How to completely remove NSIS/CoinMiner.M detection?

[Paneliya Mehulkumar 0]

How to completely remove NSIS/CoinMiner.M detection?

efsw_logs.zip

Edited December 27, 2019 by Paneliya Mehulkumar

[Marcos 5,070]

The malware is created in shared on drive D : that are shared for everyone with full access, ie. an infected computer in the network copies  malware there which is subsequently detected by ESET. It's coming from a machine with the user 1E-STORAGE\helium logged in.

[Paneliya Mehulkumar 0]

what are the steps needed to clean it completely ?

[Marcos 5,070]

1, Identify the machine where 1E-STORAGE\helium user was logged on.
2, Make sure that ESET is installed on the machine, it is fully updated and all important and critical OS updates are installed. Make sure that detection of potentially unsafe and unwanted applications is enabled. Then run a full disk scan to detect and remove possible malware.