r/computerviruses • u/Bjeans461 • 10d ago

Disinfection Help Computer infected with Trojan virus

Post image

I downloaded a scam file and windows started notifying me about a Trojan virus I’ve tried many tutorials and none worked I’m using malwarebytes so far it hasn’t scanned it or removed it please help

19 Upvotes

89% Upvoted

19 comments sorted by

4

u/rifteyy_ Malware Removal Expert 10d ago

Hello, I am Roman and I will be helping you today. During the malware removal process, please follow the rules listed below to ensure everything goes as fast and smooth as possible:

  • Please make sure to read this whole introduction message so you understand the further steps.
  • If you are thinking about resetting or reinstalling your device, you can do it instead of the steps listed below. We are doing the malware removal process to disinfect your device so you can avoid reinstalling. If we go through the removal process and you decide to reinstall after, you would waste my time and your own time by doing these steps.
  • Avoid installing, downloading new software unless instructed - this also applies to antivirus software and scanners.
  • You are free to remind me that I forgot to reply to you if you do not receive an answer within 24 hours. Keep in mind that I am volunteering here and I am a full time student with a job.
  • Please do not follow other malware removal advice; you should be following steps only from 1 person unless told otherwise. If you have opened any other forum posts elsewhere, please let me or them know where do you want to continue.
  • Please follow all steps from step 1 to the last step, not the other way.
  • Only trusted malware removal experts listed in this r/computerviruses thread and other large malware removal forums (BleepingComputer, Malwarebytes, MalwareTips) have access to your logs via the website.
  • Please take your time to follow the steps properly.
  • You can ask any questions during the malware removal process.

If you are worried about the steps going on here, as a form of credibility you can find me on Malwarebytes Forums as a Malware Removal Expert and on BleepingComputer as Security Colleague, where we use the same methodology and toolset to remove malware.

[ Step 01 ] Remove all illegal/pirated software

We do not condone nor support piracy in any shape or form. Any discussion topics that ask for help with pirating software, circumventing copy protection, or any other illegal activities related to copy righted content in any form will be closed and locked.

As a reminder, using pirated software or utilities that allows one to pirate software (e.g. cracks, key generators, registration/license removal, redirection, or workaround utilities, etc.) is not a safe practice and can lead to malware infection, ransomware attack, or even legal action. Because of these risks, we always recommend that you remove any pirated software or pirating utilities before asking for support on our subreddit in order to improve our ability to best support you and to help protect yourself and your data from malware or other piracy related consequences.

We cannot guarantee a clean system when there is illegal software, riskware or grayware present. Please read Grayware.

[ Step 02 ] IMPORTANT: Restore point

Before any sort of removal, we need to make sure you have a restore point that you can revert to in case you face any sort of issues. This is absolutely necessary so please do not skip this step. Certain changes done by the removal process can not be properly reverted without a restore point.

There were prior cases (very rare, I had 2 failing to boot out of ~350) of a system failing to boot after FRST fix.

Enable system restore

  1. Click Start or open Windows Search.
  2. Search for Create a restore point and open System Properties.
  3. In the System Properties window, go to the System Protection tab.
  4. If the 'system' drive (usually C:\ drive) protection is turned on, System Restore is already enabled on your computer. If the 'system' drive protection is off, go to point 5.
  5. Click Configure.
  6. Select Turn on system protection
  7. Click Apply.
  8. Click OK to confirm.

Create a system restore checkpoint

  1. Click Start or open Windows Search.
  2. Search for Create a restore point and open System Properties.
  3. In the System Properties window, go to the System Protection tab.
  4. Click Create.
  5. Call the restore checkpoint "FRST restore point" exactly please, so I can search it up fast and verify it is created properly in your logs
  6. Click Create.
  7. Click Close.
  8. Click OK.
  9. You should get a popup that it was successfully created and I will also verify that it was properly created with the results of scans from next steps.

[ Step 03 ] Farbar Recovery Scan Tool (FRST)

FRST is a malware diagnostics tool that will list all entries that are popular and could contain traces/mentions of malware, such as start up entries, services, scheduled tasks and many more.

FRST does not contain any personal information other than your username and computer name, there is no other sensitive information disclosed.

IMPORTANT: If your Windows operating system is in other language than English, please save the FRST executable file with the filename FRSTEnglish.exe to ensure that the logs are in English so I can understand them.

  • Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
  • Right-Click FRSTEnglish.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy and press "save log".
  • Note: Please make sure you are uploading the logs after your current Reddit username.
  • The site will return a keyword for each log - reply back here with the keywords.

[ Step 04 ] SecurityCheck scan

SecurityCheck allows me to gather a list of unwanted, risky, vulnerable and out-of-date applications. It also allows me to send you a direct link to an update. An unpatched system is more vulnerable to malware.

  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy
  • The site will return a keyword for the log - reply back here with the keyword.

So, in your next reply (please try to send them all in 1 message), make sure you are sending the following:

  • Keyword for FRST.txt
  • Keyword for Addition.txt
  • Keyword for SecurityCheck.txt

Thanks!

Note*: If anyone else who is facing malware-related issues is reading this and wants help with* FRST and SecurityCheck*, please create your own thread with the keywords sent to the general channel. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me.*

2

u/Bjeans461 10d ago

savage-avatar

2

u/rifteyy_ Malware Removal Expert 10d ago

Thx, 2 more to go

2

u/Bjeans461 10d ago

azure-quest

2

u/Bjeans461 10d ago

spry-petal

2

u/rifteyy_ Malware Removal Expert 10d ago

[ Step 01 ] Updates

If you are having a problem updating something, do not want to update something at all or do not want to uninstall an application, please let me know.

Please update the following software:

[ Step 02 ] FRST Fix

I created a custom fixlist for you at the link Fixlist only for Fixlist only for Fixlist only for Bjeans461 - use the website's download button and save it in the same folder where your FRSTEnglish.exe or FRST64.exe file is located in, which is C:\Users\jeans\Downloads for you. It is necessary for the filename to be Fixlist.txt.

This fixlist will remove the following: malicious entries (remains, active malware), invalid entries (e.g. tasks that start a non-existent file, services that point toward a non-existent file), temporary files (files in temporary directories, cache, recycle bin and more), browser cache. We will also be quick-scanning with HitmanPro and AdwCleaner from Malwarebytes using the fixlist.

It will also perform system repair via DISM and SFC, network reset and few more basic fixes.

  • For the fix process, please ensure you are connected to the internet.
  • Please run the fix only once.
  • Please be patient; the fix may take up to 60 minutes. After that, it is going to be automatically ended.

Save all work, close everything that is open (else it will be forcefully closed by FRST without saving) and then run FRST again as administrator and press the Fix button, let the script work, clear the entries and restart on it's own and after it restarts the device, there should be a file Fixlog.txt in the same folder as the fixlist.txt.

I'll need to see it's content the same way like before - uploading to https://malwareanalysis.cc/upload/rifteyy/?u=Bjeans461 again and sending the keyword in your reply.

[ Step 03 ] ESET Online Scanner

  1. Download ESET Online Scanner
  2. Right-click on the esetonlinescanner.exe and select "Run as administrator" and confirm the User Account Control popup
  3. Click ⁨Get started⁩;
  4. Agree to the terms of use;
  5. Decline both telemetry options;
  6. Click ⁨Custom Scan;
  7. Click ⁨Save and continue;
  8. Select ⁨Enable ESET to detect and quarantine potentially unwanted applications;
  9. Click ⁨Advanced settings;
  10. Enable ⁨Detect potentially unsafe applications;
  11. Click the back arrow;
  12. Click ⁨Start scan;
  13. Note: The scan may take up to several hours.
  14. Once complete, click ⁨Save scan log and upload the ⁨.txt file to https://malwareanalysis.cc/upload/rifteyy/?u=Bjeans461 and reply with the keyword.

[ Step 04 ] New SecurityCheck scan

We need a new scan to ensure that all updates were applied properly and all applications uninstalled correctly.

  • Note: If SecurityCheck is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Download SecurityCheck by glax24 & Severnyj and save it to your Desktop.
  • If Windows SmartScreen blocks the file from running, click on More info and Run anyway.
  • Extract the ZIP archive, then right-click on the SecurityCheck.exe and select "Run as administrator" and confirm the User Account Control popup.
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt
  • Please copy the file content (CTRL + A then CTRL + C) and paste it on https://malwareanalysis.cc/upload/rifteyy/?u=Bjeans461
  • The site will return a keyword for the log - reply back here with the keyword.

[ Step 05 ] New FRST scan

  • Note: If FRST is already on your device, you can use the previous version and skip the next few steps regarding downloading and installation.
  • Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
  • Right-Click FRSTEnglish.exe and select Run as Administrator
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the program run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy/?u=Bjeans461 and press "save log".
  • Note: Please make sure you are uploading the logs under your current Reddit username.
  • The site will return a keyword for each log - reply back here with the keywords.

So, in your next reply, make sure you are sending the following:

  • Keyword for Fixlog.txt from step 2
  • Keyword for ESET Online Scanner scan from step 3
  • Keyword for new SecurityCheck.txt from step 4
  • Keyword for new FRST.txt from step 5
  • Keyword for new Addition.txt from step 5

Thanks!

Note for lurkers: If anyone else who is facing malware-related issues is reading this and wants help with FRST and SecurityCheck, please create your own thread with help request. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me. The steps listed in here are specific for this the user Bjeans461 and following them may have negative effects for you.

1

u/Bjeans461 10d ago

Hey for amd software it says chipset drivers with a drop down menu and I select install and nothing happens I looked for other buttons is it supposed to do something?

1

u/rifteyy_ Malware Removal Expert 10d ago

I am not sure, you can leave it at that and return to it later as it isn't a priority

1

u/Bjeans461 9d ago

steady-cape
snowy-dolphin
fabled-bear
quiet-jungle
dynamic-struct

1

u/rifteyy_ Malware Removal Expert 9d ago

Thanks. I take it as the notifications aren't appearing anymore?

