Jump to content

All Activity

This stream auto-updates     

  1. Past hour
  2. Firefox started following Malwarebytes not detecting malware
  3. Firefox
    I would try updating to Malwarebytes 4, it has a better engine for detecting Malware. Once you upgrade, make sure to enable the scan for rootkits before performing your first scan with it. See if that helps.
  4. ottchris
    Much appreciated.
  5. gatortail started following Remove site from Blocklist
  6. gatortail
    The Trojan block is being removed and should be available within the hour.
  7. Maurice Naggar
    Thank you for that. Thank you for your patience. While at present the Malwarebytes for Windows is not installed, I noticed a couple of its drivers present, as well as what seems to be a trace of the support-tool open. Going forward & unless something changes, we want to stay away from the Malwarebytes support tool. On the Downloads folder, there is a installer file for Malwarebytes that we can use ( later ) for installation. What I have here, at present, is a batch custom script to do some cleanups, some inquiries on services, and also to attempt a couple of runs of the Windows System File Checker tool. Please Close and Save any open work you may have open. Please close as many un-needed app-windows that you yourself may have open at this point. So you can have a clear field of view. P.S. Delete any prior saved copy of Fixlist.txt ( from before ) This custom script is for 1MitchX only. Close and save any open work files before starting this procedure. Please Close and save any open work files before you start this next step. It may involve a Windows Restart at the end of it. I am sending a custom Fix script which is going to be used by the FRST64 tool. They will both work together as a pair. Please RIGHT-click the (attached file named) FIXLIST and select SAVE link AS and save it directly ( as is) to the DOWNLOADS folder The tool named FRST64.exe tool is already on the Downloads folder Start the Windows Explorer and then, to the Desktop. Double click FRST64 to run the tool. If the tool warns you the version is outdated, please download and run the updated version. IF Windows prompts you about running this, select YES to allow it to proceed. IF you get a block message from Windows about this tool...... click line More info information on that screen and click button Run anyway on next screen. on the FRST window: Click the Fix button just once, and wait. PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick. If you receive a message that a reboot is required, please make sure you allow it to restart normally. The tool will complete its run after restart. When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run. Please attach the FIXLOG.txt with your next reply later, at your next opportunity We will do more afterwards. Thank you. Sincerely, Maurice Fixlist.txt
  8. jboursier
    @HempOil Thanks for your questions. 1. Yes, it gathers logs for all Malwarebytes products, including AdwCleaner. It also provides us diagnostic information that we hope can help to pinpoint the issue. 2. Sure, feel free to send me a private message instead. (The content will only be shared with AdwCleaner development team afterwards) Thanks!
  9. Today
  10. John117 started following Anti-Exploit causes Office 365 Crashes when "save to" is clicked
  11. John117
    Hello, we are having Issues with Malwarebytes Anti-Exploit for a very long time: it causes all Office 365 applications to crash if someone wants to use the "save to" option. This option only works if Office is excluded from the Anti-Exploit. I attached a picture of the Event viewer (in this case PowerPoint crashed). I know this is a common issue but I wasn´t able to find a work around to fix it. Thank you for your attention.
  12. technurse
    Thanks, but it's not from the router, the router is just reporting that it's detected malware on device x. But when I scan any of the devices, Malwarebytes says there's no malware. It's reported on different devices, Mac, PC, and mobile devices.
  13. TwinHeadedEagle
    Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks
  14. LiquidTension
    That's certainly understandable. I will provide an update in this forum topic once we release the update containing the fix.
  15. marksnake
    now its ok! thanks
  16. 1MitchX
    Done.
  17. LiquidTension
    Thank you to everyone who has tried the beta and provided feedback. It's greatly appreciated. A forum announcement will be made once the latest release candidate is released to public.
  18. ottchris
    Many Thanks LiquidTension. Don't think reducing "Advanced Memory Protection" (see quoted workarounds in your reply and my first post) is a sensible idea. I need Copernic at the moment so I shall have to leave Chrome uninstalled until the permanent fix is implemented. So far, the only impact on Firefox appears minimal and avoidable, whereas just running a bare-boned freshly downloaded and installed copy of Chrome triggered the exploit detection. Chris
  19. Maurice Naggar
    Hi. Thank you so much for those reports. I will be making another reply later on. At this point I would like to have you do a few command line runs in a Windows Elevated Command prompt. ( a Command prompt with administrator-level rights ). Open the Start Menu, type cmd in the search box, right click on cmd.exe (at top), and click on Run as administrator. (see screenshot below) This should cause a black Command prompt ( with administrator rights) to show. I would like you to COPY each command line ( one at a time) from here and then PASTE into the black-command-prompt and then tap Enter-key and allow them to proceed. And then monitor and also write down the bottom line result-summary-displayed for each net start trustedinstaller net start winmgmt Close the command prompt window. Thank you for your patience.
  20. LiquidTension started following Copernic Desktop Search and Malware.Exploit.Agent.Generic and malwarebytes blocks vscode?
  21. LiquidTension
    Hi @kingzee, Thank you for the report. We have a defect currently for this issue and are still in the process of investigating it. If you would prefer not to post the logs in public, you are welcome to send me a private message with the logs attached. We have found the issue is not reliably reproducible, so environmental information will assist our efforts here. VS Code version? Are you using stable or insiders? Installed VS Code extensions? OS information? Malwarebytes component version (found in Settings -> About)? Are you running VS Code in a virtual machine or live machine?
  22. Maurice Naggar
    Hi Julie, From this point forward, we need to only address this one machine, the Windows 10 pc at hand. Just one. Reason being, I am having a hard time to determine which set of reports to look back on. This machine is a Windows 10 / 64 bit / and apparently on the build 1903 of Windows. I would like to have you do a few command line runs in a Windows Elevated Command prompt. ( a Command prompt with administrator-level rights ). Look on keyboard and press and hold the Windows-key and then tap the X key. and then tap the A key. ( Command Prompt ( Admin ) This should cause a black Command prompt ( with administrator rights) to show. I would like you to COPY each command line ( one at a time) from here and then PASTE into the black-command-prompt and then tap Enter-key and allow them to proceed. net start trustedinstaller net start winmgmt DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth . Close the command prompt. Locate where you saved the report tool named FRST64. ( it should be on the downloads folder) Run new report with FRST64 Right-click on FRST64 icon and select Run as Administrator to start the tool , and reply YES to allow it to proceed and run. _Windows 8 or 10 users will be prompted about Windows *SmartScreen protection* - click line More info information on that screen and click button Run anyway on next screen._ Click YES when prompted by Windows U A C prompt to allow it to run. Note: If you are prompted by Windows SmartScreen, click More info & followup & choose Run anyway. Approve the Windows UAC prompt on Windows Vista and newer operating systems by clicking on Continue or Yes. Click Yes when the* disclaimer* appears in FRST. The tool may want to update itself - in that case you'll be prompted when the update is completed and ready to use. Make sure that Addition options is *checked* - the configuration should look exactly like on the screen below (do not mark additional things unless asked). Press Scan button and wait. The tool will produce 2 logfiles on your desktop: FRST.txt , Addition.txt Then also, remind me, what is the main goal you have about this machine. Thank you. Click OK button when it shows up. Close the Notepad windows when they show on screen. The tool saves the files. Please attach these 2 files to your next reply.
  23. Dashke
    Can you please check if you are getting the notification now?
  24. Dashke
    Thanks, the block will be removed!
  25. 1MitchX
    All utilities suggested ran to completion. Addition.txt FRST.txt FSS.txt MTB.txt
  26. LiquidTension
    Thank you for the update. If you encounter any further issues, please let us know. We have a defect filed and hope to have a fix available in the future.
