Multiple Powershell instances either consuming CPU or RAM and Trojan:BAT/PSRunner.VS!MSR infecting PowerShell

Question

Hello, I have a problem with multiple Powershell instances either consuming CPU or RAM. I downloaded and ran Malwarebytes but no success. I saw that to get rid of the probable infection I could use Farbar Recovery Scan Tool. I ran it and have a FRST.txt and Addition.txt, in the files i found multiple "ATTENTION" issues on the frst.txt and the Trojan:BAT/PSRunner.VS!MSR infecting PowerShell on the addition.txt. I could not find instructions detailed enough to construct an fixlist.txt.

I hope someone can help me with this.

https://drive.google.com/file/d/1egjebgkkWiKKYbKgcWMdVPZGTho93f18/view?usp=sharing, https://drive.google.com/file/d/1s4bVpk1ba7pevJm_bZfAVhxV5fQJhtOQ/view?usp=sharing

Thanks a lot in advance.

Kimon

Answer 1

• Download **** Fixlist.txt **** and save to the folder that FRST64.exe is located in
• Close any apps with unsaved work
• Run FRST64.exe and click "Fix"
• The computer will reboot to complete the procedure

Please upload Fixlog.txt and let me know how things are running.

Answer 2

Thanks. That all looks good in the fixlog. The main infection was a crypto stealer targetting:

binance, coinbase, blockchain, Voyager, BlockFi, crypto, coindesk, etoro, kucoin, Citi, paxful, paypal, huobi, poloniex, bittrex, kraken, bitfinex, bitstamp

If there's nothing further, you can delete the Farbar scanner and the C:\FRST folder.

If you could mark the thread as answered by clicking ‘Yes’ below the post that provided the solution...that'd be much appreciated.

Good luck :)

Answer 3

Thank you so much for the instant reply. No powershell instances are active now. Here is the Fixlog.txt

https://drive.google.com/file/d/132dVirT0dXp3PCSMMlaKUrVoh3KxK0fE/view?usp=sharing

Answer 4

Hi Kimon,

Please run the fixlist below.

• Download fixlist.txt ([https://1drv.ms/t/s!AjVYLGw0OBWU2jiKPycBsfBMEA3...](https://1drv.ms/t/s!AjVYLGw0OBWU2jiKPycBsfBMEA3F?e=LpebXZ))

• Save Fixlist.txt to the folder where FRST64English.exe is located.

• Close all programs.

• Launch the Farbar Scanner tool and click "Fix".

• Restart Windows when prompted.

• Upload the output log file (FixLog.txt) to your OneDrive.