Jump to content
LesJ3

Trojan:Win32/Fuery.C!cl

Recommended Posts

I keep getting notifications from Windows Defender saying "Threat Detected: Trojan:Win32/Fuery.C!cl" and "Status: Removed".  The notifications occur largely when the computer is not in use, not when I'm browsing or reading e-mail.  The notifications have been happening a few times a day for about a week.  There are no other apparent issues (my PC isn't slow, no strange web pages, etc.)

I'm currently using Norton Security Suite, which hasn't detected anything, and ran Malwarebytes, which also didn't find anything, yet the notifications in Windows Defender keep occurring.

Any thoughts on how best to eradicate this virus?  Is there really a virus or is this a false positive from Windows Defender?

Thanks!

 

 

Share this post


Link to post
Share on other sites

 

Hi,   @LesJ3

My name is Maurice. I will be helping and guiding you, going forward on this case.   I have moved the thread to the malware removal help sub-forum.  For one-to-one help.

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible.

 

Please only just attach   all report files, etc  that I ask for as we go along.

 

Please understand that Windows Defender is able to detect suspicious / and other threats that may not be tagged by Malwarebytes, such as non-EXE type files.

Windows 10 has the Microsoft Windows Defender which can run the Windows Defender Offline scan.
Windows Defender Offline in Windows 10 can be run directly from within Windows, without having to create bootable media.

Click the Windows Start menu button on the Taskbar, select Settings icon. Then choose Update and Security.
 

In Windows Settings  >>> click on Windows Security from the left side list.

Next, In Windows Security section:  Click on the grey button Open Windows Security

next click on the blue Scan options

Look down the options list.  Tick on Windows Defender Offline scan.   Then click the grey "Scan now" button.


and let it scan the system.

Keep in mind that the design and what is scanned by Windows Defender is a whole different design from Malwarebytes. But do let me know how this scan goes and what the result is.

.

.

This is the way to look at the Windows Defender scan history.

 

Go to the Windows Start menu.  Click on the Settings icon.

Now click on Update & Security.   Then click on Open Windows Security.

·  Click the Virus & threat protection tile     and then the Protection  history label  ( in blue color)

The Protection history will have a list of recent events.

Share this post


Link to post
Share on other sites

Hey Maurice,

Thanks for the guidance.  I ran the Windows Defender offline scan, but am still getting notifications in the Windows Defender Protection History about Win32/Fuery.C!cl.  It happens every few hours where it finds and removes a couple .tmp files.

I've attached a screenshot from Windows Defender with one of the notifications.

Any ideas on how to get rid of this?

WindowsDefender-Screenshot-2020-01-16.jpg

Share this post


Link to post
Share on other sites

Hi.   Thanks for the screen grab.   Any ,tmp file is game for deletion.   Lets do this following custom script to remove these .tmp files along with other temporary files.

 

Start NOTEPAD { you can press Windows-key+R keys to get the RUN option
and then type in

NOTEPAD.exe


and press Enter key to start NOTEPAD.

Check and make sure "word wrap" is off. 
From Notepad main menu bar, Select F (format) and make sure Word Wrap is NOT checked.
IF it -is- checkmarked, click that one time so that it is un-checked.

Please copy/paste the lines below to Notepad:


@Echo on
pushd\windows\system64
del /q c:\windows\syswow64\00026658.tmp
del /q c:\windows\syswow64\00027001.tmp
del /q /s c:\windows\syswow64\*.tmp
pushd\windows\system32

exit


now Save as flush.bat to your desktop.  Close Notepad.

 

Using Windows File Explorer, go to the Desktop.
RIGHT-click flush.bat file   with the mouse pointer and select RUN As Administrator  to start it.

Reply YES to allow the process to proceed when prompted by Windows.   allow it to go forward.

.

I would suggest that after this, you run this scan with a Microsoft scanner.

The Microsoft Safety Scanner  is a free Microsoft stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Let me know the result of this.

The log is named MSERT.log 

the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is

C:\Windows\debug\msert.log

Please attach that log with your reply.

 

.

Share this post


Link to post
Share on other sites

Maurice:

I did both - neither found anything, although I have uploaded the logs as you suggested.  Perhaps Windows Defender was being blocked access to a running process containing the virus?  There seem to be no traces of the virus otherwise and I haven't gotten any notifications about the virus since this morning.

Thanks for the help!

- Les

msert.log

Share this post


Link to post
Share on other sites

Thank you for the scan report.   Excellent result.

Results Summary:
----------------
No infection found.
Microsoft Safety Scanner Finished On Fri Jan 17 15:30:54 2020

.

You may do a different scan  to get another "opinion".

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.
When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Click on the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.

Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).

Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Share this post


Link to post
Share on other sites

Hi.

Just checking in.   How are things ?   Do you need other help?

Sincerely,

Maurice

Share this post


Link to post
Share on other sites

Maurice,

Could this have been a false-positive notification from Windows Defender?  None of the other AV tools found anything, even though I was getting repeated messages from Windows Defender in real-time.

Thanks!

- Les

Share this post


Link to post
Share on other sites

Hi Les.

One has to keep in mind that Microsoft Windows Defender has its own unique design  and its own unique detection engine and rules.

I cant make a judgement as to whether it was a correct tagging or a false one.  My assumption would tend to be that W D  is correct.

That said, those .TMP files ought to be long gone.

Q:  Is there anything else at this time ?

Share this post


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.