Windows Security : Detection

Hello,

 

Windows Security had detected this :

 

Hi scipion,
My name is Dennis and I will assist you with your computer problems.
Please read through these guidelines before we start.

• Back up any important data, as a precaution before starting this process.
• If you are unsure about anything then please ask. This makes the task much easier in the long run.
• Do not run any other tools or make changes to your system during the removal process.
• Please do not start a new topic and keep all replies in this thread.
• Follow the instructions in the sequence advised.
• Copy and paste the logs into the reply. I will advise if anything needs to be added as an attachment.
• Here at Bleeping Computer we are mostly volunteers, so please be patient with us. I’ll try to respond within 24 hours. You will be advised if it is expected to be longer than 48 hours.
• Please let me know if you are going to be delayed in responding. If you do not reply after 5 days, I’ll assume you do not want to continue and will close the topic.
• Sometimes things might seem to be resolved, but there may still need to be more checks necessary, so please wait until I give the all clear.

Firstly I'd like you to follow the steps outlined here: Preparation Guide
Section 6 covers how to download and run the Farbar Recovery Scan Tool (FRST).
Note: If you receive a warning about the download, it is a false positive and you can safely ignore it.
Please copy and paste both FRST logs into your reply. If you get an error message advising that the content is too long, you should post 2 separate replies.

Dennis

The detection is a Potentially unwanted application warning, which Windows Defender appears to have removed.
The path was "C:\Users\user\Downloads\subtitle-Harry.Potter.and.the.Chamber.of.Secre_813388.exe"
I suggest that you check your Downloads folder and remove anything no do not recognise or are unsure of.
Even better would be to remove everything by selecting all of the files in the folder (Ctrl+A keys) and press Shift+Delete (at the same time) on your keyboard.
When you are asked "Are you sure you want to permanently delete these items?", press Yes.
------------------------------------------------------------------------
I have checked your logs and see that you have DriversCloud.com installed.
If you need to download drivers, then it's best to get them from your computer manufacturer's or the device manufacturer's websites. This will ensure that you have the correct drivers.
I would therefore suggest that you consider removing this program.
-------------------------------------------------------------------------
I see that you have Peer 2 Peer torrent software installed. It is likely that if you continue to use this, you will become infected, as malicious Worms, Trojans & Ransomware can spread across P2P file sharing networks
It would be wise to uninstall Peer 2 Peer programs, but that choice is up to you. If you choose to remove the program, you can do so via Start > Windows System  > Control Panel > Programs and Features.
However if you still wish to keep it, please do not use until we are finished and your computer is clean and updated.
-------------------------------------------------------------------------
You have two open firewall ports showing, which may be needed for genuine reasons, but thought you should be made aware of this.

FirewallRules: [{297DD3A9-0AFA-4C1F-AF78-233EBF4391D4}] => (Allow) LPort=5357
FirewallRules: [{D0F8C007-EEFF-467C-A532-5F7704EF7437}] => (Allow) LPort=3445

---------------------------------------------------------------------------------
At the moment there are no obvious signs of malware being present.
We will do a scan later, but could you please run this FRST script next.
This is mainly to do some clean-up.
As a part of this I have included the The Emptytemp: command.
Note: This will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
Important: This script was written specifically for you, for use only on this machine. Running this on another machine may cause damage to your operating system

• Right click on the FRST icon and select Run as administrator.
• Highlight all of the information in the text box below then hit the Ctrl + C keys together to copy the text.
• It is not necessary to paste the information anywhere as FRST will do this for you.

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
VirusTotal: C:\Users\user\Downloads\MEmu-setup-abroad-sdk-mv.exe
HKU\S-1-5-21-1856328334-1563625827-3414849223-1001\...\MountPoints2: {00c63088-3156-11ee-ad84-d89ef306ab8e} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1856328334-1563625827-3414849223-1001\...\MountPoints2: {00c63446-3156-11ee-ad84-d89ef306ab8e} - "D:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-1856328334-1563625827-3414849223-1001\...\MountPoints2: {efbae751-029e-11ee-ad7d-d89ef306ab8e} - "D:\WifiAutoInstallSetup.exe"
S3 cpuz158; \??\C:\WINDOWS\temp\cpuz158\cpuz158_x64.sys [X] <==== ATTENTION
Task: {1D7D9660-8589-42BF-A10D-F5F01B2F8787} - System32\Tasks\CCleanerSkipUAC - user => "C:\Users\user\Desktop\ccleanner\CCleaner.exe"  $(Arg0) (No File)
CustomCLSID: HKU\S-1-5-21-1856328334-1563625827-3414849223-1001_Classes\CLSID\{d1b22d3d-8585-53a6-acb3-0e803c7e8d2a}\localserver32 -> "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --toast => No File
CustomCLSID: HKU\S-1-5-21-1856328334-1563625827-3414849223-1001_Classes\CLSID\{d936918b-9c4b-555e-074a-c79314be04e1}\localserver32 -> "C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe" -ToastActivated => No File
FirewallRules: [{0B117E71-E8B9-4C05-8A80-614C4925E102}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe => No File
FirewallRules: [{CC191C13-2A15-42FC-A832-FC986722D477}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe => No File
FirewallRules: [{02E62532-29DB-4460-AA5F-64F1102811DF}] => (Allow) C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe => No File
FirewallRules: [{DDA47412-D1B3-4078-98E6-99042581B934}] => (Allow) C:\Program Files (x86)\BlueStacks X\Cloud Game.exe => No File
FirewallRules: [{A9115C81-B4B7-498E-A1E0-B0D79492EF6E}] => (Allow) C:\Program Files\BlueStacks_nxt\HD-Player.exe => No File
FirewallRules: [{03F08C92-64AC-4F27-A1D3-8695C629E548}] => (Allow) C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe => No File
FirewallRules: [TCP Query User{362E0EEE-3FFF-47FC-A96C-D8E48E6657E5}D:\program files\microvirt\memuhyperv\memuhyper.exe] => (Allow) D:\program files\microvirt\memuhyperv\memuhyper.exe => No File
FirewallRules: [UDP Query User{6DD7DCBA-38A0-45A4-84CD-E5652E992922}D:\program files\microvirt\memuhyperv\memuhyper.exe] => (Allow) D:\program files\microvirt\memuhyperv\memuhyper.exe => No File
FirewallRules: [{87B13B0B-835B-40E5-A859-FC84E7185016}] => (Block) D:\program files\microvirt\memuhyperv\memuhyper.exe => No File
FirewallRules: [{6A1BCD40-6034-4424-8CD6-2FC4E914FE83}] => (Block) D:\program files\microvirt\memuhyperv\memuhyper.exe => No File
Emptytemp:
End::

• Click on the Fix button just once and wait.
• If the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When it's finished FRST will generate a log in the location you ran the tool from. (Fixlog.txt).

Please copy the contents from this text file and paste into your next reply.
Also advise how your computer is running now.

Hello,

 

Thank you for your help.

I've deleted all files in Download folder, uninstall DriverCloud and µTorrent.

At the moment, everything is good.

 

You are very welcome.
Let's now run a full scan with ESET Online Scanner., as an extra check.

• Download ESET Online Scanner from here and save it to your Desktop.
• Right click the esetonlinescanner.exe file you downloaded and select Run as administrator.
• Select your desired language from the drop-down menu and click Get started.
• Click Yes if a User Account window appears.
• In the Terms of use screen, click Accept if you agree to the Terms of use.
• Click Get started in the welcome screen.
• Select your preference for the Customer Experience Improvement Program and the Detection feedback system.Click Continue.
• Click Computer scan, in the Welcome back screen.
• Choose Full scan on the next screen.
• Select Enable ESET to detect and quarantine potentially unwanted applications.Then click Start scan
• Please note that this process can take several hours to complete.
• At the end of the scan, the Found and resolved detections screen may be displayed. You can click View detailed results to view specific information. Click Continue.
• On the following screen click Save scan log and save it to your Desktop as ESETScan.txt. Click Continue.
• ESET Online Scanner will now ask if you wish to turn on the Periodic Scan feature.I suggest that you do not do this for now Click Continue
• You are offered a 30 day trial of ESET Internet Security on the next screen. Click Continue
• On the next screen, you can leave feedback about the program if you wish.
• There is an option to delete the application's data on closing, but we can but we can do this later.
• If you left feedback, click Submit and Close. If not, click Close.
• Copy and paste the contents of the ESETScan.txt file in your next reply.

 

Hello,

 

Done but it was impossible to save or to find the ESETScan.txt.

So here is a snap of what it's done.

Everything was deleted : https://www.cjoint.com/c/NCdswmO8oVb

Everything was in a folder in my external USB hard drive.

 

Thank you

Ok that's fine.
I'd now like you to run a scan with AdwCleaner., which is normally fairly quick.
Please download AdwCleaner.

• Close all open programs and browsers
• Right click on the icon and select Run as administrator
• Click Scan Now
• When the scan has finished AdwCleaner shows you all detected PUPs and adware.
• If any are found, select them and click Quarantine. (I would suggest that you do not select Pre-installed applications for now, or any other items you wish to keep.)
• AdwCleaner prompts you to save and close your work before continuing. Click Continue.
• After cleaning, you are prompted to restart your device. Click Restart now to complete the cleanup process.

Once your computer has restarted ...

•     If it doesn't open automatically, please start AdwCleaner.
•     Click on View Log File button (This log can also be found in the Log Files tab).
•     A Notepad file will open containing the results.
•     Click Skip Basic Repair (if the option appears)
•     Please post the contents of the file in your next reply.

That's all looking good now and I believe that we are nearly all set.
Please advise if you have any further questions, before I post some tool/log clean up instructions and information for your future reference.

Thank you !

You are most welcome.

This tool will remove the software we used.
KpRm by Kernel-panik

•     Download KpRm and save it to your Desktop
•     Right click on the icon and select Run as administrator.
•     Click Yes on the Disclaimer.
•     Place a check mark in Delete Tools and Create Restore Point.
•     Under Delete Quarantine, check Delete in 7 days.
•     Click Run.
•     Click OK in the All operations are completed box.
•     It will create and open a log report.
•     KpRm will delete itself from you Desktop and you can either save or remove the report that was generated.

These articles offer good advice and information for the future.
Keep your computer secure at home
How your system gets infected.
Ransomware advice.
Choosing Secure Passwords.
Thank you for contacting us at Bleeping Computer.

Dennis