Jump to content

Malware.Exploit.Agent.Generic C:\WINDOWS\system32\cmd.exe


Recommended Posts

Hi,

I have a very similar problem to MBD888. When I open a word file it is often stopped from opening and then I receive a Malwarebytes notification like the following:

Exploit: 1
Malware.Exploit.Agent.Generic, ComSpec=C:\WINDOWS\system32\cmd.exe, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Word
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office WMI abuse blocked
File Name: ComSpec=C:\WINDOWS\system32\cmd.exe

I have tried to do what I can to figure it out without success including scanning, reinstalling windows as well as other software. Any help in fixing this would be appreciated.

Edited by AdvancedSetup
corrected font issue
Link to post
Share on other sites

  • Root Admin

Sorry to hear you've having an issue @MC71

Can you please grab us the following logs so that we can review further.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites

  • Root Admin

Let me have you do the following for now while we continue to investigate

 

Open up the Malwarebytes program and click on the cogwheel top right
Click on the "Security" tab
Scroll all the way to the bottom to the Exploit Protection settings and click the Advanced Settings button
Click the "Application Behaviour Protection" tab and scroll down to "Office WMI Abuse Prevention" and uncheck the box under "MS Office"
click "apply"

 

Link to post
Share on other sites

It hasn't happened again when I open Word files so far, and it only happened sporadically previously. There don't seem to be any other issues so I wonder if I should assume that it is nothing to worry about particularly and is more likely an issue relating to some kind of conflict.

Link to post
Share on other sites

  • Root Admin

Are you actively using this on purpose ?

R2 ASOVPNHelper; C:\Program Files (x86)\Astrill\ASOvpnSvc.exe [823312 2020-10-11] (Astrill Systems Corp. -> Astrill)
S3 ASProxy; C:\Program Files (x86)\Astrill\ASProxy.exe [2618104 2016-06-01] (Astrill Systems Corp. -> Astrill)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ASProxy => ""="service"

 

Please check and make sure that your antivirus Bitdefender is not blocking your Dell software.

System errors:
=============
Error: (08/30/2021 09:46:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Remediation service failed to start due to the following error:
The system cannot find the file specified.

Error: (08/30/2021 09:44:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The RAPSService service failed to start due to the following error:
The system cannot find the file specified.

 

Perhaps before we do a clean up it might be best to visit Dell Support and update all of the Dell software

https://www.dell.com/support/home/en-us?l=en

Once you've updated all of your Dell software let me know please @MC71

Thanks

 

 

Link to post
Share on other sites

  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.