  27. LiquidTension
    Hi Chris, Thank you for your patience. The permanent fix (mentioned in the quotation included in your first post) is not yet available in Malwarebytes for Windows. We have been working on a fix and hope to make it available in an upcoming component update. In the meantime, we recommend sticking with one of the two known workarounds for the issue.
  28. Exeyer started following False positive prnwatch.com
  29. Exeyer
    www.prnwatch.com is blocked. VirusTotal checking - https://www.virustotal.com/gui/url/a5ab69682b9372df8e3f27828d3f4436593cd0e9872b32628bd27d0ac31fcd64/detection Please remove it from blocking.
  30. Exeyer Exeyer joined the community
  31. Metallica
    What is SAntivirus?The Malwarebytes research team has determined that SAntivirus is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.More information can be found on our Malwarebytes Labs blog.How do I know if I am infected with SAntivirus?This is how the main screen of the system optimizer looks:You will find this icon in your taskbar, and your startmenu:and see these warnings during install:and these new services:and this new driver:and this entry in your list of installed programs:How did SAntivirus get on my computer?These so-called system optimizers use different methods of getting installed. This particular one was installed by a bundler.How do I remove SAntivirus?Our program Malwarebytes can detect and remove this potentially unwanted application.This program needs to be removed in Safe Mode.Please follow these instructions:Run Malwarebytes from Safe Mode with Networking:Step 1:Boot into Safe Mode with Networking: Restart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point, you should gently tap the F8 key repeatedly until you are presented with the Advanced Boot Options menu. Select the option for Safe Mode with Networking using the arrow keys. Then press Enter on your keyboard to boot into Safe Mode. If prompted to choose a user account to login, click on your normal user name (not Administrator unless that is your normal user account) to log into Windows Step 2: Please download Malwarebytes for Windows to your desktop. Double-click MBSetup.exe and follow the prompts to install the program. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen. Click on the Get started button. Click Scan to start a Threat Scan. When the scan is finished click Quarantine to remove the found threats. Reboot the system back into normal mode. Is there anything else I need to do to get rid of SAntivirus? No, Malwarebytes removes SAntivirus completely. How would the full version of Malwarebytes help protect me?We hope our application and this guide have helped you eradicate this system optimizer.As you can see below the full version of Malwarebytes would have protected you against the SAntivirus installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late. Technical details for expertsYou may see these entries in FRST logs: (Digital Communications Inc -> Digital Com. Inc) C:\Program Files (x86)\SAntivirus\SAntivirusClient.exe (Digital Communications Inc -> Digital Com. Inc) C:\Program Files (x86)\SAntivirus\SAntivirusIC.exe (Digital Communications Inc -> Digital Com. Inc) C:\Program Files (x86)\SAntivirus\SAntivirusService.exe "SAntivirusIC" => service was unlocked. <==== ATTENTION R2 SAntivirusIC; C:\Program Files (x86)\SAntivirus\SAntivirusIC.exe [6988496 2020-01-24] (Digital Communications Inc -> Digital Com. Inc) R2 SAntivirusSvc; C:\Program Files (x86)\SAntivirus\SAntivirusService.exe [141008 2020-01-24] (Digital Communications Inc -> Digital Com. Inc) R1 SANTIVIRUSKD; C:\Program Files (x86)\SAntivirus\SAntivirusKD.sys [90096 2020-01-24] (Digital Communications Inc. -> Digital Comm. Inc) C:\Users\{username}\AppData\Roaming\santivirusclient C:\Program Files (x86)\SAntivirus C:\ProgramData\SAntivirus C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAntivirus (Digital Com. Inc ©) C:\Users\{username}\Desktop\SetupS.exe SAntivirus Product (HKLM-x32\...