Help with Wacatac.B!ml on Server 2016 Standard

Hello Gary,

I will do this as soon as the daily production is done, and post the results ASAP...

Thank you sir!

Thanks for the info. 

I have completed the task and patiently await the next steps

Can you manually check to see if this file is present?

C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db (=> Could not move)

Hello sir,

The file is present...

Update:

Hello Gary,

After reboot the virus was found again. 

I tried not to reboot but the server was running very poorly...

I am heeding to bed.

Have a great evening and I will talk to you tomorrow...

Thanks again!!!!

Edited by mlonabaugh, 30 August 2023 - 08:01 PM.

• If necessary, download Farbar Recover Scan Tool for 64 bit systems and save it to a USB device
• Download  fixlist.txt   78bytes   8 downloads and save it in the same USB device
• Insert the USB device into your compromised computer
• Holding down the Shift Key click Start, click the power icon, then select Reboot
• Click Troubleshoot
• Click Advanced options
• Click Command Prompt
• Choose an account to continue
• If necessary, enter the password then hit Continue
• You should be presented with a black command prompt screen
• In the command window type in Notepad and press Enter.
• Under File menu select Open
• Select This PC and double click on your USB drive letter
• Next to Files of type: select All Files
• Right click on the FRST icon and select Run as administrator
• Click Yes to disclaimer that may appear
• Press Fix button
• Reboot your computer
• A fixlog.txt file will be saved on the USB drive. Please copy and paste it to your reply.
• Check for detections

• Fixlog
• Detection?

Hi Gary,

Thanks for the info. 

This task will take a while to complete, probably over the weekend while no one is working (But me) 

I will get it done ASAP....

Thanks for everything sir!

• Right click on BlitzBlank, select Save as..., and save it to your Desktop
• Right click on BlitzBlank.exe and select Run as administrator
• Click OK on the warning screen
• Select the Script tab
• Copy and paste the following into the Script box:

DeleteFile:
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
DeleteFolder:
C:\Windows\Temp

• Close all open programs except for BlitzBlank
• Click the Execute Now button
• Click OK twice
• Your computer will automatically reboot
• Following reboot complete the next step

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
cmd: type blitzblank.log
File:  C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
Folder: C:\Windows\Temp
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.

• Fixlog

Good morning Gary,

Thank you for the updated info.

I will perform this task  ASAP...

Everything is running smooth at the moment, and I do not want to make any waves until the weekly production is through...

I know you understand the rational behind that train of thought.

Like always, your assistance is deeply appreciated. 

I hope you have a great holiday weekend my friend...

I hope you are enjoying the long weekend sir...

This was much easier, and less time consuming than I expected and I have completed the task.

Obviously there is no rush on my end for you to respond to this message.

I will let you know if the virus is detected again...

Thank you!!!!

********************************************************************************

• Launch FRST
• Type the following in the Search: box

blitzblank

• Click Search Files button
• When completed click OK and a Search.txt document will open on your desktop
• Copy and paste the contents of that document your reply

• Search.txt

Hello sir,

Sorry for the delay, but that took forever to finish.

I hope this was what you were expecting to see my friend...

Thanks!

*********************************************************************

It is what I expected to see but it is not good news. We need to go back to Post #21 and try it the more difficult way.

Hi Gary,

I was hoping you wouldn't say that

I will do the task as soon as possible my friend. 

Thank you!!!!