I need some info on a Win32:Malware-gen infection

[pretaxemu]

So, I managed to accidentally install a program that has lead me to some malware on my pc (Yes it's been removed) but I need some help on knowing the maximum damage it could have done to my pc I have the executable files in a RAR archive and they have some bizarre names such as...

• tmsgsawjzufsdnwlhh.exe
• hdkvxoclnhnzxbja.exe

But I'm still going to do some testing in a VM just to find out what happened and monitor it.
I also found a startup process in msconfig called 'SYSCHECK' by an unknown manufacturer.

PC Symptoms

IE opening the executable files and leading me to foreign websites.
Seeing my cursor randomly move on its own accord.​

Any answer to these questions would be greatly appreciated.
~Kian

 

[Paul Black]

Hi pretaxemu, welcome to Seven Forums,

I managed to accidentally install a program that has lead me to some malware on my pc (Yes it's been removed)

What was the program that you downloaded that contained Malware and what did you use to get rid of it?

 

[pretaxemu]

I have no clue what software could have got bundled with the malware but if you want I could link a download of the files.

 

[torchwood]

If the exe file is still in startup

you HAVE NOT removed it completly.

suggest you run further malware checks on your system
Eset on line, Malwarebytes and Farbar.

ANY SUSPECT links will be removed by the Moderaters, and should never be posted in the first place on any public forum


Roy

 

[samuria]

A lot of these things may not do a lot other than download more and more malware. By being harmless they are not picked up by AV then they download other things often disabling Av. Upoad the file to https://www.virustotal.com/#/home/upload and tell us exactley what it is

 

[Alejandro85]

Once malware managed to run on your system, you already lost the battle, the virus got control of your computer and, as Microsoft says, "it's not your computer anymore".
Among the things it could do to you, it can:
- Download other pieces of code from anywhere, and run them too.
- Read all the files you have access to
- Write all the files you have access to (that's what ransomware exploit)
- Take screenshots
- Capture all your keypresses
- Send any of this to literally anywhere in the world.
- Use your network connection to spread to other computers in your LAN (that's how companies are attacked/hacked).
- Use your internet connection to spread over internet or to join a botnet to attack websites (and the blame will fall on you).
- Attempt to exploit a vulnerability in the OS to escalate privileges and get a more permanent foothold on the PC.
- Tamper with any software installed (including antiviruses and the OS).
- Use your hardware for their purposes (like cracking passwords or mining cryptocurrencies).
- Infect restore points and backups to prevent removal.
- Install TLS certificates to spy on secure connections.
- Attempt to persist themselves on hardware (BIOS, firmware, etc.) to survive a clean install.

And certainly I'm missing many others. Most important is that all of those effects are mostly invisible to the user and have subtle effects, if any, and require a trained eye to spot. In practice, nowadays it's considered a waste of time to even try to clean systems once viruses run (even though antiviruses claim they can, it's largely untrue).
While your testing in a VM could be a nice learning exercise, it's also incredibly risky because viruses can detect VMs and modify their behavior to hide themselves, and also you're still running the host that was originally infected. The risk of reinfection by the virus escaping the VM is there, and the chance of the host not being really cleaned is much higher. If you really want to do that, use a spare computer you can sacrifice.

At this point, the only advisable step is to immediately stop using the affected computer and perform a complete reinstallation of the operating system as soon as possible, maybe extracting important data by booting an external OS.

 

[mrjimphelps]

Go to another computer (a known clean computer) and create a Windows Defender Offline (WDO) disk. Go here to make the disk: https://support.microsoft.com/en-us/help/17466/windows-defender-offline-help-protect-my-pc

Then boot the infected computer with that disk. This will bring you into the WDO program, but without loading Windows on the infected computer. You can then do a full scan and clean on the infected computer.

WDO is not the best anti-virus program available; but this type of scan (a pre-Windows scan) can be very effective in cleaning your computer. I have had good results by using WDO to clean an infected computer.

 

[Snick]

How to remove Win32:Malware-gen Trojan (Virus Removal Guide)
OOPS, Try it now!

 

[mrjimphelps]

How to remove Win32:Malware-gen Trojan (Virus Removal Guide)

No link.