Supreme BTC Clipper Persistence is Insane - HELP!

[356]

Alright so short story. I was messing around with some free checkers i got either here or on n.to
This installed some sort of BTC Clipper that I haven't encountered before.
The persistence is insane, typically I can get rid of these like in 5 mins. 
But this one I cant fine the root program.

The BTC address is 1EerXUTe8HVCiur4fCyoqBpGJJvKP2Dpu4 I didn't fall victim but i see some people are. 

So Lets begin... 
1) I'll provide some pics. But the Program inn the processes is ApiSetHost.AppExecutionAlias (32 bit)
2) It will only have one open at once (not like previous btc clippers i've encountered) However, to keep it up, this auto launches every 60 seconds or so. 
3) The location say its in C:\Users\User\AppData\Roaming\Microsoft Drivers
4) But the folder is empty and there is no hidden files
5) When Searching for it in C: I find the same name in System32 and It's a DLL/Application Extension program. 
6) I can't find the parent. I tried opening the .dll in .net Reflector but this isn't .net so it won't open. I kinda opened it in Visual Basic? But im not sure how to work it.
7) At first when inspecting, i thought Google Chrome was launching in so i deleted and reinstalled but didn't work.
8) I'm not sure what is auto relaunching it. I can't Find it in Task Scheduler or Windows Startup. But with this .dll in System32 Does that mean thats auto starting it?
9) How can I find this root program? I'm on the edge of reinstalling my windows. 

Any help would be appreciated I've hit a dead end after hours of looking around. 

[1.234]

Try to install Process hacker and monitor how is it getting spawned over your sys there gotta be a process or something. Check your startup folder, registry startup. If you end up not finding it then try running a malwarebytes scan over you OS.

Ad space by @Dav expires 2/14/2024

SELLING THIS MIDDLE SPOT CONTACT @Liars FOR PRICING


SELLING THIS BOTTOM SPOT CONTACT @Liars FOR PRICING

AD BY @ expires 13th November 

[1.077]

I would suggest just refreshing windows. Or try ESET NOD32 which has really good anti persistence for malware. 

Hopefully someone with more malware experience can help better but just some suggestions

Edit: 
https://www.eset.com/int/support/sysrescue/

Where am I? 

[356]

Try to install Process hacker and monitor how is it getting spawned over your sys there gotta be a process or something. Check your startup folder, registry startup. If you end up not finding it then try running a malwarebytes scan over you OS.

i have process hacker, and maybe I can't Navigate it properly but ill get malwarebytes right now.

---

I would suggest just refreshing windows. Or try ESET NOD32 which has really good anti persistence for malware. 

Hopefully someone with more malware experience can help better but just some suggestions

Edit: 
https://www.eset.com/int/support/sysrescue/

Thanks Ill run after Malwarebytes, Already have one good detection. bunch of false ones because i have minergate installed.



Could this be it???? came up as a Trojan



Every Checker download on c.to lmao jkjk but for real

---

Try to install Process hacker and monitor how is it getting spawned over your sys there gotta be a process or something. Check your startup folder, registry startup. If you end up not finding it then try running a malwarebytes scan over you OS.

Malwarebytes picked up around 130, quarantined everything. but this btc clipper is still here after restart.   And all of my checkers are gone lol but its okay, i need to use VPS now