Trojan:win/coinminer.edv - Help

f33dev · Oct 17, 2026 at 10:26 PM

Hello, I'm new here.

I need help, I downloaded a file from a friend that was sent trough email, he said was a game, and now he said he never sent anything but that his computer was infected.

I ran this setup.exe on my windows 11 , there was other folders there RenPy and other stuff.
I think I may have removed it but not sure.

I ran the Setup.exe file and noticed that the computer fans started making noise which normally doesn't and mostly important nothing opened but the loading cursor was spinning, after a while my antivirus Mcafee detected a virus, Trojan:Win/CoinMiner.EDV on C:\ProgramData\Google\p9pjos7\chrome_gputask.exe,
C:\ProgramData\Google\Update\ChromeUpdatePolicy.exe, C:\ProgramData\Google\p9pjos7\ChromeBreakpadHandler.exe, C:\PROGRAMDATA\GOOGLE\BROWSER\LG4IX2WIO3\CHROMESYNC.DLL.
there was also other ones, some Trojan.Generic.
and the think is that it kept detecting and saying that blocked it, but was like spamming it.
At that point I disconected my internet, also malwarebytes blocked some ip:

Trojan
IP: 146.103.114.96
Port: 443
Type: Exit
C:\Users\frede\AppData\Local\QuantumS86.exe

I downloaded Malwarebytes,hitman pro, hitman alert, ESET online tool, kaspersky, sophos endpoint and also ran microsoft's windows built in mrt.
my notebook its been turned on since the 14th of this month when I ran the setup file at 12:28.
After all these days of scanning and scanning through my 3million work files, seems like all of them stopped showing any detections.
Tho Sophos EndPoint Agent detected some stuff that the others diddn't detect tho I gave up on the scan because its been 2 days scanning and didn't finish... (It found something on svchost.exe)

I follow some youtube video of going to the folders where the infection was and deleting it, I removed all browsers that I had that was chrome and firefox.
I ran about 30 antivirus scans, fast, full scan and personalized.

Would you guys recommend anything else, to make sure this viruses are gonna for good?

Thank you for your time and help.

Oh My! · Oct 17, 2026 at 10:45 PM

Greetings and welcome to the Major Geeks Malware Forum.

Let's start with this.

I am ending for the evening but will review the reports first thing in the morning.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

Download FRST64 and save the file on your Desktop

If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english

Right click on the icon and select Run as administrator

Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option

Click Yes to the disclaimer

Click Scan and allow the program to run

When completed, FRST.txt and Addition.txt reports will be saved on the Desktop

Please attach the reports to your reply

===================================================

Things I would like to see in your next reply.

Attached reports

f33dev · Oct 18, 2026 at 6:33 PM

Oh My! said: ↑

Greetings and welcome to the Major Geeks Malware Forum.

Things I would like to see in your next reply.

Attached reports

Click to expand...

Hello there, Oh My! , thank you very much for your reply, below are the attachments:

Oh My! · Oct 18, 2026 at 8:40 PM

It is my pleasure to work with you on this.

Task: C:\WINDOWS\Tasks\ScreenMeetServiceBackupTask.job => C:\WINDOWS\system32\sc.exe9start ScreenMeet.Sup
Click to expand...

Did you knowingly download ScreenMeet Support?

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Malwarebytes (Enabled - Up to date) {A537353A-1D6A-F6B5-9153-CE1CF80FBE66}
AV: Sophos Intercept X (Enabled - Up to date) {68635362-9E8E-AE8C-658B-E4068FDE00B3}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee (Enabled - Up to date) {0BE13B34-492A-21C0-AE43-C1742279CCB6}
FW: McAfee (Enabled) {33DABA11-0345-2098-851C-6841DCAA8BCD}
FW: Sophos Intercept X (Enabled) {5058D247-D4E1-AFD4-4ED4-4D33710D47C8}
Click to expand...

In addition to Malwarebytes, which antivirus program would you like to keep? The others should be removed.

Please do this.

Create a System Restore Point and name it MG. If it is not successfully created stop and let me know.

