Jump to content

Logic Handler


Recommended Posts

Today I scanned the program data folder with malware bytes and I found many things out there. I did a scan out of curiosity, not because my pc had any symptoms or something but it found many possibly threatening files.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 06.08.2016
Scan Time: 13:45
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.08.06.06
Rootkit Database: v2016.05.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Bogdan

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 302346
Time Elapsed: 6 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 9
PUP.Optional.LogicHandler, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\backlh, Quarantined, [de00ec5b396184b2608f9ac42dd30cf4],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\mtQuotenamron, Quarantined, [716d51f61684fe38f09cb5416c97c63a],
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\jidkebcigjgheaahopdnlfaohgnocfai, Quarantined, [1dc140075d3d8fa79efa7a4f3fc328d8],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\Quotenamron_RASAPI32, Quarantined, [fbe3fd4a0793e94d020cd22439ca926e],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\Quotenamron_RASMANCS, Quarantined, [a33b87c0d1c93600d23cc92dca39b14f],
PUP.Optional.Linkury.ACMB1, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SILENTPROCESSEXIT\Quotenamron.exe, Quarantined, [03db63e4ff9b1a1c53f43db904ffcc34],
PUP.Optional.InstallCore, HKU\S-1-5-21-2711598060-2384948352-2474325007-1000\SOFTWARE\csastats, Quarantined, [e2fcdb6c3169eb4b3da03cbee81bd22e],
PUP.Optional.InstallCore, HKU\S-1-5-21-2711598060-2384948352-2474325007-1000\SOFTWARE\ICSW1.22, Quarantined, [2cb28dba2b6f95a1df70e9be010201ff],
PUP.Optional.ProductSetup, HKU\S-1-5-21-2711598060-2384948352-2474325007-1000\SOFTWARE\PRODUCTSETUP, Quarantined, [10cefe49f3a7320438cc426f08fb9868],

Registry Values: 2
PUP.Optional.LogicHandler, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\BACKLH|ImagePath, C:\ProgramData\Logic Handler\set.exe, Quarantined, [95494ff86b2f6dc9f0f424a611f1c739]
PUP.Optional.ProductSetup, HKU\S-1-5-21-2711598060-2384948352-2474325007-1000\SOFTWARE\PRODUCTSETUP|tb, 0D1F1Q2Z1G1B2R0C1L1U1I1M1S0X1J, Quarantined, [10cefe49f3a7320438cc426f08fb9868]

Registry Data: 1
PUP.Optional.Linkury, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {ielnksrch}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({ielnksrch}),Replaced,[a63896b1fe9ce155c8f46d0c07fd8779]

Folders: 8
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\X64, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\X86, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar, Quarantined, [8f4fa4a36b2fba7c7fe7d61eda29c040],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\icons, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\_metadata, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],

Files: 26
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\set.exe, Quarantined, [de00ec5b396184b2608f9ac42dd30cf4],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jidkebcigjgheaahopdnlfaohgnocfai_0.localstorage, Quarantined, [29b50c3b7f1bdd598c6d16b3b250c739],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\set.exe.config, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\Config.json, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\System.Data.SQLite.dll, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\System.Data.SQLite.Linq.dll, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\System.Data.SQLite.xml, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\X64\SQLite.Interop.dll, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.LogicHandler, C:\ProgramData\Logic Handler\X86\SQLite.Interop.dll, Quarantined, [5d819aad12884ceaeff4dfeb46bcf50b],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Roaming\md.xml, Quarantined, [805ee562950567cff0b65798d62df60a],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Roaming\noah.dat, Quarantined, [617d1d2ac8d2b68096113ab5897a34cc],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Roaming\uninstall_temp.ico, Quarantined, [da0441069a00a88e8b1d17d859aa946c],
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar\Blacklab.ico, Quarantined, [8f4fa4a36b2fba7c7fe7d61eda29c040],
PUP.Optional.Linkury, C:\Windows\Temp\Smartbar\Treeplus.ico, Quarantined, [8f4fa4a36b2fba7c7fe7d61eda29c040],
PUP.Optional.Linkury.ACMB1, C:\Windows\SysWOW64\findit.xml, Quarantined, [6975dc6b6535cb6b230ba0559c67c53b],
PUP.Optional.Linkury.Gen, C:\Users\Bogdan\AppData\Roaming\Openjob.tst, Quarantined, [2ab407401387b086e284c934a45f27d9],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\background.js, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\manifest.json, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\sitecontent.js, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\icons\128x128.png, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\icons\16x16.png, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\icons\favicon.ico, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Linkury, C:\Users\Bogdan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidkebcigjgheaahopdnlfaohgnocfai\1.0.8_0\_metadata\verified_contents.json, Quarantined, [f0eeaa9d4456171fc27039904bb7d927],
PUP.Optional.Amonetize, C:\Users\Bogdan\AppData\Local\Temp\amipixel.cfg, Quarantined, [607e3314a7f39d99fdeb0c90be4646ba],
PUP.Optional.Linkury.ACMB1, C:\Users\Bogdan\AppData\Roaming\Config.xml, Quarantined, [0bd3f94eaaf035013fea6736808455ab],
PUP.Optional.Linkury.ACMB1, C:\Users\Bogdan\AppData\Roaming\InstallationConfiguration.xml, Quarantined, [06d87ccbafeb1125ee3c0c9143c1aa56],

Physical Sectors: 0
(No malicious items detected)


this is the scan log and after it ended, I removed everything there was in there, but after I restarted my pc, it was blackscreen with a cursor for 5 seconds and then the desktop loaded. I must say that my asus gpu tweak opened as normally the first second after login, but the desktop was black with a cursor for 5 seconds and then it loaded. everything works normally but I am very paranoic. Have you got any clues or advices?

Link to post
Share on other sites

Hello and welcome::)

The log shows that MBAM removed many PUPs.  This pinned topic provides more information about PUPs.

It is generally safe to allow MBAM to remove them.

If you would like a bit more help checking the system with additional tools, to be sure you are clean, I suggest following the advice here: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the suggested, preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue - the helper will guide you through scanning, cleanup and repair.

Thank you,

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.