admin ID:1665633 Share Posted October 9 Excellent, glad to hear all is well again. I'll go ahead and close your topic now and wish you well. Please follow the directions below to remove the logs and tools we've used. If any are still left after that you can manually uninstall or delete them. Take care and stay safe out there. Try to follow as much of the advise below as you can as well. Let's go ahead and do some clean-up work and remove the tools and logs we've run. Please download KpRm by kernel-panik and save it to your desktop. right-click kprm_(version).exe and select Run as Administrator. Read and accept the disclaimer. When the tool opens, ensure all boxes under Actions are checked. Under Delete Quarantines select Delete Now, then click Run. Once complete, click OK. A log will open in Notepad titled kprm-(date).txt. You can close it. We're glad that we were able to assist you. The following information will help you to keep your computer and data safer as well as improve your overall privacy Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site. https://www.howtogeek.com/780233/best-password-manager/ Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/ Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download https://patchmypc.com/about-us Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2 Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security Malwarebytes Browser Guard Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/ uBlock Origin Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin Cybersecurity basics & protection Everything you need to know about cybercrime https://www.malwarebytes.com/cybersecurity Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog https://blog.malwarebytes.com/ Hopefully, we've been able to assist you with correcting your system issues. Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal Link to post Share on other sites More sharing options...
KevinG316 Posted October 9 Author ID:1665640 Share Posted October 9 Hi @AdvancedSetup , may i ask how can i uninstall Farbar recovery scan tool and Adw clean up. And thank so so much for assist me in this situation, Im really appreciate your effort !! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 9 Root Admin ID:1665656 Share Posted October 9 I posted above how to remove the tools. Please follow the directions here Let's go ahead and do some clean-up work and remove the tools and logs we've run. Please download KpRm by kernel-panik and save it to your desktop. right-click kprm_(version).exe and select Run as Administrator. Read and accept the disclaimer. When the tool opens, ensure all boxes under Actions are checked. Under Delete Quarantines select Delete Now, then click Run. Once complete, click OK. A log will open in Notepad titled kprm-(date).txt. You can close it. We're glad that we were able to assist you. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now