\SAntivirus) (Version: 1.0.21.19 - Digital Com. Inc) ContextMenuHandlers1: [SAntivirusShellExtension.FileContextMenuExt] -> {7784BE7F-A15C-4A41-ACF5-4CC020154952} => C:\Program Files (x86)\SAntivirus\SAntivirusShell64_v102119.dll [2020-01-24] (Digital Communications Inc -> Digital Com. Inc) ContextMenuHandlers4: [SAntivirusShellExtension.FileContextMenuExt] -> {7784BE7F-A15C-4A41-ACF5-4CC020154952} => C:\Program Files (x86)\SAntivirus\SAntivirusShell64_v102119.dll [2020-01-24] (Digital Communications Inc -> Digital Com. Inc) ContextMenuHandlers6: [SAntivirusShellExtension.FileContextMenuExt] -> {7784BE7F-A15C-4A41-ACF5-4CC020154952} => C:\Program Files (x86)\SAntivirus\SAntivirusShell64_v102119.dll [2020-01-24] (Digital Communications Inc -> Digital Com. Inc) Alterations made by the installer: File system details [View: All details] (Selection) --------------------------------------------------- Adds the folder C:\Program Files (x86)\SAntivirus Adds the file Errors.dat"="1/24/2020 9:50 AM, 330 bytes, A Adds the file ExclusionsList.dat"="1/24/2020 9:50 AM, 81196 bytes, A Adds the file Microsoft.Diagnostics.Tracing.TraceEvent.dll"="12/19/2018 12:23 PM, 1008944 bytes, A Adds the file Microsoft.Win32.TaskScheduler.dll"="12/19/2018 12:23 PM, 310784 bytes, A Adds the file package.dat"="12/26/2019 4:43 PM, 20129892 bytes, A Adds the file rsEngine.config"="1/24/2020 9:50 AM, 256 bytes, A Adds the file rsEngine.dll"="12/6/2019 2:43 PM, 5570328 bytes, A Adds the file rsEngineHelper.exe"="1/24/2020 9:48 AM, 164120 bytes, A Adds the file rsEngineHelper.exe.config"="12/19/2018 12:23 PM, 383 bytes, A Adds the file rsEngineSDK.dll"="12/6/2019 2:43 PM, 242456 bytes, A Adds the file SAntivirusClient.exe"="1/24/2020 9:48 AM, 1726672 bytes, A Adds the file SAntivirusClient.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file SAntivirusEngine.dll"="1/24/2020 9:48 AM, 1031376 bytes, A Adds the file SAntivirusIC.config"="1/24/2020 9:54 AM, 1 bytes, A Adds the file SAntivirusIC.exe"="1/24/2020 9:48 AM, 6988496 bytes, A Adds the file SAntivirusKD.sys"="1/24/2020 9:48 AM, 90096 bytes, A Adds the file SAntivirusService.config"="1/24/2020 9:53 AM, 2048 bytes, A Adds the file SAntivirusService.exe"="1/24/2020 9:48 AM, 141008 bytes, A Adds the file SAntivirusService.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file SAntivirusShell64_v102119.dll"="1/24/2020 9:48 AM, 185040 bytes, A Adds the file SAntivirusShell86_v102119.dll"="1/24/2020 9:48 AM, 154832 bytes, A Adds the file SAntivirusTools.dll"="1/24/2020 9:48 AM, 55504 bytes, A Adds the file SAntivirusUninstaller.exe"="1/24/2020 9:48 AM, 1253072 bytes, A Adds the file SAntivirusUninstaller.