Exchange 2013 infected by Backdoor:MSIL/Chopper & other variants

• Download Sysmon and note where the folder is saved >>>>Important<<<<
• If the folder is saved someplace other than the Desktop, copy and paste the folder onto the Desktop >>>>Important<<<<
• Right click on Sysmon.zip and select Extract All...
• Place a check mark in Show extracted files when complete then click Extract
• Confirm the extracted folder is on the Desktop
• Click Start, type cmd, then select Run as administrator
• Individually copy and paste each line below after the command prompt, hitting Enter after each line. Confirm each command is successful

cd %userprofile%\Desktop\Sysmon
Sysmon64.exe -i -n -accepteula

• Close the command prompt window

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Start::
Zip: C:\inetpub\temp\apppools\MSExchangeECPAppPool\MSExchangeECPAppPool.config
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create a zipped folder in the same location from where FRST was run with today's date, example: 07.30.2023_13.24.50.zip. Please upload the file here.

• Sysmon install properly?
• Fixlog
• Uploaded zip file

Fix result of Farbar Recovery Scan Tool (x64) Version: 03.02.2024 01
Ran by ex-super_user (27-02-2024 10:16:20) Run:14
Running from C:\Users\ex-super_user\Desktop
Loaded Profiles: ex-super_user
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start::
Zip: C:\inetpub\temp\apppools\MSExchangeECPAppPool\MSExchangeECPAppPool.config
End::
*****************

================== Zip: ===================
C:\inetpub\temp\apppools\MSExchangeECPAppPool\MSExchangeECPAppPool.config -> copied successfully to C:\Users\ex-super_user\Desktop\27.02.2024_10.16.20.zip
=========== Zip: End ===========

==== End of Fixlog 10:16:21 ====

• Press Windows Key + R at the same time
• Type eventvwr.msc and press Enter
• Click on the arrow to the left of the below listed entries to expand the categories

Application and Services Logs
Microsoft
Windows
Sysmon

• Right click on Operational then select Save All Events As...
• Save the file onto your Desktop (or note where the file is saved) as SysmonOperational, leaving the default Save as type: entry
• Zip the file and upload it here

• Uploaded file

Hi there,

file has been uploaded.

Hi Gary,

apology for uploading wrong file. The correct one  has been uploaded.