Hopefully Another Quick One…

Discussion in 'Malware Help (A Specialist Will Reply)' started by p45cal, Mar 23, 2019.

  1. p45cal

    p45cal Private E-2

    This time, a friend's mother was scammed by a phone caller (actually 2) claiming to be from British Telecom and managed to use a number of remote access/control applications to gain control of her machine and stayed online for some 2 hours! Her son happened to visit and cut the the conversation and connection.
    Now I'm checking her machine out for malware etc. and here are the logs, I'd be grateful if you would have a look. Thank you.
     

    Attached Files:

    p45cal, Mar 23, 2019
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did they access using TeamViewer? If so, uninstall it!!
    Remove these in ADWCLeaner:
    PUP.Optional.Legacy kofkpgiaknijknhajbhnghkodiccblkgPUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{23A4E344-AAFE-4A6E-89BF-10ACD90914F1}
    PUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{23A4E344-AAFE-4A6E-89BF-10ACD90914F1}
    PUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHUninstallTrackingTASK
    PUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F0EFCA4D-1445-4176-991A-8D95368A3D1C}
    PUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0EFCA4D-1445-4176-991A-8D95368A3D1C}
    PUP.Optional.Legacy HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHSelfDeleteTASK
    PUP.Optional.PCVARK HKLM\Software\dtdu-pr
    PUP.Optional.BrowseFox.A HKLM\Software\Wow6432Node\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    PUP.Optional.Legacy C:\Windows\System32\Tasks\IHUninstallTrackingTASK
    PUP.Optional.Legacy C:\Windows\System32\Tasks\IHSelfDeleteTASK

    This item in RogueKiller:
    [PUP.AdvancedPCCare (Potentially Malicious)] (X64) HKEY_LOCAL_MACHINE\Software\dtdu-pr -- N/A -> Found

    Everything found by Hitman!

    Reboot and rescan with ADW, Hitman and RogueKiller......also:
    Please go here > https://www.zemana.com/Download
    their program is no longer free, but you can use the demo version for this cleaning.

    It auto updates, and you click scan. After it's finished, click on the icon that looks like Cell phone strength bars. High-light the report (by date log was produced) and click on the "Open Report" icon. (looks like a folder). That notepad.txt can then be copied/pasted into another .txt doc and saved. Upload that, please.
     
    TimW, Mar 24, 2019
    #2
  3. p45cal

    p45cal Private E-2

    I'm not sure; it was already installed (I use it to help the user). I've uninstalled it anyway. I intend to reinstall it later.
    The scammer(s) tried AnyPlace, AnyDesk, and it looks like they installed Camera and BT Desktop Help. I've uninstalled what I can of these.


    ADW reports:
    ***** [ Chromium (and derivatives) ] *****
    Not Deleted PDFConverterHQ
    Not Deleted MyRadioAccess
    Not Deleted kofkpgiaknijknhajbhnghkodiccblkg
    Not Deleted Home Tab

    and a rescan produces:
    ***** [ Chromium (and derivatives) ] *****

    Adware.Mindspark PDFConverterHQ
    Adware.Mindspark MyRadioAccess
    PUP.Optional.Legacy kofkpgiaknijknhajbhnghkodiccblkg
    PUP.Optional.Legacy Home Tab

    After this I went through the Read & Run me First and subsequent Windows OS Specific Cleaning Instructions again, as well as running Zemana.
    Attached are the resulting logs.

    I'm worried, that in the 2 hours or so where a scammer has unfettered access to this lady's computer what sort of nonsense (if only it were nonsense!) they could have installed; keyloggers, screenshot-taking code, root kits, which might, say, periodically 'phone home' and deliver sensitive information to the scammer.
    They got her to gain access to some of her shopping sites!
     

    Attached Files:

    p45cal, Mar 26, 2019
    #3
  4. p45cal

    p45cal Private E-2

    Some more logs:

    Thanks very much.
     

    Attached Files:

    p45cal, Mar 26, 2019
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs look good. What were the scammers after?
     
    TimW, Mar 26, 2019
    #5
  6. p45cal

    p45cal Private E-2

    Excellent. So I can ignore that the likes of Not Deleted kofkpgiaknijknhajbhnghkodiccblkg and PUP.Optional.Legacy kofkpgiaknijknhajbhnghkodiccblkg remaining being found in ADWCleaner, even though that's one of the things you expressly asked me to have ADWCleaner remove?

    Well, that's half the question - I don't know. My friend's mother is 80+ and the report of events is very sketchy, especially as there seem to have been 2 scammers on the same day.

    So the next steps are to remove the scanning apps and toggle Restore?
     
    p45cal, Mar 26, 2019
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I would suggest you first reset all browsers to default. Then remove the apps we used following these instructions...and last toggle restore.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    3. If running Vista, Win 7 or Win 8, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    4. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 or 10 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    5. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    6. After doing the above, you should work thru the below link:
     
    TimW, Mar 26, 2019
    #7
    p45cal likes this.
  8. p45cal

    p45cal Private E-2

    OK. All done. Thanks. Fingers crossed…
     
    p45cal, Mar 27, 2019
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are welcome. Safe surfing.
     
    TimW, Mar 27, 2019
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds