Malware.Exploit.Agent.Generic C:\WINDOWS\system32\cmd.exe

[MC71]

Hi,

I have a very similar problem to MBD888. When I open a word file it is often stopped from opening and then I receive a Malwarebytes notification like the following:

Exploit: 1
Malware.Exploit.Agent.Generic, ComSpec=C:\WINDOWS\system32\cmd.exe, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Word
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office WMI abuse blocked
File Name: ComSpec=C:\WINDOWS\system32\cmd.exe

I have tried to do what I can to figure it out without success including scanning, reinstalling windows as well as other software. Any help in fixing this would be appreciated.

Edited August 30, 2021 by AdvancedSetup
corrected font issue

[MC71]

Scan logs are attached.

FRST.txt Addition.txt WMI exploit alert.txt

[AdvancedSetup]

Sorry to hear you've having an issue @MC71

Can you please grab us the following logs so that we can review further.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[MC71]

Hi,

Thanks for your reply. Log files attached.

mbst-grab-results.zip

[AdvancedSetup]

Let me have you do the following for now while we continue to investigate

 

Open up the Malwarebytes program and click on the cogwheel top right
Click on the "Security" tab
Scroll all the way to the bottom to the Exploit Protection settings and click the Advanced Settings button
Click the "Application Behaviour Protection" tab and scroll down to "Office WMI Abuse Prevention" and uncheck the box under "MS Office"
click "apply"

 

[MC71]

Done.

[AdvancedSetup]

Has that corrected the issue for you for now @MC71 ?

 

[MC71]

It hasn't happened again when I open Word files so far, and it only happened sporadically previously. There don't seem to be any other issues so I wonder if I should assume that it is nothing to worry about particularly and is more likely an issue relating to some kind of conflict.

[AdvancedSetup]

We could do some generic clean up of your computer and see if that helps. Let me know if interested.

 

[MC71]

Yes that would be good.

[AdvancedSetup]

Are you actively using this on purpose ?

R2 ASOVPNHelper; C:\Program Files (x86)\Astrill\ASOvpnSvc.exe [823312 2020-10-11] (Astrill Systems Corp. -> Astrill)
S3 ASProxy; C:\Program Files (x86)\Astrill\ASProxy.exe [2618104 2016-06-01] (Astrill Systems Corp. -> Astrill)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ASProxy => ""="service"

 

Please check and make sure that your antivirus Bitdefender is not blocking your Dell software.

System errors:
=============
Error: (08/30/2021 09:46:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Remediation service failed to start due to the following error:
The system cannot find the file specified.

Error: (08/30/2021 09:44:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The RAPSService service failed to start due to the following error:
The system cannot find the file specified.

 

Perhaps before we do a clean up it might be best to visit Dell Support and update all of the Dell software

https://www.dell.com/support/home/en-us?l=en

Once you've updated all of your Dell software let me know please @MC71

Thanks

 

 

[Arthi]

Hi MC71, @MC71

Thanks for posting. We need additional logs to debug this issue. Can you please enable logging in the Malwarebytes product as provided in the below screenshot and grab logs again. Thanks.

 

Edited August 30, 2021 by AdvancedSetup
corrected font issue

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks