Screenmates Felix2.exe

[perdrix]

There may be malware around that hides under this name, but I'm running the original animated cat that IS NOT MALWARE.

So, please if you find this on a computer do at least make additional checks before you pronounce malware on it.

Dave

[Fatdcuk]

Hi Dave and welcome to the Malwarebytes support forums

 

Please can you attach a scan log showing when Malwarebytes has detected the file.

 

Thanks in advance.

[perdrix]

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/3/18
Scan Time: 11:03 AM
Log File: c819e05c-f075-11e7-9f09-005056c00001.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3613
License: Trial

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: APOLLO\amonra

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 696419
Threats Detected: 17
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 4 min, 3 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
PUP.Optional.eSupportNTFSUndelete, HKU\S-1-5-21-694050897-1356031325-3940840900-1001\SOFTWARE\ESUPPORT.COM\NTFSUndelete, No Action By User, [1981], [355425],1.0.3613
PUP.Optional.Amigo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\MEDIAPLAYER\SHIMINCLUSIONLIST\amigo.exe, No Action By User, [3877], [386186],1.0.3613
PUP.Optional.eSupportNTFSUndelete, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\NTFS Undelete_is1, No Action By User, [1981], [355426],1.0.3613
PUP.Optional.RussAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{8E8F97CD-60B5-456F-A201-73065652D099}, No Action By User, [10], [351113],1.0.3613

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.eSupportNTFSUndelete, C:\PROGRAM FILES (X86)\ESUPPORT.COM\NTFS UNDELETE, No Action By User, [1981], [358075],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ESUPPORT.COM\NTFS UNDELETE, No Action By User, [1981], [358076],1.0.3613
PUP.Optional.MailRu, C:\PROGRAM FILES (X86)\MAIL.RU, No Action By User, [635], [384138],1.0.3613

File: 10
PUP.Optional.eSupportNTFSUndelete, C:\USERS\PUBLIC\DESKTOP\NTFS UNDELETE.LNK, No Action By User, [1981], [355427],1.0.3613
PUP.Optional.MailRu, C:\USERS\AMONRA\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\MAIL.RU.LNK, No Action By User, [635], [384473],1.0.3613
PUP.Optional.MailRu, C:\USERS\AMONRA\FAVORITES\Mail.Ru Агент - используй для общения!.url, No Action By User, [635], [471428],1.0.3613
PUP.Optional.MailRu, C:\USERS\AMONRA\FAVORITES\Mail.Ru.url, No Action By User, [635], [471428],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\Program Files (x86)\eSupport.com\NTFS Undelete\NTFSundelete.exe, No Action By User, [1981], [358075],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\Program Files (x86)\eSupport.com\NTFS Undelete\unins000.dat, No Action By User, [1981], [358075],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\Program Files (x86)\eSupport.com\NTFS Undelete\unins000.exe, No Action By User, [1981], [358075],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com\NTFS Undelete\NTFS Undelete.lnk, No Action By User, [1981], [358076],1.0.3613
PUP.Optional.eSupportNTFSUndelete, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com\NTFS Undelete\Uninstall NTFS Undelete.lnk, No Action By User, [1981], [358076],1.0.3613
JokeTool.ScreenMate, C:\PROGRAM FILES (X86)\SCREENMATES\FELIX2.EXE, No Action By User, [4066], [474622],1.0.3613

Physical Sector: 0
(No malicious items detected)

(end)

[Fatdcuk]

Thanks Dave for reporting this.

I will get it fixed on the next update cycle today

 

Locking the topic as it will be shortly resolved.

Edited January 3, 2018 by Fatdcuk