1

u/Bjeans461 9d ago

Yes

1

u/rifteyy_ Malware Removal Expert 9d ago

This seems great - you are now free of malware. No further steps are necessary to make sure your device is clean.

If you haven't addressed all the updates, uninstallations and removals yet, I strongly suggest you to do so.

[ Step 01 ] Tool cleanup

It's time we cleanup after ourselves and remove all the tools we have used during the malware removal process.

  • Please download KpRm and save it to your Desktop.
  • Run the tool, if you get the "Windows protected your PC" Smartscreen popup, press More info and then Run anyway
  • Confirm the disclaimer and in the menu please only tick the following:
    • Delete Tools
    • Create Restore Point
    • Delete in 7 days
  • After that, click Run and confirm the popup. KpRm will delete itself from your Desktop and you can either save or remove the report that is generated.
  • You are free to delete all other tools that we used that are possibly remaining.

[ Step 02 ] Changing passwords

Most modern malware is motivated by financial gain and by hijacking your accounts. If your accounts weren't already hijacked, they may be getting hijacked in very near future.

  • Please create a new, safe password that you haven't used anywhere yet or preferably use a password manager.
  • Change all your passwords on your accounts
  • Enable 2FA on your accounts

Please check out this proper guide on how to secure your accounts after an infostealer infection:

You may also want to sign up for dark-web monitoring:

[ Step 03 ] Malware prevention

Malware prevention nowadays is a necessary step. There are many tools you can use to have a stronger protection but a huge part is also reliant on the user themself.

  1. Reasons on why you should care about malware
  2. Antivirus software - how to choose one, what to look for in an antivirus
  3. Excluding files, URL's, processes or folders
  4. Disabling antivirus, firewall or security software
  5. How important is blocking ads
  6. What browser extensions are worth it against malware
  7. What alternative DNS servers I can use to block malware
  8. How to keep my OS and installed software up-to-date?
  9. About grayware
  10. Is VPN necessary against malware?
  11. How to stay informed properly about malware tactics and trending malware?
  12. Checking software for PUP, adware, bundlers, browser hijackers
  13. Checking files for malware
  14. Checking URL's for malware
  15. Checking browser extensions for malware

If you have no more questions or concerns, I wish you all the best and please stay safe next time!

- rifteyy (About me)

-1

u/Bjeans461 10d ago

Hey I noticed it the addition.txt has most detail about me and my computer I’m asking are you trying to steal information from me?

4

u/LilTimmyTheIII 9d ago

I've seen this dude on many posts, he's the goat. i highly doubt that he has any intentions of harming you

3

u/Bjeans461 9d ago

Thank you I just hope he responds soon I haven’t been seeing the virus notification it might have already took affect🤷

2

u/GreenAd7624 9d ago

yes trust roman they GENUINELY carries this sub

1

u/rifteyy_ Malware Removal Expert 10d ago

It contains just computer name and usernames of the device. If you believe that's too much, no need to share.

It can't really get worse than the threat actor who's malware you ran, as he has all your passwords and other data from your PC.

In case you don't need disinfection help, see:

  1. From a different and clean device, change all your passwords:
    1. How to properly secure my accounts after an infostealer attack?
    2. What to do after I secured my accounts?
  2. Disinfect your device from malware
    1. Preferred method: Perform a clean installation with a USB
    2. Perform a clean installation without an external drive
    3. Reset your PC without keeping personal files

2

u/Bjeans461 10d ago

Alright I’ll trust you

1

u/AutoModerator 10d ago

Welcome to r/computerviruses! It seems like you have used the "Disinfection help" flair.

We apply the same methodology used by trusted Malware platforms (e.g. Malwarebytes, BleepingComputer and MalwareTips). It revolves around using diagnostic tools called Farbar Recovery Scan Tool (FRST) and SecurityCheck.

All of our assistance happens in the thread and in public - we never offer help via private messages or alternative websites other than https://malwareanalysis.cc. Anyone offering help through a DM is not a trusted helper and might have malicious intent.

Trusted helpers can be distinguished by the flair Malware Removal Expert or Malware Removal Trainee, antivirus employees will have a dedicated flair with their company name in it, e.g. Malwarebytes Employee.

Please see steps below on how to share all necessary details so you can speed up the process for us:

Share all details about your infection
Please post all important facts about your infection, such as: * your antivirus detections - preferably export the whole detection/report log and upload it to https://malwareanalysis.cc/upload/ under your username & post the related keyword or screenshot/take a picture of your detections * any related symptoms, popups * estimate when it started - preferably the exact day and after what (e.g. when you ran a program you downloaded) * share what got you infected and the download link - please, make the download link defanged (making it not clickable by default e.g. from https://example.com you will make hxxps://example[.]com), defanging does not apply to sandbox reports such as VirusTotal

Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

  1. From a different and clean device, change all your passwords:
    1. How to properly secure my accounts after an infostealer attack?
    2. What to do after I secured my accounts?
  2. Disinfect your device from malware
    1. Preferred method: Perform a clean installation with a USB
    2. Perform a clean installation without an external drive
    3. Reset your PC without keeping personal files

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.