Trojan virus

[KevinG316]

Few days ago my laptop start to have a slow performance and heavily influence to my wifi until yesterday, window defender have notice a trojan under this name: trojan:JS/Obfuse.HNAT!MTB. The trojan have been move to quarantined and i have removed it. I also did couple full scan and offline scan and there are no threats identify. But im afraid the trojan may lurking somewhere and not completely go away. Is there anything i can do. Please help me...

 

I have attached a image below when window defender identify the trojan. 

[Porthos]

@KevinG316

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please do all of the requested scans in order and attach all of the results in your next reply.<<<<< Important.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point  <<<<< Important.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup   Windows 8 and newer only <<<<< Important.
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes
      RESTART the computer <<<<< Important.
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case. <<<<< Important.

 

Thank you

[KevinG316]

Hi im sorry for the long reply, here's is the txt doc after using the three app

 

Please let me know if you need anything else. Thank you so much for helping me !

Addition.txt FRST.txt Malwarebytes Scan Report 2024-10-09 022144.txt AdwCleaner[C01].txt

[AdvancedSetup]

Hello @KevinG316

The logs don't indicate an obvious infection.

You appear to be using the  Cốc Cốc Web browser which is not detected as a default browser and the .js JavaScript file it is or was using could possibly have been a False Positive from Microsoft.

However, I also cannot seem to find any current information such as history of updates, etc. The last posting on their main website looks to be almost 2 years old. If a web browser is not constantly being updated it is heavily at risk or compromise.

Unless there is a good, strong reason to be using that browser I would recommend you switch over to either Firefox or Brave browser as they're updated by very large teams around the clock.

 

You also appear to have Kaspersky antivirus installed. Please open Kaspersky and check for updates. Then do a Full system scan and let me know if it finds anything or not.

Thank you

 

 

[KevinG316]

Hi @AdvancedSetup thank you for replying !

I want to explain a bit more about this situation. As soon as Window Defender notify me about this trojan, i immediately removed the trojan by using Window Defender as well as uninstalling Coc coc and switched to Edge as a temporary browser. After that i do a couple full scan and offline scan before downloading Kaspersky to do full scan again. In the end there are no threat or virus identify on both off the AV. Is there anything else i need to do ? 

 

Thank you !

[AdvancedSetup]

The choice is yours. If you don't live in the United States then you can keep Kaspersky installed if you like.  @KevinG316

However, if you live in the United States you should uninstall it

 

Kaspersky will shutter US operations after software is banned by Commerce Department, citing risk
https://apnews.com/article/cybercrime-kaspersky-ban-russia-6171421f4efe18f0c45528fbcb581ce9

Russian cyber firm Kaspersky to shut down US operations after ban
https://www.cnn.com/2024/07/15/tech/russian-firm-kaspersky-lab-ban/index.html

 

We can do some generic clean up if you like, but as far as any malware threats the system looks to be okay at this time.

If you would like to do some generic clean up, please RESTART the computer and get me some NEW, fresh logs.

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

It's late for me now, but I'll assist you further tomorrow.

Cheers

 

 

[KevinG316]

Thank you for the quick reply ! @AdvancedSetup

As long as there are no malware in my laptop. My concern have been solved ! However, just in case can i do a clean install for a peace of mind ? 

[AdvancedSetup]

Yes, you can but that seems a bit aggressive.

Clean Install Windows 10 & 11 (2024)
https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587

 

[KevinG316]

And how can i remove Farbar Recovery Scan Tool ? 

[AdvancedSetup]

Excellent, glad to hear all is well again. I'll go ahead and close your topic now and wish you well.

Please follow the directions below to remove the logs and tools we've used. If any are still left after that you can manually uninstall or delete them.

Take care and stay safe out there. Try to follow as much of the advise below as you can as well.

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt. You can close it.

 

We're glad that we were able to assist you.

 

The following information will help you to keep your computer and data safer as well as improve your overall privacy

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/780233/best-password-manager/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Cybersecurity basics & protection
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity

 

Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal

 

[KevinG316]

Hi @AdvancedSetup , may i ask how can i uninstall Farbar recovery scan tool and Adw clean up. And thank so so much for assist me in this situation, Im really appreciate your effort !!

[AdvancedSetup]

I posted above how to remove the tools. Please follow the directions here

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt. You can close it.

 

We're glad that we were able to assist you.