Command Prompt (DotNet.exe) Autorun

[Cactus23828]

I wasn't sure where to post this, and I hope it's the right place. I've been getting a Command Prompt Window and a DotNet.exe error after starting up Windows. I believe this most likely happened after uninstalling a program that came bundled with another program, called DriverPack Solution, I suppose. I've spent countless days and hours to try and fix this issue, but to no avail. 

A similar topic I found on the forum, but it's not entirely resolved: https://forums.malwarebytes.com/topic/257447-driverpack-solution-drpsu-dotnetexe-autorun/

The Command Prompt Window seems to start from System32 (screenshots attached below). Note: the Timeout program with no icon in Task Manager sometimes does not appear there. 

FRST logs are also attached below. Any assistance to fix this issue would be much appreciated.

FRST.txt

Addition.txt

 

 

 

[Maurice Naggar]

Hello  

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

• Please attach  mbst-grab-results.zip    to your reply

[Cactus23828]

Hello, I've attached the log. I've restarted the laptop and ran the tool when the Command Prompt window appeared, as it might help removing it.

mbst-grab-results.zip

[Maurice Naggar]

Tell me: On or around 13 October did you do something on your system about a printer or printers or print provider ? or else, Install any sort of tweaker program? Kindly list for me, the most recent apps you may have installed in the past 2 or 3 weeks.

[Cactus23828]

No, I don't remember installing any program of that sort. I don't have a printer either, that's connected to this laptop.

From what I remember, I have installed these apps in the past 2-3 weeks:

- Paradox Launcher v2 (but then I removed it)

- Windows PE X86 X64

- Microsoft XNA Framework

- COMODO Antivirus (didn't mean to install it, uninstallation probably got glitched somehow, as it appears in FRST logs)

- DriverPack Solution (which I didn't mean to install at all, it came bundled with another program a while ago, but I didn't gave it much thought, until I uninstalled it and that issue happened)

Other than that, there isn't really anything else.

[Cactus23828]

Windows PE X86 X64 was actually maybe installed by another program, if I think of it now.

[Maurice Naggar]

"Driver Pack Solution" is the most likely to be a big source of your current problem. Never ever install any program or app or addition that you have not checked out thoroughly.
There are many help sites on Windows that you can get recommendtions about "apps". This Malwarebytes forum is one such venue.
Always select "custom install" when possible, during a install, so you might be able to see what else is bundled.

Torrenting & file-sharing. Try to not do that, as a general security matter. All it takes is one malicious file to lead to tragedy & loss.
https://informationsecuritybuzz.com/articles/torrenting-know-risks-take/

DON'T FALL FOR THE MONEY-SAVING LURE OF CRACKED SOFTWARE
https://scambusters.org/crackedsoftware.html

( Step 1 )
Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

Select View → Show → File name extensions

( Step 2 )
Perform a Clean Boot in Windows 11 to Troubleshoot Software Conflicts
https://www.elevenforum.com/t/perform-a-clean-boot-in-windows-11-to-troubleshoot-software-conflicts.2787/

( Step 3 )
Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.
 

[Cactus23828]

Thank you for all of that information. I've uninstalled any torrenting app, after that I did a Clean Boot. 

Here are the Adwcleaner logs. (That Command Prompt is still there)

AdwCleaner[C00].txt

AdwCleaner[S00].txt

[Maurice Naggar]

We now do a custom script run. The Adwcleaner is a good cleanup. This here will get rid of a scheduled task that triggers the "DriverEasy" junk pest. It will also do several checks of the system.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRSTENGLISH.exe  on the Downloads folder to run a custom script.    

This custom script is for  Cactus23828  machine  only / for this machine only.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

 Fixlist.txt   <<< - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRSTENGLISH.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

•    If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.
• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.  👈

PLEASE have patience when this starts. You will see a green progress bar start.  Please attach the Fixlog.txt report.   😉

NOTE: I have a concern that you had in recent past installed too many un-needed apps / add-ons. Additionaly, I have a concern that you tried too many antivirus apps on your own, without doing proper "cleanups" of each tool after uninstalling same. I saw traces of Avast , Comodo, and others.

[Cactus23828]

That took a long time. I've attached the log below.

1 hour ago, Maurice Naggar said:

NOTE: I have a concern that you had in recent past installed too many un-needed apps / add-ons. Additionaly, I have a concern that you tried too many antivirus apps on your own, without doing proper "cleanups" of each tool after uninstalling same. I saw traces of Avast , Comodo, and others.

And yes, I've learned my lesson. I'll never do that again 

Fixlog.txt

[Maurice Naggar]

2 other things + a question about overall situation.

( 1 )

Current DNS Servers: 192.168.0.1

Please consider changing your default DNS Server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

• Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
• Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
• OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
• DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

( 2 )

Then get & first SAVE & then run the AVASTCLEAR tool
Get, Save & Run the Avast clear tool.
https://support.avast.com/en-us/article/Uninstall-Antivirus-Utility/Save the tool first; then run it.
Then do a Windows RESTART  from the Start menu.
 

( 3 )

How is overall situation?

Is the rogue task "Dotnet"  ( Drivereasy) all gone now ?    👈

( 4 )

Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe

 

and save the tool on the desktop.

If Windows's  SmartScreen block that with a message-window, then
Click on the MORE INFO spot and over-ride that and allow it to proceed.

This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

[Cactus23828]

Just thought I would do these steps before I go to sleep. Attached the SecurityCheck log below. The DNS is now changed as well.

Also to answer (3), yes, it appears that Dotnet is not appearing at startup anymore. Thanks.

Have a good day.

SecurityCheck.txt

[Maurice Naggar]

Very well. Just one app needs attention to insure it has very latest release version 

Microsoft Edge v.106.0.1370.42   Warning! Download Update 

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

Edited October 17, 2022 by Maurice Naggar

[Cactus23828]

Downloaded the Edge update, and it appears I have the latest Windows Update.

[Maurice Naggar]

This here is for tools cleanup.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log may open in Notepad titled kprm-(date).txt.  I do not need it. Just close Notepad if it shows up.

Delete mb-support-1.8.7.918.exe
Delete mbst-grab-results.zip on the Desktop

I wish you well 😎

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you