View original (French)

Miner.exe, virus?

dingding22 -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,
For the past two days, I feel like I have a virus...
a certain "Miner.exe" keeps crashing often,
so I searched for the problem and saw that I needed "FRST.exe"
following the tutorial, I have 3 links, but I don’t know what to do with them, so if you could help me
that would be very nice of you

FRST.txt: https://pjjoint.malekal.com/files.php?id=FRST_20170823_u14x9f15v6h5
Addition.txt: https://pjjoint.malekal.com/files.php?id=20170823_w10m5u5r9y11
Shortcut.txt: https://pjjoint.malekal.com/files.php?id=20170823_v8u9l11e12v14

1 answer

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Windows key + R,
    In the "Run" field, type notepad and click OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
     HKU\S-1-5-21-2604625461-1616393135-3317735751-1000\...\Run: [audioge.exe] => C:\Users\Admin\AppData\Roaming\mgqHQ4GQN9moRoJMhbfXgMlD183k.exe [1444352 2017-08-19] () 
     HKU\S-1-5-21-2604625461-1616393135-3317735751-1000\...\Run: [Windows Update] => C:\Users\Admin\AppData\Local\Temp\smss.exe [3173376 2017-08-22] () <==== ATTENTION 
    HKU\S-1-5-21-2604625461-1616393135-3317735751-1000\...\Run: [Windows Update] => C:\Users\Admin\AppData\Local\Temp\smss.exe [3173376 2017-08-22] () <==== ATTENTION
    2017-08-22 03:00 - 2017-08-22 03:00 - 000079064 _____ (Malwarebytes) C:\Windows\system32\Drivers\wylbgn.sys
    2017-08-22 02:50 - 2017-08-22 16:44 - 000000000 ____D C:\Users\Admin\AppData\Roaming\2E597AA1-388B-4AFB-BE9F-BFA40350F742
    2017-08-22 02:49 - 2017-08-22 02:49 - 000003460 _____ C:\Windows\System32\Tasks\hpwuSchd
    Task: {B6DDF437-FC3F-4DCD-A9A7-64E851917212} - System32\Tasks\hpwuSchd => C:\Users\Admin\Music\backgroundtskh.exe [2017-08-21] (Venus Exploits)
    C:\Users\Admin\Music\backgroundtskh.exe 
    Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smss.exe [2017-08-22] () <==== ATTENTION
     2017-08-22 02:50 - 2017-08-22 16:44 - 000000000 ____D C:\Users\Admin\AppData\Roaming\2E597AA1-388B-4AFB-BE9F-BFA40350F742 
     2017-08-22 02:49 - 2017-08-22 02:49 - 000003460 _____ C:\Windows\System32\Tasks\hpwuSchd 
     2017-08-22 02:28 - 2017-08-22 02:28 - 000000000 ____D C:\memehax 
     2017-08-21 23:15 - 2017-08-21 23:15 - 000000000 __SHD C:\Users\Admin\AppData\Roaming\1FE211 
     2017-08-21 22:43 - 2017-08-21 22:43 - 001260892 _____ C:\Users\Admin\Downloads\774.rar 
     2017-08-19 07:03 - 2017-08-19 07:03 - 001444352 _____ C:\Users\Admin\AppData\Roaming\mgqHQ4GQN9moRoJMhbfXgMlD183k.exe 
     2017-08-18 17:26 - 2017-08-18 17:26 - 014501888 _____ ( ) C:\Users\Admin\Desktop\Underparty.exe 
    RemoveProxy:
    Reboot:


    Once the text is pasted into Notepad,
    Go to the "File" menu and click "Save As",
    To the left, select the Desktop,
    In the field at the bottom, for the file name type: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click the "Fix" button
    A restart may be necessary (not required)
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    2)

    Open "My Computer" then the "C" drive then the "FRST" folder
    Inside is the "Quarantine" folder, right-click on it,
    Then select from the menu "Send to compressed folder"
    After that, upload the "Quarantine.zip" to http://upload.malekal.com/

    --
    Please press any key to continue the disinfection...
    0