Malware.AI.370446197

[scoutt]

We are getting hammered with the following

Malware.AI.3704461979	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{E71CA55D-3A3F-4662-BA87-0B21C5ED5DE3}
Malware.AI.3704461979	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{E71CA55D-3A3F-4662-BA87-0B21C5ED5DE3}
Malware.AI.3704461979	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\AppWin\User_Setting_WSUL
Malware.AI.3704461979	File	Malware	Quarantined	C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\AppWin\User_Setting_WSUL
Malware.AI.3704461979	File	Malware	Quarantined	C:\WINDOWS\SYSTEM32\WSU.EXE

Please allow, these are legit

 

Malware.AI is not very smart as these have not changed in years

 

[sUBs]

Apologies but I would require the logfile

[scoutt]

Which log file sUBs, there are a few of them lol

[Porthos]

1 hour ago, scoutt said:

Which log file sUBs, there are a few of them lol

To get the log from Malwarebytes do the following:
 

Single click on the target sight above scanner window.

In the new window select Report

Double click on the Scan log which shows the Date and time of the scan just performed.

Click Export > From export you have two options:
Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
 

Please use " Copy to Clipboard " then paste the contents here in your next reply

Please double-click on one of the block entries shown in the image you posted to view the report, then click the Export link on the bottom left of the report and select Copy to clipboard, then paste the contents here in your next reply so that we may take a look and advise you based on what it shows.

Thanks

[scoutt]

Hi Porthos, we are on Nebula, we don't have a scanning window. These are scheduled hyper scans.

[Porthos]

14 minutes ago, scoutt said:

Hi Porthos, we are on Nebula, we don't have a scanning window. These are scheduled hyper scans.

It helps to know that in each of your posts in the future.

 

[Porthos]

See if the following will help. Send the log directly by PM to @sUBs protect privacy.

https://support.malwarebytes.com/hc/en-us/articles/360038522294-Collect-Malwarebytes-Endpoint-Agent-diagnostic-logs

[scoutt]

Logs are way to big to send in the forum.

[shadowwar]

Can you just zip and attach a copy of the file that is being detected here (wsu.exe) here?

Subs if off for the weekend now so i can address this if i have a copy of the file. 

Edited June 12, 2021 by shadowwar

[scoutt]

Thanks Shadowwar

WSU.zip

[shadowwar]

This file is no longer detected but i whitelisted it anyways. 

Thanks for reporting.