Microsoft Defender Reports Threats Detected

[Huskypsyd]

I believe I got rid of all of the problem files, but Microsoft Defender shows two threats, and when I tell it to delete or quarantine the threats, nothing happens. I have reinstalled Windows 11 (keeping my programs). Malwarebytes, ESET, and Hitman Pro all come back clean.

Malwarebytes Advanced Log.txt Malwarebytes Log.txt Addition.txt FRST.txt

[Maurice Naggar]

Hello  

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

Select View → Show → File name extensions

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

[Huskypsyd]

 Malwarebytes Adwcleaner log attached.

AdwCleaner[S03].txt

[Maurice Naggar]

Thanks. I would like you to clear ( empty) all CACHE on Chrome browser & then any other brand browser like EDGE & any other.

As to Chrome, insure it is the latest release from Chrome
https://support.google.com/chrome/answer/95414?
On some periodic basis, suggest to delete all Cache content on Chrome for "all time" period. That will help keep Chrome running more snappy.
open Chrome.
At the top right, click More .
Click More tools and then Clear browsing data.
Choose the time range All time.
Select the types of information that you want to remove.
Click Clear data.

By the way, the same principle applies to the Edge browser in Windows 11 / 10. Clearing all cache helps.

The section for EDGE browser how-to https://forums.malwarebytes.com/topic/286888-few-malwares-were-failed-to-removed/?do=findComment&comment=1517006

( 2 )

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted items from a system. This tool does not install. It is run on-demand.

This link is for the 64-bit version of MSERT.exe . Be sure you save the file first
https://definitionupdates.microsoft.com/download/DefinitionUpdates/safetyscanner/amd64/MSERT.exe

Upon completion of the save, Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well

Launch MSERT.exe
Accept the agreement terms of Microsoft
Select CUSTOM scan
Look on Scan Options & select CUSTOM scan & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on screen display. The only things that count are the End result at the end of the run.
Again, any on-screen display about repeat 'infection' is not to be relied on. Ignore those.
We only rely on the end result that is on the log-report-file.

This is likely to run for many hours ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log

the log will be at

Windows\debug\msert.log
Please attach that log with your reply

It is normal for the Microsoft Safety Scanner to show 'detections' during the scan process on the screen itself.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

[Huskypsyd]

MSERT Log Attached. 

msert.log

[Maurice Naggar]

The MS Safety Scanner reports no threat.

Results Summary:
---
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Sat May 13 17:31:55 2023

[  Do a custom scan with Microsoft Defender Antivirus ]

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select CUSTOM scan & then pick the C drive  & have it go forward.

Once it has started the scan phase, you can go take a long break.   Let me know the results.

[Huskypsyd]

See attached photo. When I click the "start options," nothing happens. 

[Maurice Naggar]

Please have lots of patience.

Please run the following custom script. Read all of this before you start. Please Close all open work.

FRST64.exe is already on this machine

Please download the attached fixlist.txt file and save it to Downloads folder

Fixlist.txt <-- - - - -

NOTE. It's important that both files, FRST64, and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Use File Explorer to go to the Downloads folder

RIGHT-Click on   FRST64 and select

RUN as Administrator

and reply YES to allow it to go forward to start.

That is important so that this run has Elevated Administrator rights !!

NEXT press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will also run scans with MS Defender antivirus. Depending on the speed of your computer this fix may take 50-55 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera + Brave caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

[Huskypsyd]

Fixlog attached.

Fixlog.txt

[Maurice Naggar]

Thanks. The run is very good. Microsoft Defender is in good shape. 

[  Do a Quick scan with Microsoft Defender Antivirus ]

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select QUICK scan & have it go forward.

Let me know the results.

[Huskypsyd]

The quick scan was clean. 

[Maurice Naggar]

That is fine. 

Temporarily disable Microsoft SmartScreen to download the next software below 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

When all done, you may go back to turn ON the EDGE Smartscreen protection.

[Huskypsyd]

attached

SecurityCheck.txt

[Huskypsyd]

Scanned again after restart. File attached. 

SecurityCheck_after restart_.txt

[AdvancedSetup]

@Maurice Naggar has probably gone to bed by now. I'm sure he'll be back with you again some time tomorrow @Huskypsyd

Thanks

 

[Huskypsyd]

That makes sense, no worries. Thanks!

[Maurice Naggar]

Hi. Thanks for the reports. Because Windows Update had had a restriction ( before the custom Fix script run) I would suggest you do a Check for Updates on Windows. Insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

As to the program Hitmanpro, if you did not purchase a license, and if you are done with it, Uninstall it. Because it is listed as running, by uninstalling it ( and Restarting Windows) it will lighten the work load on the machine.

These are what need attention, per the SecurityCheck.
See if you really need 3 different versions of Python ! By the way, Python is not normally on a consumer-home system. It is only seen if a user happens to have added some special application. If you know of no such need, then just Uninstall each of these versions of Python.

Python 3.11.2 (64-bit) v.3.11.2150.0  Warning! Download Update
Microsoft Visual Studio Code (User) v.1.77.0   Warning! Download Update

Python 3.11.2 (32-bit) v.3.11.2150.0  Warning! UNinstall

Python 2.7.18 v.2.7.18150  Warning! Uninstall

Driver Easy 5.8.0 v.5.8.0 Warning! . Computer experts no longer recommend this program.

Bonjour v.3.1.0.1  Warning! Uninstall Bonjour. The pc does not need it.

IObit Uninstaller 12 v.12.4.0.7 Warning! Suggest you uninstall.

We can wrap up this case.
Let's go ahead and do some clean-up work and remove the tools and logs we've run.
Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• You may attach that file to your next reply. (not compulsory)

[Huskypsyd]

Attached

kprm-20230516123606.txt

[Maurice Naggar]

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

I am marking this case for closure.
I wish you all the best. Stay safe.
Sincerely.

Maurice

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you