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file Signatures.dat"="1/24/2020 9:50 AM, 1108824 bytes, A Adds the file SignaturesPacks.dat"="1/24/2020 9:50 AM, 204460 bytes, A Adds the file System.Threading.dll"="12/19/2018 12:23 PM, 387408 bytes, A Adds the file un.ico"="12/26/2019 4:04 PM, 34494 bytes, A Adds the file WhiteList.dat"="1/24/2020 9:50 AM, 311020 bytes, A Adds the folder C:\Program Files (x86)\SAntivirus\amd64 Adds the file KernelTraceControl.dll"="12/19/2018 12:23 PM, 223008 bytes, A Adds the file msdia140.dll"="12/19/2018 12:23 PM, 1380512 bytes, A Adds the folder C:\Program Files (x86)\SAntivirus\Cache Adds the folder C:\Program Files (x86)\SAntivirus\x64 Adds the file 7z64.dll"="12/19/2018 12:23 PM, 1646592 bytes, A Adds the file ext_x64.dll"="12/19/2018 12:23 PM, 375576 bytes, A Adds the file lz4_x64.dll"="12/19/2018 12:23 PM, 119064 bytes, A Adds the file rsEngineFW_x64.dll"="12/19/2018 12:23 PM, 104216 bytes, A Adds the file rsEnginePM_x64.dll"="12/19/2018 12:23 PM, 228120 bytes, A Adds the file rsLggrServer_x64.dll"="12/19/2018 12:23 PM, 821528 bytes, A Adds the file System.Data.SQLite.dll"="12/19/2018 12:23 PM, 1658136 bytes, A Adds the folder C:\Program Files (x86)\SAntivirus\x86 Adds the file 7z86.dll"="12/19/2018 12:23 PM, 1113088 bytes, A Adds the file ext_x86.dll"="12/19/2018 12:23 PM, 280344 bytes, A Adds the file KernelTraceControl.dll"="12/19/2018 12:23 PM, 167200 bytes, A Adds the file lz4_x86.dll"="12/19/2018 12:23 PM, 98584 bytes, A Adds the file msdia140.dll"="12/19/2018 12:23 PM, 1081656 bytes, A Adds the file rsEngineFW_x86.dll"="12/19/2018 12:23 PM, 88856 bytes, A Adds the file rsEnginePM_x86.dll"="12/19/2018 12:23 PM, 190744 bytes, A Adds the file rsLggrServer_x86.dll"="12/19/2018 12:23 PM, 569344 bytes, A Adds the file System.Data.SQLite.dll"="12/19/2018 12:23 PM, 1209624 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAntivirus Adds the file SAntivirus Product.lnk"="1/24/2020 9:48 AM, 1011 bytes, A Adds the folder C:\ProgramData\SAntivirus Adds the file b.dat"="1/24/2020 9:48 AM, 19050864 bytes, A Adds the folder C:\ProgramData\SAntivirus\b Adds the file Microsoft.Diagnostics.Tracing.TraceEvent.dll"="12/19/2018 12:23 PM, 1008944 bytes, A Adds the file Microsoft.Win32.TaskScheduler.dll"="12/19/2018 12:23 PM, 310784 bytes, A Adds the file rsEngine.dll"="12/6/2019 2:43 PM, 5570328 bytes, A Adds the file rsEngineHelper.exe"="1/24/2020 9:48 AM, 164120 bytes, A Adds the file rsEngineHelper.exe.config"="12/19/2018 12:23 PM, 383 bytes, A Adds the file rsEngineSDK.dll"="12/6/2019 2:43 PM, 242456 bytes, A Adds the file SAntivirusClient.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file SAntivirusService.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file SAntivirusUninstaller.exe.config"="2/9/2019 5:44 PM, 427 bytes, A Adds the file System.Threading.dll"="12/19/2018 12:23 PM, 387408 bytes, A Adds the folder C:\ProgramData\SAntivirus\b\amd64 Adds the file KernelTraceControl.dll"="12/19/2018 12:23 PM, 223008 bytes, A Adds the file msdia140.dll"="12/19/2018 12:23 PM, 1380512 bytes, A Adds the folder C:\ProgramData\SAntivirus\b\x64 Adds the file 7z64.dll"="12/19/2018 12:23 PM, 1646592 bytes, A Adds the file ext_x64.dll"="12/19/2018 12:23 PM, 375576 bytes, A Adds the file lz4_x64.dll"="12/19/2018 12:23 PM, 119064 bytes, A Adds the file rsEngineFW_x64.dll"="12/19/2018 12:23 PM, 104216 bytes, A Adds the file rsEnginePM_x64.dll"="12/19/2018 12:23 PM, 228120 bytes, A Adds the file rsLggrServer_x64.dll"="12/19/2018 12:23 PM, 821528 bytes, A Adds the file System.Data.SQLite.dll"="12/19/2018 12:23 PM, 1658136 bytes, A Adds the folder C:\ProgramData\SAntivirus\b\x86 Adds the file 7z86.dll"="12/19/2018 12:23 PM, 1113088 bytes, A Adds the file ext_x86.dll"="12/19/2018 12:23 PM, 280344 bytes, A Adds the file KernelTraceControl.dll"="12/19/2018 12:23 PM, 167200 bytes, A Adds the file lz4_x86.dll"="12/19/2018 12:23 PM, 98584 bytes, A Adds the file msdia140.dll"="12/19/2018 12:23 PM, 1081656 bytes, A Adds the file rsEngineFW_x86.dll"="12/19/2018 12:23 PM, 88856 bytes, A Adds the file rsEnginePM_x86.dll"="12/19/2018 12:23 PM, 190744 bytes, A Adds the file rsLggrServer_x86.dll"="12/19/2018 12:23 PM, 569344 bytes, A Adds the file System.Data.SQLite.dll"="12/19/2018 12:23 PM, 1209624 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\santivirusclient Adds the file santivirusclientConfig.xml"="1/24/2020 9:50 AM, 1233 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}] "(Default)"="REG_SZ", "SAntivirusShellExtension.FileContextMenuExt Class" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files (x86)\SAntivirus\SAntivirusShell64_v102119.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\*\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\Folder\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\lnkfile\shellex\ContextMenuHandlers\SAntivirusShellExtension.FileContextMenuExt] "(Default)"="REG_SZ", "{7784BE7F-A15C-4A41-ACF5-4CC020154952}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}] "(Default)"="REG_SZ", "SAntivirusShellExtension.FileContextMenuExt Class" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}\InprocServer32] "(Default)"="REG_SZ", "C:\Program Files (x86)\SAntivirus\SAntivirusShell86_v102119.dll" "ThreadingModel"="REG_SZ", "Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\SAntivirus\Protected] [HKEY_LOCAL_MACHINE\SOFTWARE\SAntivirus] "campid"="REG_SZ", "" "channel"="REG_SZ", "" "DIUCIE"="REG_SZ", "oPeivQUmp1HQIdzZWWYABAr9vhEl/K1fdKcJ7hJ6vnywqDG2B5iBnmpea/CqXWRf" "EVNLSA"="REG_SZ", "637154562580668961" "fbsd_ictssd"="REG_DWORD", 1579820400 "FirstRun"="REG_SZ", "1/24/2020 9:50:00 AM" "INSTDT"="REG_SZ", "637154562016873158" "ite"="REG_DWORD", 1579855733 "iuid"="REG_SZ", "0" "lhsday"="REG_DWORD", 1579820400 "lvsday"="REG_DWORD", 1579820400 "pixel"="REG_SZ", "" "PMDPP"="REG_SZ", "0" "RGUSR"="REG_SZ", "637154562017964466" "SDKLFC"="REG_SZ", "637154562577666195" "SDKLUC"="REG_SZ", "637154562575272531" "ServicePipe"="REG_SZ", "SAntivirus1" "SIGLC"="REG_SZ", "1/24/2020 9:50:56 AM" "su"="REG_SZ", "8a803927793b13626b59dcb4adcbc283f2feda7d196e4eb3f807fb4cc6b183d9" "tg"="REG_SZ", "" "U"="REG_SZ", "0ab2630c-b6c0-4568-aa9d-7394687dd436" "UH"="REG_SZ", "840A88286A38BC706482266E552A7018" "WLLCK"="REG_SZ", "1/24/2020 9:50:57 AM" [HKEY_LOCAL_MACHINE\SOFTWARE\SegOption] "fst"="REG_DWORD", 1 "gui"="REG_DWORD", 42 "guisc"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SAntivirus] "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\SAntivirus\un.ico" "DisplayName"="REG_SZ", "SAntivirus Product" "DisplayVersion"="REG_SZ", "1.0.21.19" "EstimatedSize"="REG_DWORD", 49640 "Publisher"="REG_SZ", "Digital Com. Inc" "UninstallString"="REG_SZ", "C:\Program Files (x86)\SAntivirus\SAntivirusUninstaller.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\SAntivirus\Protected] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SAntivirus] "cr"="REG_DWORD", 1579855627 "EVNLSA"="REG_SZ", "637154562580668961" "FirstRun"="REG_SZ", "1/24/2020 9:50:00 AM" "IMode"="REG_DWORD", 0 "InstallDir"="REG_SZ", "C:\Program Files (x86)\SAntivirus" "INSTDT"="REG_SZ", "637154562016873158" "PMDPP"="REG_SZ", "0" "RGUSR"="REG_SZ", "637154562017964466" "SDKLFC"="REG_SZ", "637154562577666195" "SDKLUC"="REG_SZ", "637154562575272531" "SIGLC"="REG_SZ", "1/24/2020 9:50:56 AM" "U"="REG_SZ", "0ab2630c-b6c0-4568-aa9d-7394687dd436" "UH"="REG_SZ", "840A88286A38BC706482266E552A7018" "WLLCK"="REG_SZ", "1/24/2020 9:50:57 AM" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SAntivirusProduct] "InstallEnd"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\SAntivirusSvc] "EventMessageFile"="REG_EXPAND_SZ, "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EventLogMessages.dll" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAntivirusIC] "Description"="REG_SZ", "This service protect your pc from viruses and spyware." "DisplayName"="REG_SZ", "SAntivirusIC" "ErrorControl"="REG_DWORD", 1 "FailureActions"="REG_BINARY, ............d...d...d. "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\SAntivirus\SAntivirusIC.exe -service" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 16 "WOW64"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAntivirusIC\Security] "Security"="REG_BINARY, ........0................p...."......................... ................................... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SANTIVIRUSKD] "DisplayName"="REG_SZ", "SAntivirus Kernel Driver" "ErrorControl"="REG_DWORD", 1 "Group"="REG_SZ", "SAntivirus Kernel Driver" "ImagePath"="REG_EXPAND_SZ, "\??\C:\Program Files (x86)\SAntivirus\SAntivirusKD.sys" "Start"="REG_DWORD", 1 "Tag"="REG_DWORD", 1 "Type"="REG_DWORD", 1 "WOW64"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SANTIVIRUSKD\Enum] "0"="REG_SZ", "Root\LEGACY_SANTIVIRUSKD\0000" "Count"="REG_DWORD", 1 "NextInstance"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAntivirusSvc] "Description"="REG_SZ", "This service protect your pc from viruses and spyware." "DisplayName"="REG_SZ", "SAntivirusSvc" "ErrorControl"="REG_DWORD", 1 "FailureActions"="REG_BINARY, ............d...d...d. "ImagePath"="REG_EXPAND_SZ, "C:\Program Files (x86)\SAntivirus\SAntivirusService.exe" "ObjectName"="REG_SZ", "LocalSystem" "Start"="REG_DWORD", 2 "Type"="REG_DWORD", 16 "WOW64"="REG_DWORD", 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAntivirusSvc\Security] "Security"="REG_BINARY, ........0................p...."......................... ................................... Malwarebytes log: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 1/24/20 Scan Time: 11:00 AM Log File: 55ffdc54-3e90-11ea-b6a9-00ffdcc6fdfc.json -Software Information- Version: 4.0.4.49 Components Version: 1.0.793 Update Package Version: 1.0.18176 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 235953 Threats Detected: 37 Threats Quarantined: 37 Time Elapsed: 4 min, 5 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 22 PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SAntivirusShellExtension.FileContextMenuExt, Quarantined, 1553, 783943, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SAntivirusIC, Quarantined, 1553, 783952, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SANTIVIRUSKD, Quarantined, 1553, 783953, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SAntivirusSvc, Quarantined, 1553, 783954, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\SAntivirus, Quarantined, 1553, 783949, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\SegOption, Quarantined, 1553, 757809, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\SAntivirus, Quarantined, 1553, 783948, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SAntivirus, Quarantined, 1553, 783950, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\*\SHELLEX\CONTEXTMENUHANDLERS\SAntivirusShellExtension.FileContextMenuExt, Quarantined, 1553, 783945, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\SAntivirus, Quarantined, 1553, 