Suspected BitCoin Mining Virus - Help!

Viruses and worms
1

I started getting error messages that my hard drive is out of space, even though I should have several tens of GB free. I started deleting files, which would temporarily clear up hard drive space, but then I would get the same error message again! I ran a WinDirStat, and saw that my AppData/Temp folder seems to be much larger than it should be - like over 100 GB. I looked at it, and it appears to have ton of folders, each that looks like the attached image (.exe and .cl files, including one called “darkcoin.cl”). I’m not bitcoin mining (at least by choice) so I think my machine was turned into one!

I’ve tried running full anti-virus scans, including anti-malwarebytes, and it doesn’t seem to be cleaned out. Any thoughts?

I’m attaching the logs this forum recommends. Thanks!!!

2

The log from MBam is missing.

3

My fault! Here it is. Please note I ran ccleaner in between the first post and running MBam just now, and it seems like maybe that cleaned things up??? (Crossing fingers). Should I run the other scans again? Thanks!!

4

There are few malware experts in the forum now, so if you dont recive help in 48hours i recomend you try

Geeks to go forum > http://www.geekstogo.com/forum/

Malwarebytes forum > https://forums.malwarebytes.org

5

If you are not receiving help anywhere else, then please do the following:

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Pando Media Booster
QuickTime 7
Settings Manager

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[b] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/b]Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!