Since everything I tend to find about this infection points to info/password stealer.
Do not use or do anything on this computer that would use or connect to anything sensitive, as in banking and other tasks related. Also, can connect to other computers through servers connected to this one.
If you run the risk of losing material and or delicate information the best solution from here if we can't locate the infection would be to have this computer reformatted. Honestly, thats the best and safest thing to do.
We can remove those items found, and run another tool in an attempt to locate where this is hidden but, I don't think we can find it thus the design of the trojan.
All that was found to be infected was located in C:\Users\Public => folder
Finding articles that say this can be deleted and other articles saying it's not a good idea so not sure what the best solution is for that.
Let's try a couple of things.
Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)
highlight on the text below and select Copy.
beginning with
Start:: and finishing with
End::~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Highlight the entire content of the quote box below and select Copy.
Start::
CloseProcesses:
CreateRestorePoint:
C:\Users\Public\ghjjjkkjkj
C:\Users\Public\dad.txt
C:\Users\MSSQLSERVER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64b1[8].cab
C:\Users\Public\20207517556\x.txt
C:\Users\MSSQLSERVER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64b1[9].cab
C:\Users\Public\20207521533\x.txt
C:\Users\Public\20207522545\x.txt
C:\Users\Public\20207517556\x.txt
C:\Users\Public\20207517556\x.txt
C:\Users\Public\20207523557\x.txt
C:\Users\Public\20207522545\x.txt
C:\Users\Public\20207521533\x.txt
C:\Users\Public\20207522545\x.txt
C:\Users\Public\20207521533\x.txt
C:\Users\Public\202076169\x.txt
C:\Users\Public\dad.txt
C:\Users\Public\dad.txt
C:\Users\Public\2020765658\x.txt
C:\Users\Public\2020762621\x.txt
C:\Users\Public\20207523557\x.txt
C:\Users\Public\20207523557\x.txt
C:\Users\Public\2020767610\x.txt
C:\Users\Public\202076169\x.txt
C:\Users\Public\2020765658\x.txt
C:\Users\Public\202076169\x.txt
C:\Users\Public\2020768622\x.txt
C:\Users\Public\2020767610\x.txt
C:\Users\Public\2020767610\x.txt
C:\Users\Public\2020768622\x.txt
C:\Users\Public\2020768622\x.txt
C:\Users\Public\2020762621\x.txt
C:\Users\Public\2020762621\x.txt
C:\Windows\Temp\*.*
EmptyTemp:
End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.
Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Download the latest version of TDSSKiller from http://www.bleepingcomputer.com/download/tdsskiller/dl/4/
- Doubleclick on TDSSKiller.exe to run the application
- Then click on Change parameters.
- Check the boxes beside Verify Driver Digital Signature, Detect TDLFS file system and Use KSN to scan objects , then click OK.
- Click the Start Scan button.
- If a suspicious object is detected, the default action will be Skip, click on Continue.
- If malicious objects are found, they will show in the Scan results and offer three (3) options.
- Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
- Get the report by selecting Reports
- Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
- Please copy and paste its contents on your next reply.
Please post these logs when finished.