783949, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\SAntivirusProduct, Quarantined, 1553, 783951, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\santivirusclient_RASAPI32, Quarantined, 1553, 783946, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\santivirusclient_RASMANCS, Quarantined, 1553, 783946, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SAntivirusService_RASAPI32, Quarantined, 1553, 783947, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\TRACING\SAntivirusService_RASMANCS, Quarantined, 1553, 783947, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\SAntivirus, Quarantined, 1553, 783948, 1.0.18176, , ame, PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}\InprocServer32, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}\InprocServer32, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}\InprocServer32, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7784BE7F-A15C-4A41-ACF5-4CC020154952}, Quarantined, 1553, 783944, 1.0.18176, , ame, Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 4 PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS, Quarantined, 1553, 783938, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\SANTIVIRUS, Quarantined, 1553, 783939, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\PROGRAMDATA\SANTIVIRUS, Quarantined, 1553, 783940, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\USERS\{username}\APPDATA\ROAMING\SANTIVIRUSCLIENT, Quarantined, 1553, 783941, 1.0.18176, , ame, File: 11 PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSIC.EXE, Quarantined, 1553, 783952, , , , PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSKD.SYS, Quarantined, 1553, 783953, , , , PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSSERVICE.EXE, Quarantined, 1553, 783954, , , , PUP.Optional.Segurazo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAntivirus\SAntivirus Product.lnk, Quarantined, 1553, 783939, , , , PUP.Optional.Segurazo, C:\Users\{username}\AppData\Roaming\santivirusclient\santivirusclientConfig.xml, Quarantined, 1553, 783941, , , , PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSSHELL64_V102119.DLL, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSSHELL86_V102119.DLL, Quarantined, 1553, 783944, , , , PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSKD.SYS, Quarantined, 1553, 783938, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSIC.EXE, Quarantined, 1553, 783938, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\PROGRAM FILES (X86)\SANTIVIRUS\SANTIVIRUSSERVICE.EXE, Quarantined, 1553, 783938, 1.0.18176, , ame, PUP.Optional.Segurazo, C:\USERS\{username}\DESKTOP\SETUPS.EXE, Quarantined, 1553, 783956, 1.0.18176, , ame, Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & Servers Malware Execution Prevention Save yourself the hassle and get protected.
  32. John117 John117 joined the community
  33. Twidget2869 started following Should We Enable Rootkit Scanning?
  34. Twidget2869
    You are so right, it took an ENTIRE EXTRA SEVEN SECONDS. It took longer to click on the check box to enable it than it took for it to actually run... If you can't afford an extra 7 seconds...
  35. Twidget2869 Twidget2869 joined the community
  36. MysteryFCM started following Entire TLD blacklisting
  37. MysteryFCM
    Please do not post live links. As alluded to by Samuel, there are quite a lot that have already been whitelisted by the BG team, but there are a plethora of others that have not. They review those on a case by case basis.
  1. Load more activity
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept