Help with Wacatac.B!ml on Server 2016 Standard

Hello,

My antivirus keeps finding and cleaning Wacatac.B!ml in the temp folders.

But the viruses keep returning, and the server is running very poorly. 

I may have a hacker situation. Can someone please help me? 

Thank you!

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

• Download Farbar Recover Scan Tool for 64 bit systems and save it to your Desktop. <<< Important
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
• 2 Notepad documents should now be open on your desktop.
• Please copy and paste the contents of each report in separate reply windows

• FRST.txt
• Addition.txt

Hi Gary,

Thank you for helping me again. 

I'm sorry it's taking so long, but when I run FRST.exe as administrator nothing happens. 

I am rebooting the server now and will let you know if I have any luck this time....

Didn't just want to leave you hangin...

Thanks...

• Please download all 3 versions of RKill by Grinler, not including the zip version, and save them to your desktop
• Disable your anti-malware software. Please refer to this page if you are not sure how.
• Double click on Rkill to launch the program. If one download version does not launch try a different one.
• Note: You may have to run Rkill a few times before it is successful
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
• Please copy and paste the contents of the RKill report that will appear on your desktop in your reply (file is also located at c:\rkill.log)
• Do not reboot your computer after running Rkill. If your computer reboots run Rkill again before continuing on
• If nothing happens or if the tool does not run, please let me know in your next reply.
• Attempt to run a FRST scan and post the results

Hello sir,

Turned out to be the firewall hosing me up.

See files below

Thanks!!!!!

Start part ********************************************************* Addition Text

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CloseProcesses:
Folder: C:\Windows\Temp\tmp00000118
C:\Windows\Temp
Powershell: Set-MpPreference -EnableControlledFolderAccess Disabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $true
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*.*
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
Powershell: Set-MpPreference -EnableControlledFolderAccess Enabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $false 
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

• Fixlog

Good morning,

Sorry for the delay... 

Since this is a working server I need to do my fixes at specific times. 

Thank you for your help....

Please see requested info below...

 Fix result of Farbar Recovery Scan Tool (x64) Version: 28-08-2023

Good morning sir,

This is just an updated FYI...

After the Fix and reboot the server is still in the same distress.

I'm not sure if this helps, but Windows Defender reported finding the two infections below after the Fix Reboot.

I have removed both, and patiently await your instructions my friend... 

Thank you!

C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db => Could not move

• Click Start and type cmd then select Run As Administrator
• Individually copy and paste each line after the Command Prompt hitting Enter after each one
• If you receive an error after hitting Enter stop and let me know what happened

cmd: icacls "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" /save "%userprofile%\mpenginedb"
cmd: takeown /f "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db"
cmd: icacls "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" /grant administrators:F
Move: "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db" "C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.bak"
cmd: icacls "C:\ProgramData\Microsoft\Windows Defender\Scans" /restore "%userprofile%\mpenginedb"

• Close the Command Prompt window
• If successful, run a Windows Defender scan and post the results

• Results?

Edited by Oh My!, 30 August 2023 - 12:40 PM.

Hello,

I ran the firs command and received the error below.

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
CloseProcesses:
Powershell: Set-MpPreference -EnableControlledFolderAccess Disabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $true
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\*.*
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
Powershell: Set-MpPreference -EnableControlledFolderAccess Enabled
Powershell: Set-MpPreference -DisableRealtimeMonitoring $false
End::

• Click Fix
• Allow the requested reboot
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

• Fixlog