Hi. After finding it mysterious that several trojans tried to get into my computer and that MalwareBytes hasn’t been updated, and that Avast had been generating BSOD every time I tried running it, I decided to uninstall and and then reinstall it and update it (MalwareBytes, that is). After running the scan it found two objects, both of which it said that it quarantined. However, I’m afraid that traces of it may still be in my system. I shall post the two things I found.
To start with these are registry entries, on there own they are inert in these registry keys there would or should be a command to point to a different file.
Could you tell me how to bring it up? I’m using a different laptop right now than the one that was infected, and the infected one is currently running another MalwareBytes scan.
Open MBAM main Scanner window and click the Log tab, select the relevant log and double click it, copy and paste the contents of the log into your next post. Or when you double click on the log it opens in notepad you can select save as, that will show you where the file is located, you can find and attach that to your post.
On an additional note, I found something strange while going through my network connections. In addition to “YUGGOTH”, the name of my system, and RENEE-PC, my mother’s, there was something called NELARINA. I don’t know if it is relevant or not, but when it disappeared from the Network page, my internet connection suddenly died. So far it is staying away, but I have no clue when it will be back. Might it be related to my current problems?
I chose to delete them. Currently, I’ve been able to solve all of the problems I was encountering. I still want to know all I can about the things that were in my ocmputer, however.
From the registry keys in the MBAM log, this is the Bad File, “C:\Users\Eric\AppData\Local\hcx.exe” that is the one that the registry keys are trying to substitute for iexplore.exe and the launching of .exe files (this would no doubt inject some code into each launched .exe file.
Check the the physical presence of this file “C:\Users\Eric\AppData\Local\hcx.exe” ?
The AppData folder and its sub-folders may be hidden. Change the windows explorer > Tools > Folder Options > View tab, and check the ‘Show Hidden Files and Folders’ option.
I suspect that it won’t be there as I would have expected MBAM to have reported it too or you are likely to be experiencing other malware symptoms. But if it is present check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here, post the URL in the Address bar of the VT results page.
If multiple scanners detect this file as malware - Send the sample/s to avast as a Undetected Malware:
Open the chest and right click in the Chest and select Add, navigate to where you have the sample and add it to the chest (see image). Once in the chest, right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update. Note: manually adding to the chest doesn’t remove them from the original location, so they still have to be dealt with in that location.