I found a directory in my windows user account that seemed odd:
C:\Users\Troy\AppData\Local\aron\ which contained several files - one of which named “windows.exe” which was running as a service that I could not locate in services
Another file was named 1.cmd which I opened in text and it had the following command:
“svchost -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u andalousy8@gmail.com -p x”
Avast never caught anything but when I ran the suggested scans using Malwarebytes, it did pick it up.
I’ve attached the suggested log files. Thank you for any help and suggestions
LOL, that would be a BTC mining trojan/malware. Yes, that sucks. Not, it’s not bad. It just can kill your hardware really fast. (Is your CPU always at 100% or GPU?)
OK, so let’s start with the basics before I say or continue anything else.
I like you, epic job on posting some dudes gmail account he’s using for BTC mining. (I really hope that isn’t yours… Because, that’d suck…)
Do you bitcoin mine by chance? The code you posted there goes to a pool for bitcoin mining, that’s his (your? I hope not…) username (I don’t suppose you have the password too… because “x” doesn’t work. (You’re Australian right? If you are, send that email to the AFP (Australian Federal Police) and report it as Cyber Crime. )). If not, send it to your countries version of the FBI. (RCMP (CDN), FBI (US), AFP (AU), NCA (UK) to name a couple)/
If you don’t mine: ZIP all those files (including the one you’ve already deleted via MBAM) and attach them with that email to the AFP. Also, send them to a dropbox or something. I’d like to see if someone signed them.
Yes, courtesy of a moderator here… I found that out. (Mod’s can see your IP address so if you misbehave they just ban the IP)
You and I are both Canadian. Reason I asked if you were Aussie is because one of your Windows update files has -au… short for Australia.
The RCMP here usually deal more with Child Porn more then financial stuff, but I’m sure they’ll enjoy the break. I will also send them a tip on that email. (I actually seriously considered dropping Computer Science to go out to “The Depot” in Sask to train for general policing then to go into [Investigative] Cyber Security.)
As for how it got on… Couple ways. Anything from an email attachment, to trojan horse to a hacked website. There are so many ways you can be infected, it’s impossible to list them all.
Ideally, dbrise (or someone else, like Magna or Twin) will be with you sometime today or tomorrow. (dbrise is also Canadian. I want to say he’s in BC, but I’m not sure.) They’ll be the ones who actually help remove the files.
I’ll see about giving J Division a call tomorrow and letting them know (If that’s alright with you that is.).
Since you’ve zipped the files, you can remove the other ones to stop the mining. They’ll kill your hardware. (If you do delete those files before someone comes to see you, just post a fresh FRST log. Saves them from asking)
I don’t see traces of miner in logs so I can say you are now clean. As for GWX it is leftover from Windows 7/8.1 to 10 upgrade application and you can safely delete them.
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
