Windows 10: Recently got a Trojan which is trying ot hijack my powershell.exe, need help with FRST

Hello, I recently picked up a Trojan which is hijacking my powershell and trying to connect to a remote server as "xboxwindows.com". I installed malware bytes just to do a second scan as a second opinion to defender and removed suspicous items with MWB. The trojan however is still attempting to contact the remote server. Did a scan with FRST though I'm not sure how to interpret what I'm seeing and what should be in a fixlist. Can anyone help?

:)

 

How do i run FRST.64

Hi



Welcome to Microsoft community.



It seems like you are referring to Farbar Recovery Scan Tool (FRST). To run FRST on a 64-bit system, you can follow these steps:

1. Download the FRST tool from a trusted source.
   
2. Right-click on the FRST executable file (FRST64.exe) and select "Run as administrator" to launch the tool with elevated privileges.
   
3. When the tool opens, click on the "Scan" button to initiate a scan of your system.
   
4. After the scan is complete, FRST may generate a Fixlist.txt file that contains instructions for fixing issues found during the scan.
   
5. If you are prompted to provide a Fixlist, you can review the contents of the file and decide whether you want to proceed with the suggested fixes.
   
6. To apply the fixes, click on the "Fix" button in FRST.
   

Please feel free to let me know if you have any further updates, thanks.

Best regards

Derrick Qian | Microsoft Community Support Specialist

 

How to uninstall PowerShell? (Detected as trojan)

Please share logs from Farbar Recovery Scan Tool (FRST) and I'll help you resolve the matter.



Download Farbar Recovery Scan Tool

• If your computer language is not English, rename FRST64.exe to FRST64English.exe
  
• Run FRST and press "Scan"
  
• Two logs are created in the folder that FRST is run from, FRST.txt and Addition.txt
  
• Upload the logs to OneDrive, Google Drive or any file sharing service
  
• Post the share link
  

Note: If you are downloading FRST with Edge, smartscreen will initially block it.

Click on the 3 dots next to the warning and select Keep-> Show more-> Keep anyway.

 

Cannot get rid of this trojan

Hi im very pro and you are bad,

Please provide Farbar Recovery Scan Tool (FRST) logs and I'll help you remove the trojan.



Download Farbar Recovery Scan Tool

• If your computer language is not English, rename FRST64.exe to FRST64English.exe
  
• Run FRST and press "Scan"
  
• Two logs are created in the folder that FRST is run from, FRST.txt and Addition.txt
  
• Upload the logs to OneDrive, Google Drive or any file sharing service
  
• Post the share link
  

Note: If you are downloading FRST with Edge, smartscreen will initially block it.

Click on the 3 dots next to the warning and select Keep-> Show more-> Keep anyway.