Windows 10: Trojan:BAT/PS.Runner.VS!MSR causing powershell to launch often for a couple of weeks on...

Hey there, I believe my computer has been infected with some pretty serious malware.. It's been a couple of weeks now facing this particular issue, and about a month ago someone managed to steal all of my passwords I suspect it's because they found out the password to my original microsoft account and got all the passwords i'd imported from chrome to edge when I switched somewhat recently, the reason I suspect that is because they went as far as to change the email address and the password and the phone number on my microsoft account once they got in so I've been completely locked out of my

:)

 

PowerShell does not launch bash.exe

All,

I
am new and trying to learn.

My
issue: When I enter bash.exe in a PowerShell cmd window, my PC does not launch the Ubuntu command. I think Windows Subsystem for Linux (WSL) is not in my $ENVath.

Troubleshooting
I have done:

1. Reading
   on the Internet, I can test my $ENVath by typing the following a PowerShell cmd:
   

PS C:\WINDOWS\system32>
where.exe calc

C:\Windows\System32\calc.exe

It returned the follow:

PS C:\WINDOWS\system32>
calc

(And the calculator displayed
on my PC)

1. Reading
   on the Internet, I can also test my $ENVath by typing the following a PowerShell cmd:
   

PS C:\WINDOWS\system32>
where.exe wsl

It returned the follow:

INFO: Could not find
files for the given pattern(s).

Here
is the output of $ENVath

PS
C:\WINDOWS\system32> $ENVath

C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program
Files (x86)\Calibre2\;C:\Program Files\PuTTY\;C:\Program Files\Microsoft VS Code\bin;C:\Users\user-lenovo595\AppData\Local\Microsoft\WindowsApps

Question:

What
would you suggest as my next step to fix the issue?

Thank
you,

 

Trojan-PoweLike!bat

Defender is not finding and removing or quarintining a malware "Trojan-PoweLike!bat" that I can not get off my computer. It was detected by Stinger, but it keeps coming back. Windows defender is not finding it How can I completely remove it????

 

Trojan Found and Deleted....but it Returns (Trojan: HTML/Phish.AB!MSR)

Windows defender periodically finds a Trojan in a .htm file in my Windows Communications appdata area (see attachment). You will notice that the file is in the Attachments folder. Windows defender seems to delete this threat but after a few days or a couple
weeks, the threat will return in the exact same location.

I have no evidence that the Trojan is actually running on my computer. I believe it is just sitting in the file waiting to be executed. I have not knowingly run this file and am usually careful about phishing attacks.

Only Microsoft Defender will find it. I tried using Malwarebytes, Bitdefender and Microsoft Safety Scanner. None of these even finds it.

MS-Defender says that it is successful at removing it and a scan immediately after the clean will not find the Trojan.

A few troubleshooting actions to date:

• Have removed the threat and immediately opened all known Microsoft communications programs (Outlook, Windows Calendar/Mail, Skype, Skype-Biz, Teams). I then reran a scan but did not find the Trojan. Nevertheless, it did return a couple weeks later.
• I have started my computer in Safe Mode and deleted the entire package folder. After rebooting, the Trojan is no longer found by Defender. However, the folder and its content is eventually recreated along with the Trojan threat.
• I had a case opened at Microsoft (who more-or-less had me repeat everything I had already done). MS ultimately recommended that I rebuild/refresh my entire computer. I am not adverse to doing this but I am worried that since the Trojan appears to be in
  an attachment within Windows communications, it will simply return. I do not want to waste my time.

I currently run a daily scan of the appdata\package folder so that I can identify when the file returns.

MS-Surface Pro i7/16GB/512GB with all Windows 10 Pro updates completed.

Office 365 environment with most all files stored in OneDrive or SharePoint.

Thank you for any further thoughts on this issue.

-bs