Checking for malware: windows 10

[Maryam]

Hello, 

I am worried that I might have a virus or malware or something of the sort on my laptop, and it's worth mentioning that I have downloaded many books and movies from torrent websites.

Windows defender would occasionally find a threat and it would be removed etc. and I didn't have the time to give it much attention. Fast forward to now:

1) a full scan found a threat on 21/6/2022: Event ID 1000

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
 For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/uTorrent_BundleInstaller&threatid=311958&enterprise=0
     Name: PUABundler:Win32/uTorrent_BundleInstaller
     ID: 311958
     Severity: Low
     Category: Potentially Unwanted Software
     Path: file:_C:\Users\20111\AppData\Roaming\uTorrent\updates\3.5.5_45505.exe; file:_C:\Users\20111\AppData\Roaming\uTorrent\updates\3.5.5_45704.exe
     Detection Origin: Local machine
     Detection Type: FastPath
     Detection Source: User
     User: DESKTOP-9VNPSBG\20111
     Process Name: Unknown
     Security intelligence Version: AV: 1.369.26.0, AS: 1.369.26.0, NIS: 1.369.26.0
     Engine Version: AM: 1.1.19300.2, NIS: 1.1.19300.2

 

2) I attempted an offline scan and noticed that the device would start before the offline scan was finished and I can't find it in the protection history. I went to the event viewer and event ID 5007 was there matching the time I started the offline scan, I attempted many times and it is repeated with varying values here's one example: 

Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
     Old value: Default\PreviousRunningMode = 0x0
     New value: HKLM\SOFTWARE\Microsoft\Windows Defender\PreviousRunningMode = 0x2

 

3) Then I downloaded Malware bytes and it scanned with no threats found 

4) I downloaded the Microsoft safety scanner tool ran the quick scan with no threats found, ran the full scan that went on for 8 hours during which it showed progress of finding 21 files infected but after it finished it said no threats found I took photos of the log 

 

then I ran a scan on the downloads folder and it also showed one file infected during the scan then nothing in the final report. 

 

 

[Maurice Naggar]

Hello @Maryam  I will guide you from here & forward. About the "screen" display of "infected" on the MS Safety Scanner...forget about that display....about what you "saw" on intermediate displays of the Microsoft Safety Scanner,  I would like you to review the remarks by AndyDavid about all that on this Microsoft community venue https://docs.microsoft.com/en-us/answers/questions/326108/mar-1721-msert-detects-items-during-scan-but-at-en.html

Also, the post by EricYin of Microsoft  ( just below that section)

 if nothing reported in %SYSTEMROOT%\debug\msert.log, that means no infections.

It's only the final report that matters.  For the gory details, see  https://answers.microsoft.com/en-us/protect/forum/protect_scanner-protect_scanning-windows_10/what-is-wrong-with-the-microsoft-safety-scanner/27c95df9-7d49-4d02-b734-bcb16495cfc3?messageId=e199de56-9a50-4cc5-a37a-3a7f2708b093

See also https://support.microsoft.com/en-us/topic/how-to-troubleshoot-an-error-when-you-run-the-microsoft-safety-scanner-6cd5faa1-f7b4-afd2-85c7-9bed02860f1c

*

ACTION items for you so you can provide me useful reports, which I need:

Do all steps listed on this topic I'm infected - What do I do now? - Windows Malware Removal Help & Support - Malwarebytes Forums

Then attach all reports on your next reply to this thread

 

[Maryam]

Thank you for the clarification. I am less worried now! Although I did have my wifi off during the scan so the msert.log mentions failure to submit MAPS report...

Here are the files:

malwarebytes scan report 23.6.2022.txt

Addition.txt

FRST.txt

 

[Maurice Naggar]

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.  That is, once it is under way, you should leave it running.  It will run for several hours.