===================================================

Removing Windows Security Exclusions

--------------------

Note: Exclusions are designed to override some normal Windows Defender protection mechanisms

Click Start, type Security then select Windows Security

Click Virus & threat protection

Click Virus & threat protection settings - Manage settings

Scroll down to Exclusions then click Add or remove exclusions

Click on the down arrow to the right of each entry then select Remove unless you intentionally and specifically allowed the Exclusion. If in doubt, remove the entry.

Close the Windows Security window

===================================================

Farbar Recovery Scan Tool Fix

--------------------

Right click on the FRST64 icon and select Run as administrator

Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied

There is no need to paste the information anywhere, FRST64 will do it for you
Code:
Start::
CreateRestorePoint:
CloseProcesses:
cmd: type "C:\Users\f33dev\AppData\Local\Il2CppDumper.config"
2026-10-02 22:05 - 2026-07-16 21:26 - 000013505 _____ C:\Users\f33dev\AppData\LocalLow\b8c518d85a4aa8418276e78e63359ff92a3c90fb80132a654671ded739ebcd9f
2026-10-04 00:46 - 2026-08-04 00:28 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\ef638a495c1e556e8e9eb350114af1f65e6924a8a0a72d21b58d88454602e43e
2026-10-09 00:20 - 2026-07-21 18:20 - 000238481 _____ C:\Users\f33dev\AppData\LocalLow\61ea1926095310340e93c89911df1b8464415a0304140617b0136843bd201ccd
2026-10-08 22:22 - 2026-07-21 18:20 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\487abbdba293690d6da65537df45b1e72311abfe8b94a044ffa72693ac020e7c
2026-10-09 04:57 - 2026-07-21 18:20 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\791307d7559d21b70ad8b7ddc8ef342abb29eb6a784acf810dca48f9226ed7ff
2026-10-11 01:37 - 2026-07-16 21:23 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\d9d8fb3e284dac5f0729dd0595e435f5c35bcb01de4964a0baacda4fcca645a9
2026-10-14 13:00 - 2026-07-23 21:55 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\8215abb5d66afb94f9af642eca830ee4d9d8e54f1372c5ad92fa33cf187e42d6
2026-10-15 22:58 - 2026-07-16 21:25 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\e5a09415aeb028932b585a7cf1cfda32659b8d7700f409068f7428e85f93598f
2026-10-16 18:47 - 2026-07-17 10:59 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\73d6a03148202e17b285a23b70730ae5b6234c4b1a6eb8153bc79b3543d9fb97
2026-10-16 18:41 - 2026-07-16 21:27 - 002217827 _____ C:\Users\f33dev\AppData\LocalLow\2e13fa5e423396c35bf646ecf887fad530ff82fadec680c9b77ebd632714a3c9
2026-10-16 19:06 - 2026-07-16 21:27 - 000003322 _____ C:\Users\f33dev\AppData\LocalLow\eafc4f2942c7431193001f4d2588cc3d3979aba6f5e2cb63c3f36902f5ffa647
2026-10-17 23:12 - 2026-07-16 22:49 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\404843439bfb6e85bd24adb1b7dffd84c8350a93722c37cb48468baf3b69ac0c
2026-10-18 17:49 - 2026-07-16 21:25 - 000000130 _____ C:\Users\f33dev\AppData\LocalLow\63eaff7c47334bd9228f0593f3d5fbdb88ff9c726e11174d292c38ea2946ad85
C:\Program Files (x86)\Google\Update\Install\p9pjos7r
C:\Users\f33dev\AppData\Local\Temp\bwp55c2a296-bcee-4187-bd69-68c6c22de12e
C:\Users\f33dev\AppData\Local\Temp\dg5200p06UjMrx1P
C:\ProgramData\Google\Browser\lg4ix2wio3
2026-10-14 12:42 - 2026-10-14 12:42 - 000000000 ____D C:\Users\f33dev\AppData\Local\Yandex
Task: {26EA5418-43D4-4B8F-B483-92B89E082BA7} - System32\Tasks\base_component_rel => C:\Users\f33dev\AppData\Local\Temp\dg5200p06UjMrx1P\SmartLab.exe  (No File) <==== ATTENTION
DeleteKey: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dngcpimnedloihjnnfngkgjoidhnaolf]
DeleteKey: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcoeoabgfenejglbffodgkkbkcdhcgfn]
HKU\S-1-5-21-2523309613-1213778252-3982441228-1001\...\Run: [BingWallpaperDaemon] => C:\Users\f33dev\AppData\Local\Temp\bwp55c2a296-bcee-4187-bd69-68c6c22de12e\UnInstDaemon.exe (No File) <==== ATTENTION
S4 GUpdateTaskp9pjos7r; "C:\Program Files (x86)\Google\Update\Install\p9pjos7r\googleupdater64.exe" /svc (No File)
HKU\S-1-5-21-2523309613-1213778252-3982441228-1001\...\StartupApproved\Run: => "BingWallpaperDaemon"
HKU\S-1-5-21-2523309613-1213778252-3982441228-1001\...\Run: [btweb] => "C:\Users\f33dev\AppData\Roaming\BitTorrent Web\btweb.exe" /MINIMIZED (No File)
AppInit_DLLs: C:\ProgramData\Google\Browser\lg4ix2wio3\chrmelf.dll => No File
Task: {2D2C46F2-ADFB-41BE-BA1B-768B34495CCA} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe  -mode=scheduled (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File)
S2 LDPlayerENSvr; "G:\LDPlayer\LDPlayer9\ldplayerserviceEN.exe" (No File)
S2 LDRemoteSvc; "C:\LDPlayer\OSLink\bin\ldremoteservice.exe" (No File)
S3 PRI-Driver; \??\C:\Windows\System32\drivers\PRI-Driver.sys (No File)
CustomCLSID: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001_Classes\CLSID\{50726f74-6f6e-2e56-504e-000000000000}\localserver32 -> "C:\Program Files\Proton\VPN\v4.4.0\ProtonVPN.Client.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001_Classes\CLSID\{6a27a1a9-7be8-1491-04ca-ee68a211c258}\localserver32 -> "C:\Program Files\Google\Play Games\current\service\Service.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001_Classes\CLSID\{819DA794-BB4B-40C5-8912-46E3290C83BD}\localserver32 -> C:\Users\f33dev\AppData\Local\Discord\app-1.0.9260\Discord.exe => No File
CustomCLSID: HKU\S-1-5-21-2523309613-1213778252-3982441228-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => No File
Shortcut: C:\Users\f33dev\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nim-2.2.10\Nim.lnk -> C:\Users\f33dev\Documents\Kiwifydownloader\tools\start.bat (No File)
cmd: netsh winsock reset catalog
cmd: netsh int ip reset resetlog.txt
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Emptytemp:
End::
Click Fix

When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.

WARNING Regarding the Emptytemp: command, please see here before running the Fixlist. If you have concerns stop and let me know.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

Recognize ScreenMeet Support?

Which antivirus program do you want to keep?

System Restore Point created successfully?

Exclusions reviewed?

Fixlog

f33dev · Oct 18, 2026 at 9:15 PM

Oh My! said: ↑

It is my pleasure to work with you on this.

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

Recognize ScreenMeet Support? Yes, I installed this for the Mcafee remote support, but they didn't do much, I'll tell you that, I even sent the virus file to them for analysis but didn't send me an answer back yet.

Which antivirus program do you want to keep?I'll keep Mcafee as I have a permanent subscription with my internet plan, I'll keep malwarebytes until the trial period and then remove it. Now I have a problem I'm trying to remove the Sophos EndPoint Agent but keep asking some anti-tamper password that I never set... found some video on removing it going to regedit but didn't attempt it yet, and I think this is what making my PC so slow because it scans the pc the whole time.

System Restore Point created successfully?Yes

Exclusions reviewed? Yes, I went there but there isn't any in there.

Fixlog: some stuff said not found, because I had run some stuff earlier on to remove the msconfig services for those google update virus things that kept automatidcally iniatilizing even tho the files were removed by the antivirus and by me manually deleting it.

Click to expand...

Thank you Mr. Oh My!

Oh My! · Oct 18, 2026 at 9:19 PM

Ooops, misread the quote.

