CryptoPHP Trojan Removal

[Orbit Storm]

Looking for insight from anyone experienced with CryptoPHP malware infections. I made the mistake of trusting a legitimate looking site that claimed to be a third-party designer offering their own collection of original WordPress themes. Being a freelance designer, I'm always scouring such sites for third-party content that typically gets buried among popular designers on larger networks like Envato and WordPress itself. No, I am not a pirate. I only seek out legitimately free content and over the years I've managed to sift through countless themes unscathed. That ended tonight.

That being said, I was unaware of the zipped file being infected (note: I never opened it). Windows Defender popped fairly quickly and during the scan, the status changed to "error encountered" and simply sat stagnant afterward. I promptly did a scan via Malwarebytes which failed to detect the file. Attempts to delete the zipped file failed (explorer displayed "detected 0 of 0"). I finally settled for a system restore to earlier today (to curb any possible widespread infection) and was finally able to delete the file after the restore completed and I accessed the desktop. Scans from Windows Defender, Malwarebytes, and now Avast have failed to detect anything thus far.

My concern is, was it really that easy? From the horror stories I've read, and the astronomical number of sites and computers infected by this new malware, I'm not convinced it was really that simple. The classic symptoms of SEO-based infections (like this one) are not occurring, such as my browser defaults being changed, toolbars being installed, or my homepage changing. Perhaps I'm just being paranoid (rightfully so), but I was hoping someone may have experienced something similar and managed to avoid further disaster.

Thank you!

 

[ex_bubblehead]

If you never opened or executed the file you should be fine. However, I'd dump Windows Defender, most everything else (even McAfee) is better at detecting and cleaning malware.

 

[Orbit Storm]

If you never opened or executed the file you should be fine. However, I'd dump Windows Defender, most everything else (even McAfee) is better at detecting and cleaning malware.

Thanks for the response. I normally don't use Windows Defender, but this is a relatively new system and I hadn't gotten my usual AV program installed (Avast). I just found it weird that the file was detected by Windows Defender but then encountered an "error". In hindsight, I'm assuming I couldn't move the file myself because Windows Defender was trying to and likely had control of it even after I closed the program. Like I said above, I'm probably just being paranoid. Thanks again!

 

[JivesUK]

If you never opened or executed the file you should be fine. However, I'd dump Windows Defender, most everything else (even McAfee) is better at detecting and cleaning malware.

Thanks for the response. I normally don't use Windows Defender, but this is a relatively new system and I hadn't gotten my usual AV program installed (Avast). I just found it weird that the file was detected by Windows Defender but then encountered an "error". In hindsight, I'm assuming I couldn't move the file myself because Windows Defender was trying to and likely had control of it even after I closed the program. Like I said above, I'm probably just being paranoid. Thanks again!

Same problem as me. Downloaded a zip which had CryptoPHP included but I never opened it. Windows defender detected it right away. I've also scanned with MB and defender in safe mode three times with no infections past the initial one.

Am I safe? I'm a little paranoid with these things.