.exe file reappearing in downloads folder

A file named flstudio_win64_21.2.3.4004.exe keeps coming back to my C:/Users/---/Downloads folder whenever I delete it or move it to my recycle bin.

Here are the FRST logs

Edited by hillanddale, Yesterday, 02:09 PM.

Hi hillanddale,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution, before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Let's run a clean-up script and see if that resolves then issue.
Firstly here are a few observations for your consideration.
1) The free drive space is getting low, so I suggest you look at removing any unwanted programs and content. The FRST fix will also assist with this.
2) Your version of Java Runtime Environment is out of date and therefore potentially vulnerable. Unless you have a particular need for Java, it may be wise to uninstall via Control Panel>Programs and Features. If you wish keep it, you should update asap via Control Panel>Java>to open the Java Control Panel>Update Tab.
Unless you have a particular need for Java, it may be wise to uninstall via Control Panel>Programs and Features, as it has been prone to many vulnerabilities in the past.
If you wish keep it, you should make sure that it remains updated to the latest version. This normally happens automatically and can also be done manually via Control Panel>Java>to open the Java Control Panel>Update Tab.
3) The fix will make Avast Update Helper visible, which you can uninstall in the normal way, as the main program is no longer installed.
--------------------------------------------------------------------------------------------------------
Could you please run this FRST script next.
As a part of this I have included the The Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code. Also included is a firewall reset, so you may need to re-authorise some genuine connections.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
CreateRestorePoint:
CloseProcesses:
File: C:\Users\ijhd3\Downloads\flstudio_win64_21.2.3.4004.exe
2024-03-04 18:07 - 2024-03-04 18:07 - 975209152 _____ (Image-Line) C:\Users\ijhd3\Downloads\flstudio_win64_21.2.3.4004.exe
2024-02-12 15:03 - 2024-02-12 15:03 - 000000000 ____D C:\Program Files (x86)\AVAST Software
2024-02-12 15:01 - 2024-02-16 14:04 - 000000000 ____D C:\ProgramData\Avast Software
2024-02-12 15:01 - 2024-02-16 14:04 - 000000000 ____D C:\Program Files\Avast Software
Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1653.5 - AVAST Software) Hidden
2024-02-10 14:56 - 2023-08-30 16:14 - 000000000 ____D C:\Users\ijhd3\AppData\Roaming\utorrent
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\Run: [Chromium Update] => C:\Users\ijhd3\AppData\Local\Chromium\Update\1.3.99.0\ChromiumUpdateCore.exe [588800 2021-01-11] (Chromium.) [File not signed] <==== ATTENTION
Task: {88323F18-5AB3-44EF-81A7-E5910496F646} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-1761784628-959279815-2364782326-1001Core => C:\Users\ijhd3\AppData\Local\Chromium\Update\ChromiumUpdate.exe [100352 2021-01-11] (Chromium.) [File not signed] <==== ATTENTION
Task: {5E31640A-F74D-4F4B-8203-DEC9D9EABFDE} - System32\Tasks\ChromiumUpdateTaskUserS-1-5-21-1761784628-959279815-2364782326-1001UA => C:\Users\ijhd3\AppData\Local\Chromium\Update\ChromiumUpdate.exe [100352 2021-01-11] (Chromium.) [File not signed] <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-1761784628-959279815-2364782326-1001_Classes\CLSID\{D8E0CDAD-2FAE-40EB-8433-7F5A79714FB8}\InprocServer32 -> C:\Users\ijhd3\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll (Chromium.) [File not signed]
CustomCLSID: HKU\S-1-5-21-1761784628-959279815-2364782326-1001_Classes\CLSID\{E064AEC2-5150-4DF6-B2A3-1A6721C2076B}\InprocServer32 -> C:\Users\ijhd3\AppData\Local\Chromium\Update\1.3.99.0\psuser_64.dll (Chromium.) [File not signed]
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\StartupApproved\Run: => "Chromium"
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\StartupApproved\Run: => "Chromium Update"
C:\Users\ijhd3\AppData\Local\Chromium
FF Plugin HKU\S-1-5-21-1761784628-959279815-2364782326-1001: @chupdatechmm.com/Chromium Update;version=3 -> C:\Users\ijhd3\AppData\Local\Chromium\Update\1.3.99.0\npChromiumUpdate3.dll [2021-01-11] (Chromium.) [File not signed]
FF Plugin HKU\S-1-5-21-1761784628-959279815-2364782326-1001: @chupdatechmm.com/Chromium Update;version=9 -> C:\Users\ijhd3\AppData\Local\Chromium\Update\1.3.99.0\npChromiumUpdate3.dll [2021-01-11] (Chromium.) [File not signed]
