Jump to content

Archived

This topic is now archived and is closed to further replies.

mayowa

Coin Miner

Recommended Posts

Hello All,

A customer  was infiltrated with coin miners malware virus, ESET file security on the server was used to scan with threat-sense parameters of in-depth scan and strict cleaning,

We are still experiencing pop up's of  the presence of coin miner on the server as detected by ESET every minutes

Does anyone have any ideal on how to deal with this situation ?

For you perusal kindly find attached document for the Log collected from the file security installed on the server 

eset log.rar

Share this post


Link to post
Share on other sites

Does temporarily disconnecting the server from the network stop the malware from being created / detected ? Please gather logs with ESET Log Collector and provide me with the generated archive.

Share this post


Link to post
Share on other sites
1 hour ago, Marcos said:

Does temporarily disconnecting the server from the network stop the malware from being created / detected ? Please gather logs with ESET Log Collector and provide me with the generated archive.

Thanks Marcos for your swift response

Kindly check the ftp support server for the log as requested with the name Egbin efsw_logs.zip

I await your feedback for a resolution 

Thanks in anticipation 

Best Regards 

Share this post


Link to post
Share on other sites
On 5/24/2018 at 4:18 PM, mayowa said:

Thanks Marcos for your swift response

Kindly check the ftp support server for the log as requested with the name Egbin efsw_logs.zip

I await your feedback for a resolution 

Thanks in anticipation 

Best Regards 

Hello Macros

I will like to follow up on the subject matter as reported earlier 

Share this post


Link to post
Share on other sites
On 5/28/2018 at 1:43 PM, mayowa said:

Hello Macros

I will like to follow up on the subject matter as reported earlier 

Hello All,

kindly help with above subject caption,we need immediate remediation because the client is running out of patience as it keeps coming backing after ESET detects and deletes it

Actually we thought of isolating the server,but it has spread to other servers and work stations 

Share this post


Link to post
Share on other sites

Post screen shots of what Eset is detecting. For example, the actual alert popup and entries from the log file.

Share this post


Link to post
Share on other sites
15 minutes ago, itman said:

Post screen shots of what Eset is detecting. For example, the actual alert popup and entries from the log file.

Thanks Itman for your response as requested please find attached document for "screen shot of what ESET is detecting "on entries from the log file",Kindly check the ftp support server for the log as requested with the name Egbin efsw_logs.zip

I await your response in anticipation for a quick resolution 

Regards 

Egbin 2_LI.jpg

Share this post


Link to post
Share on other sites

Since it sounds like it is pretty well entrenched in your network, I would start with the servers and then proceed to the endpoints.

Download SysInternals Autoruns: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns .

Run it as Admin. Under the Options setting, the only thing "hidden" should be empty locations. Under Scan Options in this section, checkmark VirusTotal.

Look for anything suspicious in any auto start locations such as registry run keys, etc. and Task Scheduler entries. Also under the WMI tab, look for suspicious events. Best way to remove items is to "uncheck" them in Autoruns. This way they are not permanently deleted and can be restored by re-checkmarking them if anything gets "borked."

Share this post


Link to post
Share on other sites

  • Recently Browsing   0 members

    No registered users viewing this page.

×