Inactive Japanese Porn Malware

[jamiecampos]

I was visiting some Japanese websites to view manga images. I notiiced later a file in my
download folder. Foolishly, I clicked on it, and watched in horror as it installed sometthing.

Now, every 5 minutes a window pops up with japanese porno on it.

I saved the original file, and have it zipped up. It seems to be a self-executing zip file in exe
format.

When I log on to the computer, I can see a windows command box (black box) open and doing something. There is a file listed in 'applications' with no name that I am unable to terminate.

I can see nothing unusual in hijack this logs or malwarebytes scans.

The file infected a non-privleged account, and the administrator account is not infected.

Attached are two screen shots, one of the pop-up window, and one of the task manager,

I was unable to upload the 7-zip file that includes the original executable that I ran to get infected, it was rejected, however I can email it.

Jamie

[HJT log removed by Broni]

 

[jamiecampos]

Here is an update:

Apparently the extracted files create a registry entry that runs an HTML-application

The registry entry: HKU\S-1-5-21-6372259613-1446327078-3904827135-1003\Software\Microsoft\CurrentVersion\Run\webkirin

will execute C:\ProgramData\kirin\MPM4P73S.bat

which will start "MSHTA MP4P73S.d" which is a local web page with obfuscated javascript that lazy-loads content from Japan or China.

Deleting the registry entries and the folder (C:\ProgramData\kirin) should fix this.

 

[Broni]

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

 

[jamiecampos]

Apparently, you pushed "cut and paste' of your canned response without reading my earlier reply.

I already solved this problem.

Deleting the registry entries and the folder (C:\ProgramData\kirin) fixed this.

 

[Broni]

If there are no other problems....good job