Something didn't go right with the Fixlist. Let's try it this way.

===================================================

Farbar Recovery Scan Tool - Run Fix Using Attached File

--------------------

Download the attached file and save it in the same location as FRST.exe (example, Desktop, USB device) <<< Important

Right click on FRST and select Run as administrator

Click Fix

The tool will create a log on the desktop called Fixlog.txt

Attach the report to your reply.

f33dev · Oct 18, 2026 at 9:50 PM

sorry about the quoting. Well did it again here is the new fixlog.txt

also is this legit or is the virus again?

Also do you recommend any antiviruses? like maybe a better one then Mcafee?
This is the first time I got a virus, I had this PC for 2 years.

Thank you for your amazing help!!

Oh My! · Oct 18, 2026 at 10:24 PM

I can't do anything without your help.

Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
Click to expand...

It is a bit hard for me to read the screen shot but I think it is legitimate. If it seems to be related to the above quote it should be fine.

Regarding the antivirus issue this is what I have prepared as a response:

I am often asked about which antivirus program should be used. Here is my reply.

Which antivirus to use is an individual choice and I don't make any recommendations. However I don't mind sharing what I have chosen. Personally I use Windows Security (the new name for Windows Defender) along with the paid version of Malwarebytes, Malwarebytes Premium.

Windows Security takes care of updates automatically and is integrated with Windows Update. It works behind the scenes without the need for interaction on my part. I prefer this approach rather than what I experienced with other programs.

Malwarebytes Premium is also very low maintenance and it provides real time monitoring. It is designed to run alongside Windows Defender without causing conflicts. You can run Malwarebytes in "Side-by-Side Mode" so that Windows Security and Malwarebytes Premium are both active at the same time (see Stop Malwarebytes from Turning Off Defender). This is not always the case with 2 antivirus programs. The free version, although very good, is launched manually and therefore addresses what is already on the computer rather than monitoring the computer in real time to stop potential threats. So, I have 2 real time protection programs running at the same time, Windows Security and Malwarebytes Premium. So far I have not become infected. Of course safe computer habits is an integral part of computer security.

Having said all of that, it is a personal decision.
Click to expand...

We need to repair your Windows Image. Please do this.

===================================================

DISM RestoreHealth from Administrator Command Prompt

--------------------

Press the Windows Key, type cmd, then select Run as administrator

Copy and paste DISM /Online /Cleanup-Image /RestoreHealth after the command prompt then hit Enter

Patiently wait as the process may take a long time to complete

When completed report whether the process was successful or an error occurred

===================================================

Things I would like to see in your next reply.

Results?

f33dev · Oct 19, 2026 at 12:13 AM

Thank you for the antivirus recommendations.
Alright, finally finished now:

Code:

Microsoft Windows [version 10.0.26300.9711]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\System32> DISM /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.26100.9549

Image Version: 10.0.26300.9711

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\Windows\System32>

Oh My! · Oct 19, 2026 at 8:52 AM

Perfect.

If you have decided on which antivirus program you would like to use let me know and we will clean out everything else.

f33dev · Oct 19, 2026 at 11:55 AM

Yes for now I'll keep Mcafee subscription since is included on my internet plan and when my 14 day trial ends for malwarebytes I will buy the 2 year deal that they have.
I would like to remove the rest, specially this annoying Sophos EndPoint that I have no idea what the tamper protection password is, gonna follow this later to see if I can remove it: https://support.sophos.com/support/s/article/KBA-000004158?language=en_US

Thank you for your help.

Log in or Sign up

Trojan:win/coinminer.edv - Help

f33dev Private E-2

Oh My! Malware Expert Staff Member

f33dev Private E-2

Attached Files:

Addition.txt

FRST.txt

Oh My! Malware Expert Staff Member

f33dev Private E-2

Attached Files:

Fixlog.txt

Oh My! Malware Expert Staff Member

Attached Files:

Fixlist.txt

f33dev Private E-2

Attached Files:

Fixlog.txt

Oh My! Malware Expert Staff Member

f33dev Private E-2

Oh My! Malware Expert Staff Member

f33dev Private E-2