Hey everyone, just an update. The lovely people from Bleeping Computer has helped me remove the virus completely and my Task Manager functionality restored.
I'm not sure if you can share links to different forums here, but if anyone wants to read up on how how we were able to fix it. Or if you yourself are encountering the same virus, PM me and I will be glad to send you the link of my topic in BC.
Thanks for everyone who posted here and provided support.
I'm not sure if you can share links to different forums here, but if anyone wants to read up on how how we were able to fix it. Or if you yourself are encountering the same virus, PM me and I will be glad to send you the link of my topic in BC.
Thanks for everyone who posted here and provided support.
Hey everyone! My PC is currently infected with a Bitcoin Mining virus and I'm just looking around if there are still steps to take in order to fight this curse orinevitably go for the easy route and just wipe and reformat. Any help is appreciated, thanks in advance!
How it happened:
The virus successfully injected itself into my computer masking itself as an Nvidia application. I was working, and suddenly an Nvidia update ran but it was running with cmd, so it was a bit sketchy. But it was my mistake that I ignored it. It was able to inject itself into the registry, and powershell to run its network activities through that phase. This was left unchecked for about 2 hours, by then it had already completed its download and was running autonomously in the background. I turned on Task Manager, but would only show in "less detailed" mode. Once clicked on more details, it forces itself close.
Current Status:
Successfully located the directory of the virus in C:/ProgramData. Size is about 2.8GB, attempted to delete but cannot fully since there are tasks still running in the background. The file is now about 8 MB. Malwarebytes has successfully blocked it from re-downloading in the background. It's somewhat a vaccine, I still have the virus in the PC, but it's in a dormant state because of it's network restrictions.
It's shown to be running through powershell to do its network activities and registry editor to block out task manager and run autonomously in the background. Are there steps to try and remove this thing from the registry editor and also the powershell?
Softwares Used:
Observations:
- Windows Defender - Detects virus, attempts to remove, but redetects soon after removal.
- Malwarebytes - Detected virus, removed virus, does not detect virus anymore even if it still here but successfully blocks it from using network activities.
- rkill - No detections at all.
- HitmanPro - No detections at all.
- Spybot - Detected the virus, when attempted to fix, froze. (Able to detect that the virus had created its own permissions as a new users in Registry permissions)
Running Tasks:
- Accessed HKEY_CURRENT_USER/Microsoft/Windows/CurrentVersion, somewhere along there and injected lines to run files ending with .vbs (was the first stage).
- Signs of it using powershell to run its network activities.
- Located in C:/ProgramData in a hidden folder named "NVIDIA Corporation." File size is about 2.5GB - 2.8GB when it's successfully downloaded all its files.
- Inside the folder you will find a lot of NVIDIA logs to make it appear legit, although there a lot of .json as well.
1. NVIDIA Web Helper.exe (Im assuming this is the mother task since I can't fully delete "NVIDIA Corporation" folder because of this task).
-> "C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe" index.js
Questions:
Updates:
- If there is no hope left, and I am forced to reformat. Do I need to reformat both my drives or do I only reformat the boot drive?
- Is there any way to combat these network activities with cmd prompt or powershell?
- If it has injected itself to registry editor, can you alter that?
Was able to suspend Node.js scripts and especially "NVIDIA WebHelper" javascript with Process Explorer and that helped to turn my computer back to normal for the time being. Speed is back to normal, although virus is still lingering as I still see Malwarebytes trying to block something from re-trying to download itself from powershell.exe. As well as myself still not being able to run Task Manager properly.
- Recently discovered the "NVIDIA Web Helper.exe" process that I assumed was the mother task might not be, since it is running under "Node.exe." Process that I cannot terminate for the time being.
- Spybot was a great tool that made it possible for me to reduce/delete the "NVIDIA Corporation" folder down to 2 MB.
- I'm still certain I am infected since I cannot access Task Manager's "more details" still.Or could it be that this is just lingering code from the virus that force closes Task Manager? Will update again soon.
- I've removed permissions from the Unknown Account in regedit completely except for one section which is HKEY_CURRENT_CONFIG. There is an error saying I can't remove it because of "inheriting permissions" from parent object. Still reading up about this. Any help appreciated!
Last edited:
Facebook
Twitter
Instagram