FF Plugin HKU\S-1-5-21-1761784628-959279815-2364782326-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark\nplightsparkplugin.dll [No File]
CHR HKU\S-1-5-21-1761784628-959279815-2364782326-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jdanfkhnfpagoijgfmklhgakdicpnfil]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [9620]
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://uk.yahoo.com/?fr=fes_yfp_chr_nt_yfp2&type=wbf_nptdwxol_21_02_ssg01
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://uk.yahoo.com/?fr=fes_yfp_chr_nt_yfp2&type=wbf_nptdwxol_21_02_ssg01
HKLM\...\Run: [RTHDVCPL] => "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s (No File)
HKU\S-1-5-19\...\RunOnce: [OneDrive] => C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe /background /setautostart (No File)
HKU\S-1-5-20\...\RunOnce: [OneDrive] => C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe /background /setautostart (No File)
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\Run: [CorsairLink4] => C:\Program Files (x86)\CorsairLink4\CorsairLink4.exe -startup (No File)
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\Run: [btweb] => "C:\Users\ijhd3\AppData\Roaming\BitTorrent Web\btweb.exe" /MINIMIZED (No File)
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\Run: [utweb] => "C:\Users\ijhd3\AppData\Roaming\uTorrent Web\utweb.exe" /MINIMIZED (No File)
HKU\S-1-5-21-1761784628-959279815-2364782326-1001\...\Run: [Chromium] => "c:\users\ijhd3\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session (No File)
Task: {937927C0-53B4-4B21-87B5-DE505BAF0158} - System32\Tasks\Avast Secure Browser Heartbeat Task (Hourly) => C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe  --type=heartbeat --hourly (No File)
Task: {C74E6A57-1120-4112-BED7-308735106673} - System32\Tasks\Avast Secure Browser Heartbeat Task (Logon) => C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe  --type=heartbeat --logon (No File)
Task: {8CC7576C-5D3D-4CA2-8A5D-BA9D7E440B06} - System32\Tasks\iTop Screen Recorder SkipUAC (Isaac) => "C:\Program Files\iTop Screen Recorder\IScrRec.exe"  /skipuac (No File)
Task: {45806556-9251-4431-B3A3-09AD09C4A746} - System32\Tasks\iTop Screen Recorder Startup => "C:\Program Files\iTop Screen Recorder\IScrRec.exe"  /autorun (No File)
Task: {3806BD37-C94D-447E-B8E9-3935922C1F29} - System32\Tasks\iTop Screen Recorder UAC => "C:\Program Files\iTop Screen Recorder\iScrInit.exe"  /UAC (No File)
Task: {58C5BD15-4022-49DE-84BF-98200283B539} - System32\Tasks\iTop Screen Recorder Update => "C:\Program Files\iTop Screen Recorder\AutoUpdate.exe"  /auto (No File)
Task: {2A293E34-4FAA-42BD-AEFD-8B0A7B29ECC9} - System32\Tasks\iTopVPN_Scheduler_Isaac => "C:\Program Files (x86)\iTop VPN\iTopVPN.exe"  /autostart (No File)
Task: {2C7E998E-2BD1-4AB6-92A4-915405D63CCE} - System32\Tasks\iTopVPN_SkipUAC_Isaac => "C:\Program Files (x86)\iTop VPN\iTopVPN.exe"  /SkipUac (No File)
Task: {C9F13D6E-E389-40F4-A9DD-3FC86B9C6316} - System32\Tasks\iTopVPN_Update_Isaac => "C:\Program Files (x86)\iTop VPN\atud.exe"  /auto (No File)
Task: {5A8F6B5E-8593-4A6A-8EDE-2028CB47BCEA} - System32\Tasks\Start Corsair Link => "C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK.exe"  (No File)
Task: {52BACCAF-06EB-4335-81E5-31E268425E28} - System32\Tasks\AvastBrowserProtectS-1-5-21-1761784628-959279815-2364782326-1001 => C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtect.exe  --runonce (No File) <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-1761784628-959279815-2364782326-1001_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" -ToastActivated => No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
S3 cpuz149; \??\C:\WINDOWS\temp\cpuz149\cpuz149_x64.sys [X] <==== ATTENTION
S3 csravrcp; \SystemRoot\System32\drivers\csravrcp.sys [X]
S3 CsrBthAudioHF; \SystemRoot\System32\drivers\CsrBthAudioHF.sys [X]
S3 CsrBtPort; \SystemRoot\system32\DRIVERS\CsrBtPort.sys [X]
S3 csrhfgcc; \SystemRoot\System32\drivers\csrhfgcc.sys [X]
S3 csrpan; \SystemRoot\System32\drivers\csrpan.sys [X]
S3 csrserial; \SystemRoot\system32\DRIVERS\csrserial.sys [X]
S3 csr_bthav; \SystemRoot\system32\drivers\csrbthav.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\ijhd3\AppData\Local\Temp\tmp599F.tmp [X] <==== ATTENTION
cmd: netsh winsock reset catalog
cmd: netsh int ip reset C:\resettcpip.txt
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: Bitsadmin /Reset /Allusers
cmd: ipconfig /flushdns
Removeproxy:
Emptytemp:
End::

• Click on the Fix button just once and wait.
• If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.

