Accidentally opened an .scr file

[jimmyn85]

Hi,

Help please, I just opened an .scr file that I am now worried that it contained a virus. How can I check that it hasn’t installed something unwanted on my PC? The file was sent to me through what I believed to be a trusted source. They were sending a word document that they had stated that they have encrypted as an .scr for security reasons.

I have unplugged the internet and run a malware bytes scan and a windows defender scan  nothing has come up.

Thank you in advance.

 

 

[MKDB]

Hello @jimmyn85  and 

 

My name is MKDB and I will assist you.

 

• Please follow the steps in the given order and post back the logs as an attachment when ready. Thank you very much for your cooperation.
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
• As English is not my native language, please do not use slang or idoms. It may be hard for me to understand.

 

 

I will guide you along on looking for potential malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Please stick with me until I give you the "all clear".
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.

 

 

 

Step 1

Please download the suitable version of Farbar Recovery Scan Tool (FRST) and save it to your desktop: 32bit | 64bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Check the box in front of Shortcut.txt.
• Press the Scan button.
• FRST will create three logs (FRST.txt + Addition.txt + Shortcut.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

[jimmyn85]

Thank you for your reply. I have carried out your instructions and attached the requested files for you. 

Addition.txtFRST.txtShortcut.txt

[jimmyn85]

Here is a link to download the rar file I was given containing the suspected .scr file. It may help diagnose the potential threat. Password is 1415. https://www.dropbox.com/s/c8heq7a79oav8ux/BlockHead%24.rar?dl=0 

[MKDB]

Thanks @jimmyn85.

Please remove this link from your post again!

 

First, let's do two scans.

 

 

Step 1

Please download AdwCleaner and save it to your desktop.

• Double-click to run it.
• Accept the End User License Agreement.
• Click Scan Now.
• When finished, if items are found please click Next / Quarantine.
• Maybe your PC will be rebooted, AdwCleaner will be opened automatically.
• Click View Log File.
• AdwCleaner will open one log (AdwCleaner[Cxx].txt).
• Please attach the log to your next reply.

 

 

Step 2

The Microsoft Safety Scanner (MSS) is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

• The download links & the how-to-run-the tool are at this link at Microsoft.
• Please let me know the results of this scan.
• Run a Quick Scan.
• The log is named MSERT.log.
• The log will be at%SYSTEMROOT%\debug\msert.log which in most cases is

C:\Windows\debug\msert.log

• Please attach that log with your next reply.

 

 

 

[jimmyn85]

Thank you. Requested files attached for you. msert.logAdwCleaner[C00].txt

[MKDB]

Thank you for your logfiles @jimmyn85.

 

We are going to remove some orphans and check windows system files, this may take some time (>15 min), please be patient. You should not run any other program while the fix is running.

After that, we do another scan to check.

 

 

Step 1

• Please download the attached fixlist.txt file and save it to the location where you ran FRST from ( P:\Downloads\ ).

Note: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

• Close all open programs and save your work.
• Run FRST again.
• Press the Fix button only once and wait. Please be patient.
• If the tool needs a restart, please make sure you let the system restart normally and let the tool complete its run after restart.
• FRST will create one log now (Fixlog.txt) in the same directory the tool is run.
• Please attach this logfile to your next reply.

 

 

Step 2

• Run FRST again.
• Do not change any settings.
• Press the Scan button.
• FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run.
• Please attach these logfiles to your next reply.

 

 

 

fixlist.txt

[jimmyn85]

Thanks how long does this usually take? It’s been 30 mins and FRST is now not responding attempting to delete local\temp files. 

[jimmyn85]

It finally completed and I have attached the requested files for you. Thank you.

Addition.txtFRST.txt 

[MKDB]

During the deletion of temp-files, it is possible that FRST is not responding, this is nothing to worry about.

Please attach fixlog.txt as well.

Thank you @jimmyn85.

[jimmyn85]

Ah ok thanks. Can I ask why I have to run the additional fixlog? What’s actually going on here, is there a virus present? I’m just curious to know. 

[MKDB]

Please note:

You should NOT run the fix again. You should only attach the logfile fixlog.txt which should have been created by FRST (according to my understanding, you have already run the fix, haven't you?).

 

Edited April 5, 2022 by MKDB

[jimmyn85]

Ah yes sorry I misread. Here it is. 

Fixlog.txt

[MKDB]

Thank you for the logfile @jimmyn85.

We have removed some orphans related to PUP (Potentially Unwanted Program), repaired damaged system files and and removed some orphans.

Your logfiles look good. How is your system running?

 

 

 

 

[jimmyn85]

Ok great, system appears to be running fine. Although it appeared to run fine before hand, I was just concerned that there may have been a hack attempt. Thanks again.  

[MKDB]

Thanks for your feedback @jimmyn85.

 

 

Thank you for your cooperation, we're done.

 

Step 1

• Right-Click on FRST64 and choose Rename.
• Rename FRST64 into Uninstall.
• Run Uninstall.
• FRST and it’s files/folders will be deleted.
• If the tool needs a restart, please make sure you let the system restarts normally.

 

 

 

A few final recommendations:

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes.

[MKDB]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.

 

As this topic seems to be solved, I do not follow it any longer.

Take care!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you