Question HELP! Serious Undetectable Malware Infection

Krixer

Honorable
Jun 29, 2015
10
1
10,515
0
Hello,

I suspected there was a malware infection on my system after I found a weird process called "net-helper.exe" running.

Rkill detected the process and terminated it.
Malwarebytes pro couldn't detect it, and Sophos Hitman Pro also did not detect it.
The service isn't a default windows service, it was created, and the file was created yesterday.
I also monitored the process in Procmon and the behavior is largely suspicious.
CrowdInspect also showed the process opening some tcp port to a remote location with the same weird webpage address!
I can disable the service and the process stops, but I just have no idea how to remove it.
No google search result for the malware's name, and I just have no idea what to do.

Here's the screenshots of the process in it's directory and the service:
https://drive.google.com/file/d/192Ktrzt19YfSfxp3K3isOVs7Z-a7LgZv/view?usp=sharing
https://drive.google.com/file/d/1xh_WDN3dPxjHiLMvc7WyJDvsuAnLypjC/view?usp=sharing

And here's the procmon log:
https://drive.google.com/file/d/1tTgXMlAA-9REd1G9FedpWQBYZEGECYmE/view?usp=sharing

PLEASE, help me out!
 

Gegemon007

BANNED
Feb 4, 2021
78
13
35
0
It will also ask to uninstall all your Antivirus apps
And if that doesnt work. I think then Kaspersky will detect it
And even that doesnt work, then u can use CMD command Del
Just paste this command in Administrator CmD
 
Last edited:

Krixer

Honorable
Jun 29, 2015
10
1
10,515
0
It will also ask to uninstall all your Antivirus apps
And if that doesnt work. I think then Kaspersky will detect it
And even that doesnt work, then u can use CMD command Del
Just paste this command in Administrator CmD
I would imagine that the malware has gone deep into my OS, so a CMD delete wouldn't suffice!
 

Gegemon007

BANNED
Feb 4, 2021
78
13
35
0
Actually it hasnt, as it has only infected the services which u can delete
First type cd windows
Then type rmdir file name
Can u rename the file to NetHelper?
 
Last edited:

Gegemon007

BANNED
Feb 4, 2021
78
13
35
0
I can rename it yes, but I'm thinking of a full reinstallation of Windows to be safe.
I was going to say if everything fails, reset windows using USB bootable installation file
U can try to delete it using CMD command which i did write above
 

USAFRet

Titan
Moderator
Mar 16, 2013
139,005
7,367
166,440
21,417
I can rename it yes, but I'm thinking of a full reinstallation of Windows to be safe.
For your OS reinstall, see this:

 

Johnwmel

Great
Jan 21, 2021
158
17
85
0
More steps will be needed, after I see the result of this log

Step 1: Run AdwCleaner
https://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click Scan Now
Click on Quarantine for all it finds.
Reboot.
Please Copy & Paste the contents of that logfile with your next reply.
View: https://i.imgur.com/qERgl4y.gif
 

ASK THE COMMUNITY

TRENDING THREADS