Malwarebytes detects a file as malware every minute

[esuelflow]

This machine likely had a trojan on it, and malwarebytes kept flagging it every minute. I scanned the file and ran an ADW cleaner. Attached are the logs from FRST64 as well as malwarebytes

Addition.txt FRST.txt scanlogs.txt

[Maurice Naggar]

Hello @esuelflow  My name is Maurice. I will guide you. Allow me a while to review the reports you attached. I will get back with you.

[Maurice Naggar]

@esuelflow Question please. Is this like your own home computer?  or is this owned by someone eles or a company pc ?

[esuelflow]

A PC used by someone at my company

[Maurice Naggar]

I would suggest that you check with the company IT support first to confirm if they will take care of "this current" issue. That is because they may object to someone outside the company helping out.

[esuelflow]

I'm working with them to get this fixed, at the moment we aren't sure if we have successfully removed the malware from the PC. But my manager said that it would be OK for you to help me with this :D
Thank you for being considerate!

[Maurice Naggar]

The scan report you attached did not find a "malware'.  You had mentioned some 'file' was being flagged. 

I need all detail about that. Look at this guide article https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows

Look at the section "view "detection history". Please export out any reports dated for today or yesterday. I need detail on what was flagged / files names / file path. Attach the report files on next reply.

Edited March 15, 2022 by Maurice Naggar

[esuelflow]

I have attached the log for the detected file, this occured every minute from 8:47-when we took the computer off of the internet

detectionlog.txt

[Maurice Naggar]

Next, a custom script to do  checks & selected  cleanups. 

We will use FRST64.exe  on the Desktop folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Esuelflow  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will run the Windows DISM tool to check the system.  It will attempt a quick scan with Microsoft Defender. It will clear the Cache for Edge and Chrome

NOTE-2: As part of run it will attemp to add the IP address 164.90.198.40 to the block rules of Windows firewall for outbound & inbound. This is the IP blocked on the block notice.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   DESKTOP   folder
•  
•     Fixlist.txt        <<< - - - - -

Then, Start the Windows Explorer and then, go  to the DESKTOP    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity. 

[esuelflow]

Looks like it completed, attached is the fixlog.txt after I restarted the PC

Fixlog.txt

[Maurice Naggar]

Thank you. Hopefully, the IP block will not re-appear.
[ 2 ]
Inquire with your IT whether they actual intended to have these excluded from any monitoring by Microsoft Defender antivirus
C:\Users\Chad Weber\Desktop\NVClientInstall.exe
C:\Program Files (x86)\nvclient\sysdiag.exe
C:\Program Files (x86)\nvclient
C:\Program Files (x86)\nvclient\clfct.dll
C:\Program Files (x86)\nvclient\sinvfct.dll
C:\Program Files (x86)\nvclient\sysk32n.dll

[ 3 ]
As next steps, you can do a couple of on-demand manual scans with Microsoft Defender antivirus & then with Malwarebytes
Initiate the scans via the Right-click context menu option of Windows File Explorer
Start File Explorer
Expand the C drive tree on the right side until you see the folder C:\Windows\System32
Then, use the mouse pointer and on the right tree-view, do a RIGHT-click on C:\Windows\System32 &
select Scan with Microsoft Defender antivirus

Then repeat the same on that folder, do a RIGHT-click on C:\Windows\System32 &
select Scan with Malwarebytes

Let me know the results.  Let me know if you get the same IP block anymore.

[esuelflow]

Thank you for your help! I have attached a log of the malwarebytes scan on the folder. Windows defender didn't detect anything

malwarelog.txt

[Maurice Naggar]

Good morning. That is very good. For your consideration,  as just another check-up.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  CUSTOM scan  & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply.

[esuelflow]

I haven't had any popups from malwarebytes and IT let me know that I should remove these files
C:\Users\Chad Weber\Desktop\NVClientInstall.exe
C:\Program Files (x86)\nvclient\sysdiag.exe
C:\Program Files (x86)\nvclient
C:\Program Files (x86)\nvclient\clfct.dll
C:\Program Files (x86)\nvclient\sinvfct.dll
C:\Program Files (x86)\nvclient\sysk32n.dll

[esuelflow]

It is still running, but it has already detected 18 infected files. I'll post the log and await further instructions once it's complete. Thank you again for all your help

[Maurice Naggar]

Hi. Caution. Do not use what it displays on-screen during the run as the final conclusion. Only use the final result after it completes & is noted in the log file itself.  The conclusion may well find no infection. The other thing is, that this sort of scan option can take several hours to finish. You can leave the system be while it is scanning. Attach the "MSERT.log" after run is finished. { again, the interim visual display that may show 'infection' is NOT the final findings. If any are shown as such they are of a interim nature pending verification when they send up to the MS cloud for final say.)

[esuelflow]

Here is the log file.

msert.log

[Maurice Naggar]

YAY ! 

Results Summary:
----------------
No infection found.

Well done. We can pust aside the MSERT. 

Next, a custom script round 2.   This is to cleanup the settings on MS Defender antivirus that exclude "nvclient". This will also do a Quick scan with MS Defender antivirus.

FIRST please Delete the olf file named Fixlist.txt on the Desktop.

We will use FRST64.exe  on the Desktop folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Esuelflow  only / for this machine only.

 

 Hoping it will be not much more than say 12 or 15 minutes.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   DESKTOP   folder

Fixlist.txt      <<< - - - - -

Then, Start the Windows Explorer and then, go  to the DESKTOP    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity. 

[esuelflow]

Thank you so much for all your help!
Attached is the fixlog

Fixlog.txt

[Maurice Naggar]

Very good. Bravo. This pc should be good-to-go. See about doing a mirror-image backup if possible. You did fine. Is there some thing else you need?
The MS Defender A-V is in fine state & is up-to-date & has latest definitions from MS. and the 6 exclusions on the settings are no longer 'excluded'.
I would presume it no longer gets any IP block notices from Malwarebytes.

[esuelflow]

Thanks again for your help Maurice, definitely saved me a lot of time!

[Maurice Naggar]

Hi. You are very welcome. What follows is just a tools cleanup. 

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• You may attach that file to your next reply. (not compulsory)

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you