Hi dennis_l,

Thanks for the quick reply! Here are the contents of fixlog.txt.

That's good news.

Let's now run a full scan with ESET Online Scanner., as an extra check.

• Download ESET Online Scanner from here and save it to your Desktop.
• Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
• Select your desired language from the drop-down menu and click Get started.
• Click Yes if a User Account window appears.
• In the Terms of use screen, click Accept if you agree to the Terms of use.
• Click Get started in the welcome screen.
• Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
• Click Computer scan, in the Welcome back screen.
• Choose Full scan on the next screen.
• Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
• Please note that this process can take several hours to complete.
• At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
• On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
• ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
• You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
• On the next screen, you can leave feedback about the program if you wish.
• There is an option to delete the application's data on closing, but we can but we can do this later.
• If you left feedback, click Submit and Close. If not, click Close.
• Copy and paste the contents of the ESETScan.txt file in your next reply.

The scan is finished, here are the results.

Ok good.
Please now run a scan with AdwCleaner, which is much quicker than ESET.

Please download AdwCleaner.

• Close all open programs and browsers
• Right click on the icon and select Run as administrator
• Click Scan Now
• When the scan has finished AdwCleaner shows you all detected PUPs and adware.
• If any are found, select them and click Quarantine. (I would suggest that you do not select Pre-installed applications for now, or any other items you wish to keep.)
• AdwCleaner prompts you to save and close your work before continuing. Click Continue.
• After cleaning, you are prompted to restart your device. Click Restart now to complete the cleanup process.

Once your computer has restarted ...

•     If it doesn't open automatically, please start AdwCleaner.
•     Click on View Log File button (This log can also be found in the Log Files tab).
•     A Notepad file will open containing the results.
•     Click Skip Basic Repair (if the option appears)
•     Please post the contents of the file in your next reply.

There are two notepad files, one for Scan and one for Clean. I'm assuming you're talking about the Clean one, so here it is, but if you meant the Scan one I can post that one as well.

Yes that was the right one.
As there were some more detections let's carry on with another scan.
We will remove all of these tools when we are finished.
I'd now like you to run a scan with Emsisoft Emergency Kit..

• Download and save the installation file from here:
• Emsisoft
• Double-click on the Emsisoft Emergency Kit setup file to start the installation process and then click on the Install button.
• You may be presented with a User Account Control warning, asking you if you want to run this file. Click Yes to continue.
• The downloaded package unpacks to “C:\EEK” by default and this folder now opens on your screen.
• To start Emsisoft, double-click on the Start Emergency Kit Scanner icon in this folder.
• You may get another User Account Control warning. Click Yes to continue.
• Accept the Licence Agreement.
• When you launch the program for the first time, Emsisoft Emergency Kit will automatically download updates. The Scan tab changes from orange to green when the update process is completed.
• Leave the settings unchanged, which include detection of Potentially Unwanted Programs.
• Now click on Malware Scan in the Scan button.
• When the Emsisoft scan has finished, you will see a screen reporting details of any malicious files found on your computer.(Close the pop up inviting installation of Emsisoft protection)
• Click Quarantine selected objects. (Note, this option is only shown if malicious objects were detected during the scan)
• You may be asked to restart your computer.
• When the threats have been quarantined, click the View Report button in the lower-right corner and the scan log will open in Notepad. The logs can also be accessed in the left hand menu bar.
• Please save this log on your desktop and post the contents into your next reply.
• When you close Emsisoft Emergency Kit it asks if you wish to sign up for a newsletter. This is optional, and does not affect the malware removal process.

Emsisoft didn't find anything. I'll attach the log anyway in case there's anything useful in there.

That's what I was hoping to see.
I believe that we are nearly all set now.
Please advise if you have any further questions, before I post some tool/log clean up instructions and information for your future reference.

You are most welcome.
This tool will remove the software we used.
KpRm by Kernel-panik

•     Download KpRm and save it to your Desktop
•     Right click on the icon and select Run as administrator.
•     Click Yes on the Disclaimer.
•     Place a check mark in Delete Tools and Create Restore Point.
•     Under Delete Quarantine, check Delete in 7 days.
•     Click Run.
•     Click OK in the All operations are completed box.
•     It will create and open a log report.
•     KpRm will delete itself from you Desktop and you can either save or remove the report that was generated.

These articles offer good advice and information for the future.
Keep your computer secure at home
How your system gets infected.
Ransomware advice.
Choosing Secure Passwords.
Thank you for contacting us at Bleeping Computer.

Dennis