healthy software (healthy.exe)

[blade7658]

I received a warning today from Windows Firewall about healthy.exe. I can't find anything on this program and so thought I would pick your brains. When I scanned the folder with Malwarebytes it found nothing suspicious (nor did my daily full scan). But the file location is under C:\Users\Scott\AppData\Roaming\Healthy and it looks like the entire program is there (the exe file, several dll files and two folders (img and locales). I find that really odd, but admit I don't spend anytime in the appdata folder. When I searched the internet, I found nothing on this program, which I also found odd. Any thoughts?

Thanks!

Scott

[AdvancedSetup]

Good day, @blade7658 let us get some logs to see what's going on

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[blade7658]

Thanks so much @AdvancedSetup!

Attached are my files. Nothing found that I could tell, but I am not even a 1% expert on this.

 

AdwCleaner[S00].txt blade7658 malwarebytes scan results.txt FRST.txt Addition.txt

[AdvancedSetup]

Thank you for the logs, @blade7658

 

Do you access DOD Military sites?

You have some disallow certificates that are for the Dept. of Defense that appear to be invalid.

Let's go ahead and stop Folding at Home for now. it can be quite a drain on resources at times.

Did you set up this task on purpose yourself?

Tasks\Daily reboot => shutdown /r /f /t 0

 

 

Please run the following fix. Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply.

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[blade7658]

@AdvancedSetup

Thanks for the help, I feel like I just took a giant step forward.

I retired from the military 2 years ago (before that I hit military sites daily). I might still occasionally go to a .mil site, but mostly just dfas.mil (the pay site) at this point. Except DFAS, it might be a base website or a news page, but nothing that would require a certificate (I would think).

I thought I removed folding at home years ago (I liked the concept, but did note it ran the computer hard, so I removed the program with add/remove). Let me know if I need to do more as I can't find it on my computer (using search) and it was not on the add/remove list.

I ran FRST and the fixlog is attached. Several questions after the reboot. I had three Defender Firewall popups on reboot. I think I want to allow them, but will wait for your thoughts. They are:

Steam Client Bootstrapper - least important to me, but not sure what will be broke if I deny. I play a lot of Steam games, which typically require connecting with their server before you are allowed to play.

ACDSee Commander Ultimate 2022 - this program is my picture organizer and one feature I use is to automatically download pictures from my phone. This represents the vast, vast majority of pictures I take and it not a small number (we have our first grandchild now!).

Plex Media Server - this is my movie organizer and allows me to play movies on my TV stored on a hard drive attached to my computer.

I think it is "safe" to turn these 3 on, but await your thoughts. 

Thanks for the summary of what will happen - I use LastPass and love it. I had no concerns, so I let it run. One editing comment - you may want to put a comment "read below!" before you say "press the fix button".  I do things as I read them (like many I suspect), but just happened to glance down at the rest of the message before I ran FRST.

I looked at the "Healthy" directory (in Scott\AppData\Local) since that was my initial concern and it is still there, but now only with only a "User Data" folder which contains 3,589 files and 94 folders (327 MB), but none are exe files. Many "file" types, some database files (.db), "OLD" and "text" files, and two "PMA" files.  I am guessing I can delete this whole "Healthy" directory, but will also await your inputs.

 

Thanks again!

 

 

Fixlog.txt

[AdvancedSetup]

Thank you for your service.

Yes, please go ahead and allow those Firewall alerts for the requested items if asked.

Let me get a new run of the Farbar scanner. Run it and click on the SCAN button. Then post back both new logs. Perhaps I missed the entries for the Healthy in the AppData\Local

 

FRST.TXT
ADDITION.TXT

 

Thanks

 

[blade7658]

Thanks for your support!

Attached is the new FRST logs. Thanks

Addition.txt FRST.txt

[AdvancedSetup]

Thank you for the logs.

Some bad news. Note the entry in the Event Logs. It is showing a bad block which can be a sign of a failing drive.

 

System errors:
=============
Error: (07/18/2022 01:37:06 PM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (07/18/2022 01:37:06 PM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (07/18/2022 01:37:01 PM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

 

DR0 pertains to your main C: drive where Windows is installed.

 

DriveLetter   : C:
Number        : 0
Label         : Samsung 870 EVO Boot Drive
Manufacturer  :
Model         : Samsung SSD 870 EVO 4TB
SerialNumber  : S6BBNJ0RB00800F
Name          : Samsung SSD 870 EVO 4TB
FirmwareRev   : SVT01B6Q
PnPID         : SCSI\DISK&VEN_SAMSUNG&PROD_SSD_870_EVO_4TB\7&162ECC57&0&010000
SCSIPort      : 0
FileSystem    : NTFS
MediaType     : Fixed hard disk media
PartitionKind : GPT
BootDisk      : True
TotalSpace    : 3725.204
FreeSpace     : 1639.57
UsedSpace     : 2085.634
Drive         : Win32_LogicalDisk: C: (DeviceID = "C:")
Partition     : Win32_DiskPartition: Disk #0, Partition #1 (DeviceID = "Disk #0, Partition #1")
Disk          : Win32_DiskDrive: Samsung SSD 870 EVO 4TB (DeviceID = "\\.\PHYSICALDRIVE0")

 

Please download the Samsung Magician software and have it check the drive. There is a SMART check and then there is a SHORT check I'd run.

https://semiconductor.samsung.com/consumer-storage/support/tools/

 

Let me know what it says. If the drive is failing you'll need to get it replaced and the data backed up before it fails.

 

Here is an example of running the SMART and SHORT scans. I'd run the SMART self-test first. Then move on to the SHORT Scan. It will show under the Logs in the program.

 

[blade7658]

That drive failing would be tragic as it is only 2 months old. I saw something that made me wonder (an event viewer entry - the same one you saw?), so I checked it with CHKDSK (including Stage 5) previously and with CrystalDiskInfo. Both had no errors. Good news is I have a strong backup regiment.

The short SMART scan csv is attached. Looks fine to me but it doesn't say much. I couldn't find any other logs for either scan.

The short scan had no bad results and said drive is in good condition. I could not see how to get a log (used export for SMART, but not an option for short).

 

Calder short SMART.csv

[blade7658]

I think I found the actual logs for both scans (attached). Thanks!

SMSVC_1658175649.log SMUI_1658175656.log

[AdvancedSetup]

Great, sounds good. Please check and see if the Firmware is up to date as well.

We'll go ahead and move forward then since the disk checks out good.

Please go ahead and delete the HEALTHY folder if you feel comfortable doing so. If not, let me know and we can use Farbar to do so.

C:\Users\Scott\AppData\Local\Healthy

Only remove that folder.

Then run the following scanner and post back the log when ready after removing that folder.

 

 

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

 

[AdvancedSetup]

Good day, @blade7658

How are things going? Were you able to run the Scanner above?

 

[blade7658]

I meant to tell you I updated the firmware before running those tests.

I deleted the healthy folder.

I was going to run the Microsoft Safety Scanner tonight when I head to bed. I didn't see this message until this AM.

Thanks!

[AdvancedSetup]

Excellent sounds good. I'll check back on you again tomorrow then.

Have a great day

 

[blade7658]

Scan is done and log is attached. Looks like good news to me (one malware removed), but I await your thougths and instructions.

I hope you had a terrific day!

msert.log

[AdvancedSetup]

Good day, @blade7658

Yes, great news there. That was just a tamper setting that was off. Microsoft has corrected the setting for us.

 

How is the computer running now?
Are there still any signs of an infection or other alerts, or popups?

 

Please temporarily right-click over Malwarebytes and quit the program from the Task Tray
Then run the following program. Once the program has finished running you can restart Malwarebytes

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

• Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• If Microsoft SmartScreen blocks the download, click through to save the file
• This tool is safe.   Smartscreen is overly sensitive.
• If SmartScreen blocks the file from running click on More info and Run anyway
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

 

Thank you

 

 

[blade7658]

Things all seem good now. I feel like I got so much more help than just removing healthy.exe. Thanks so much for your incredible help. Attached is the log. I don't use Firefox currently but every so often I pull it up if I am having a problem on some web site and it updates the software then (I just did that to confirm). I stand by for any other advice. Thanks so much!

SecurityCheck.txt

[AdvancedSetup]

You're quite welcome for the assist

 

Please uninstall, update, or otherwise address the following as appropriate for your computer.

 

---------------------- [ AntiVirusFirewallInstall ] -----------------------

Malwarebytes version 4.5.10.200 v.4.5.10.200 Warning! Download Update

--------------------------- [ OtherUtilities ] ----------------------------

NVIDIA GeForce Experience 3.24.0.126 v.3.24.0.126 Warning! Download Update

Python 3.10.4 (64-bit) v.3.10.4150.0 Warning! Download Update

Microsoft Visual Studio Code (User) v.1.68.1 Warning! Download Update

------------------------------ [ ArchAndFM ] ------------------------------

7-Zip 19.00 (x64) v.19.00 Warning! Download Update
Uninstall old version and install new one.

-------------------------- [ IMAndCollaborate ] ---------------------------

Cisco Webex Meetings v.40.12.4 Warning! Download Update

Zoom v.5.9.1 (2581) Warning! Download Update

 

-------------------------------- [ Media ] --------------------------------

QuickTime 7 v.7.76.80.95 Warning! This software is no longer supported. Please uninstall it and use another software.

 

------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 74.0.1 (x64 en-US) v.74.0.1 Warning! Download Update

 

---------------------------- [ UnwantedApps ] -----------------------------

Bonjour v.3.1.0.1 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.

 

 

When those items are done, restart the computer. Then click on START and type in "Check for updates" and allow Windows to scan for and install any updates it finds.

 

Keep me posted on your progress

 

Thanks

 

 

[blade7658]

Wow, I try hard to keep things up to date!

Interestingly Malwarebytes update failed when I used the system tray but it worked when I opened the program and updated via the about tab. Now the system tray icon tells me I am update.

Updated GeForce Experience security patch, but I can't run the latest version of GeForce Experience - NVIDIA has ceased support of my video card that is about 8 years old now (but still works for me).  I am likely going to replace it in the next year, but I am not really in a rush.

Updated VS Code by opening VS Code (and gave me the nudge I needed to get some work done).

Updated Python to 3.10.5 (the latest version now)

7-zip uninstalled and new version installed.

I uninstalled web-x. I don't use it any longer, so will reinstall at a future date if needed.

Updated Zoom via the app.

Quick Time unistalled.

Firefox was updated yesterday when I opened it.

I need Bonjour as I plug my iPhone into my PC. Pretty sure my PC won't be able to talk to my phone without it.

Windows is up to date.

Attached is the latest Security Check - looks good to me.

Thanks!

SecurityCheck.txt

[AdvancedSetup]

I uninstall GeForce Experience myself or try to prevent it from being installed as I simply just don't use it.

As for Bonjour I have and use my wife's iPhone and all works just fine without Bonjour. It is simply a sharing protocol but Windows already has its own.

Up to you but it is quite noisy and creates local network traffic storms that are not needed in my opinion. If you find you do have an issue it takes no time to reinstall it.

 

Are there any other issues or concerns then before we finish up here?

 

 

[blade7658]

I liked GeForce because it optimized my games and it kept the video card up to date, but now that it can't do the second part, I might dump it.

I will try uninstalling Bonjour.

Thanks for all the help - have a great week!

[AdvancedSetup]

Glad we could help.

 

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please attach that file to your next reply. (not compulsory)

 

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes

 

[blade7658]

I ran KPRM (attached).

Comments:

1. I use LastPass and have found it very helpful. 

2. I back up continuously with an online service. Proved helpful when I lost a file storage hard drive a few months back. Recovered everything.

3. Installed PatchMyPC - I like the idea and will give it a try for a while. So far very impressive.

4. I believe I have this set up correctly and have not noticed any problems with Windows not updating.

5. Great read. I might go back to Firefox, but I got away from it as some sites were not running well on it. Have to admit, the value of cookies currently outweighs the negatives for me, so I don't think I will be deleting them daily any time soon.

6. Browser Guard is already installed (and it works very well). I added UBlock as well.

Really amazing stuff - definitely bookmarked #5 and have opened up the referenced material for further reading.

Thanks!

kprm-20220720170842.txt

[AdvancedSetup]

14 minutes ago, blade7658 said:

1. I use LastPass and have found it very helpful. Good that you're using one. Last Pass has had a few issues in the past but none severe that I recall

2. I back up continuously with an online service. Proved helpful when I lost a file storage hard drive a few months back. Recovered everything. Good, glad to hear. Works well with smaller data sets but the larger the data pool you have the longer it takes to back up and recover. Have heard some horror stories of customers with large amounts of data taking well over a week to recover their data from online. Also, if you have any data that is critical to you then I would suggest more than one back up medium.

3. Installed PatchMyPC - I like the idea and will give it a try for a while. So far very impressive.  Yes, we found it a few months ago too. So far no reported issues or concerns that I've seen.

4. I believe I have this set up correctly and have not noticed any problems with Windows not updating. Excellent

5. Great read. I might go back to Firefox, but I got away from it as some sites were not running well on it. Have to admit, the value of cookies currently outweighs the negatives for me, so I don't think I will be deleting them daily any time soon. Sad how much tracking all these browsers do. Fighting back helps some, but difficult to stop it completely and still have a decent experience on the computer.

6. Browser Guard is already installed (and it works very well). I added UBlock as well. Cool, glad you like it.

Really amazing stuff - definitely bookmarked #5 and have opened up the referenced material for further reading.

Thanks!

You're quite welcome.

Take care and have a great rest of your week. I'll go ahead and close your topic soon.

Cheers

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you