Someone accesses my laptop while I'm sleeping.

He recently accessed my social accounts from my laptop, to post spam and cryptocurrency topics to steal information.

I've changed all my passwords to avoid that but it still happens. Google history detects connections from my same laptop at times when I am not using it, I already ran a scanner with Malwarebytes and Hitman Pro following a Tutorial, but today it happened again now with my email account and I log in to a Huobi account.

 

On February 25, the Windows antivirus detected the following after running an Installer: Trojan:Win32/Midie!MTB, Trojan:Win32/Synder!ic, Trojan:Win32/Amadey!MTB and Trojan:Win32/XMRig.A! MTB.

Everything was put in Quarantine and Deleted by the Antivirus but I don't think it was solved, can it help me so I don't have to format my laptop.

Greetings and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

Please do this.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

• Download Farbar Recover Scan Tool for 64 bit systems and note where the file is saved (Desktop, Downloads, etc.) <<< Important
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of each report in separate reply windows

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• FRST.txt
• Addition.txt

Dear Gary,

 

I show you the information obtained.

 

-------------------------------------------------------------------------------------------------------------

 

We have a bit of a mess on our hands.

Please navigate to your C:\Users\flash\Downloads folder and examine the contents. Let me know if there are any files you don't recognize.

Please do this.

===================================================

Removing Edge Extensions

--------------------

• Launch Edge
• Type edge://settings/profiles in the address bar and hit Enter
• Report whether Sync is on or off. If necessary select Sign out
• Click Sign out on the pop up screen
• In the address bar type edge://extensions and hit Enter
• Remove the following:

Billetera de Binance
Coinbase Wallet extension

• Close Edge, relaunch it and check for the extension

===================================================

Removing Chrome Extensions

--------------------

• Launch Chrome
• Type chrome://settings/syncSetup in the address bar and hit Enter
• If necessary Turn Off Sync and report whether or not that was necessary
• In the address bar type chrome://extensions and press Enter
• In the upper right corner of the window slide the Developer mode button to the right
• Remove the following, along with any other extension you don't recognize or don't want:

Billetera de Binance
Coinbase Wallet extension

• Close Chrome

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
Zip: C:\Users\flash\AppData\Roaming\shpafact
zip: C:\Users\flash\Downloads\ChromeSetup (1).exe
Folder: C:\Users\flash\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\4
Task: {21F965B6-9642-448C-8615-7AD3376447D7} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe  -auto (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
Task: {56B2D505-06BA-41F0-B629-A18A7F2F2447} - System32\Tasks\Oem\AcerJumpstartTask => "C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe"  /default (No File) 
Task: {21F965B6-9642-448C-8615-7AD3376447D7} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe  -auto (No File) 
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
Task: {56B2D505-06BA-41F0-B629-A18A7F2F2447} - System32\Tasks\Oem\AcerJumpstartTask => "C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe"  /default (No File) 
Task: {fe175258-994c-4985-a2c0-084b2cc4a6a1} - no filepath. <==== ATTENTION 
Task: {fe175258-994c-4985-a2c0-084b2cc4a6a1} - no filepath. <==== ATTENTION 
2024-02-25 19:42 - 2024-02-25 19:42 - 000393216 _____ C:\Users\flash\Downloads\06e624f4-16b2-4e04-9af2-daaeb8389288.tmp 
2024-03-02 16:34 - 2024-03-02 16:34 - 006970144 _____ (VS Revo Group ) C:\Users\flash\Downloads\Sin confirmar 28658.crdownload 
CHR HomePage: Default -> hxxp://www.ask.com/?l=dis&o=15383cr
S3 GSDriver; \SystemRoot\System32\drivers\GSDriver64.sys [X] 
S3 SrvcWTDMIOMngr; \??\C:\OEM\OA30\WTDMIoMngr.sys [X] 
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Powershell: Get-MpThreatDetection
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create 2 zipped folders on the Desktop with today's date, example: 07.30.2023_13.24.50.zip. Please upload the files here.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Downloads folder?
• Extensions removed?
• Fixlog
• Uploaded zip folders

Edited by Oh My!, 03 March 2024 - 05:33 PM.

• Downloads folder: OK
• Extensions removed: Edge OK Chrome Unistalled
• Fixlog

• Uploaded zip folders: How do I upload files?, I can't find the option

The 2 zip folders are located here:

C:\Users\flash\OneDrive\Escritorio\03.03.2024_16.22.38.zip
C:\Users\flash\OneDrive\Escritorio\03.03.2024_16.22.39.zip

Did you upload them here? I didn't receive them.

Dear Gary,

 

That's it, I've sent the files

 

Regards

Thank you.

I suspect you were hit with a Backdoor Trojan delivered via a .zip file downloaded from other than a trusted source. Though I can't find conclusive proof one of the files you uploaded is responsible, there is enough suspicion combined with the symptoms you describe to conclude there should be concern your computer is vulnerable.

Since attempting to resolve this would likely include the removal of much of your downloaded files, let me provide you with some information to consider before deciding what you would like to do.

===================================================

BACKDOOR WARNING

--------------------

One or more of the identified infections is a Backdoor Trojan.

This allows hackers to remotely control your computer, steal critical system information, and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable. Please let me know if you have already noticed evidences of financial institution irregularities. Those accounts should be monitored from this point forward.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS.
 

Here are some thoughts I have put together for people who ask what they should do in light of the infection. Ultimately each user must decide for themselves what to do and the below are things you might want to consider.

It is necessary for us to at least make you aware of the worse case scenario. This is because of the potential Backdoor Trojans bring with them, but it is not a determination on our part that your situation currently falls within this worse case scenario.

Ultimately it is a personal decision whether to reformat or not. What decision should you make to let you sleep well at night? It is different for different people. I will say whether rightly or wrongly most people decide to clean and not reformat, at least initially.

The only insight I can offer is how I evaluate the issue personally even though I have never had a Backdoor Trojan on my computer. One of the primary purposes for malicious software is to somehow separate you from your money. It seems reasonable to assume that a thief trying to take your money via a Backdoor Trojan will hit you hard, and quickly. Once your computer starts to act up and you become suspicious you have the opportunity to eliminate access to your computer and change the information taken, namely account and password information. The key to this, in my opinion, is whether or not you have noticed any irregularities in your banking or other financial institutions, or things like email and social network accounts (i.e. Facebook). If you have not seen any evidence of that then you may question whether your information has truly been stolen. If it seems it hasn't, and your critical information has been changed, it is reasonable to be more confident you are safe but you must stop short of claiming an absolute guarantee.

If, after careful consideration you decide not to reformat your computer it would be wise to continue monitoring your sensitive data and don't wait to address future symptoms on your computer which seem to be malware related.

The bottom line, the only way to be absolutely sure to be rid of a Backdoor Trojan is to reformat. The decision is yours.

Oh My!

Given your situation I think that is a wise decision.

\\?\Volume{2f6c96fd-73b9-4726-a14e-dfd732cafdc2}\ (Recovery) (Fixed) (Total:1 GB) (Free:0.33 GB) NTFS

You have a Recovery Partition so that will make things a bit easier.

The first thing we want to do is make a backup copy of all trustworthy data files (documents, music, photos). If you want to backup questionable downloads I would recommend placing them on an separate external drive. Do not mix those downloads with other data that you trust. Before reintroducing the "trusted" data files back into a clean system we will scan the files for malware.

You also want to identify all programs you have installed that did not come with the Windows Operating System or as part of the Acer setup. All of those will have to be reinstalled. An example would be WinRAR. You can review the list in the Addition.txt report under Installed Programs and review folders such as C:\Program Files or C:\Program Files (x86). I would also recommend you take a photo of your Desktop if you wish to eventually replicate it. When I do a complete reformat I actually look through every folder to make sure I don't miss a program. Personally I also create an image of my drive.

Once you have backed up your data and identified programs let me know.