• At screen "Detections occured and resolved" click on blue button "View detected results"
• On next screen, at lower left, click on blue "Save scan log"
• View where file is to be saved. Provide a meaningful name for the "File name:"
• On last screen, set to Off (left) the option for Periodic scanning
• Click "save and continue"
• Please attach the report file so I can review

[Maryam]

eset scan log 24.7.txt

[Maurice Naggar]

Hello. Thank you. 

[   Do a custom scan with Microsoft Defender Antivirus ]

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select CUSTOM scan & then pick the C drive  & have it go forward.

Once it has started the scan phase, you can go take a long break.   Let me know the results.

[Maryam]

Hello

The custom scan looked fine with 0 threats found

[Maurice Naggar]

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.

[Maryam]

AdwCleaner[C00].txt

[Maurice Naggar]

This custom script is for  Maryam  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any.  

We will use FRST64  on the Desktop\Trojan Malware Removal  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity.  It will rebuild the Winsock. 

NOTE-2: This should run scans with MS Defender antivirus and remove outstanding action items, if any. It will also cleanup a undesirable sub-folder Host App Service

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt          <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads  folder.

RIGHT click on FRST64  and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[Maryam]

Thank you for the follow-ups and the quick replies!

I just need to ask some questions before I proceed because we're getting into unfamiliar grounds for me. Could you clarify more what the logs meant? So far what I got is that firstly, there was Win32/uTorrent.C which, from the name, could be related to the torrent app that I previously had installed or files I downloaded (and I also recognize it from previous windows defender scans). Secondly, Pokki/host app service which the script will work on cleaning up. Both adware. Correct me if I'm wrong. 

Now the part I don't understand is this: 

5 hours ago, Maurice Naggar said:

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity.  It will rebuild the Winsock. 

Could you please elaborate more on what this will do exactly or why we're doing it? Also, Does this risk data loss or windows system failure of any sort? Do I need to backup on an external hard-drive before doing this or will doing so infect the hard-drive with the previously mentioned adware/malware? 

I do want them removed obviously, I just want to make sure I understand what I am doing and all its risks. Thanks again!

 

[Maurice Naggar]

The Win32/uTorrent.C were executable files that ESET online scanner found as threats. Thus removed.
Likewise Host App Service is a threat. It is not part of Windows  and any of its remains need to be removed.
System File Checker is a basic tool of Windows file protection. It is a component of the Microsoft Windows operating system. It is used to look for potential corrupted Windows files, and if any are corrupted, to get the legitimate one back in place. This is a standard set of tools run when we are dealing with a case of suspicion of malware.
No, these do not have a risk of data loss, nor a system failure.
If you wish, you may take the extra step beforehand to save backup copies of your documents.

[Maryam]

Okay. I got a bit busy but I will proceed with the script hopefully some time in the next couple of days . I will be back to upload the log when done. 

Many thanks. 

[AdvancedSetup]

Hello @Maryam

Are you still with us?

 

[Maryam]

Yes, I am. 

[Maurice Naggar]

Looking forward to your doing my prior suggestions here https://forums.malwarebytes.com/topic/287764-checking-for-malware-windows-10/?do=findComment&comment=1522090

You can get that started & once it begins, you can step away and take a break.

[Maryam]

Here it is.

a side note: I noticed that utorrent can now be found in the add/uninstall programs (uninstall button not clickable)

 

 

 

Fixlog - Copy.txt

[Maurice Naggar]

Hello. Thank you for the Fixlog report. That is a good run. Now, since I believe this Windows system has MCAFEE, I suggest you launch McAfee and do a full scan. Let me know the result.

[Maryam]

It might've had McAfee but I think I uninstalled it at some point. Now it only has the McAfee security scanner which only seems to do quick scans.

[Maurice Naggar]

Hi. I would recommend getting a report on the update status of some key apps.

• Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• and save the tool on the desktop.
• If Windows's  SmartScreen block that with a message-window, then
• Click on the MORE INFO spot and over-ride that and allow it to proceed.

                               This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[Maurice Naggar]

Hello @Maryam How goes this?

[Maryam]

[Maurice Naggar]

That is a "false" positive. You should over-ride that message if at all possible.

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks