About PSEXESVC.exe - App/PsExec-Gen

[LodeHere]

Hi,
my Hitman Pro (Free) detected PSEXESVC.exe - App/PsExec-Gen
It doesn't say it's bad, but offers to remove it, but only after I renew my license. (Which I had years ago before Malwarebytes.) Paying for a new license just to have one removal I would like to avoid.

It looks like I don't need it, so I wouldn't mind having it removed. Could Malwarebytes have a look into it?

"What is App/PsExec-Gen"
 

https://www.startpage.com/do/dsearch?query=what+is+App%2FPsExec-Gen&language=english&cat=web&pl=ext-ff&extVersion=1.1.7

 

Edited August 14, 2023 by AdvancedSetup
Disable Hyperlink

[Porthos]

Info on PsExec.

This tool is for the remote execution of programs. It is not malicious in itself but can be misused/used by other malware (worms, backdoor Trojans) to gain access to your PC.

[LodeHere]

Thank you for your kind response with helpful information.

As said, I would like to remove it. But don't know how...

[Porthos]

7 minutes ago, LodeHere said:

It looks like I don't need it, so I wouldn't mind having it removed.

We can assist you in removing it if you like. If you did not download the systernals software then it should be removed.

Please do the following so that we may take a closer look at your system.

Please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply
  
   

Thank you

[LodeHere]

Thank you very much.

I've copy/pasted the instructions in a new document.

Have desktop icons disabled. I like just one or another beautiful picture there. All i need is in the tool -tray- bar, and the rest on my Start Menu. But sure I can save the results elsewhere and post them here as an attachment.

[LodeHere]

I had to turn desktop icons back on. Surprisingly easy.

Hope this is what you meant:

mbst-check-results.txt

Edited August 14, 2023 by LodeHere

[AdvancedSetup]

Hello @LodeHere

We need the Zip file it creates, please

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

[LodeHere]

This time it worked, it looks like.

Thank you for offering to look into it.

mbst-grab-results.zip

[AdvancedSetup]

Please do the following steps @LodeHere

[ 0 ]

Before we proceed, please create a NEW System Restore Point

How to Create Restore Point in Windows 8/8.1
https://www.isunshare.com/windows-8/create-restore-point-in-windows-8-8.1.html

 

[ 1 ]

Please go to Control Panel, Programs, Programs and Features, Uninstall a program

Then right-click and uninstall the following

• CCleaner (computer experts no longer recommend this program)

 

[ 2 ]

The logs show that you have Emsisoft Anti-Malware running, but the Installer listing does not show. Please reinstall Emsisoft Anti-Malware and then restart the computer.

Then go back into Control Panel and uninstall Emsisoft Anti-Malware

Then restart the computer again

(if you want to have and keep Emsisoft Anti-Malware you can reinstall once we're done)

 

[ 3 ]

Please make the following change in Malwarebytes if you're using the Premium or Trial version

• Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the Security tab.
• Then turn off "Always register Malwarebytes in the Windows Security Center"
• Restart the computer

It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article.

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

We are not aware of any currently known issues between Windows Defender and Malwarebytes Premium

 

[ 4 ]

Are you sure you want this enabled or allowed? Push Notifications on your browser appear to be enabled. Even trusted sources can sometimes push out unwanted alerts

FF Notifications: librewolf\Profiles\gje33v9p.default-default -> hxxps://www.rt.com; hxxps://www.lampen24.nl; hxxps://www.youtube.com; hxxps://mijn.ing.nl

https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

Turn notifications on or off - Google Chrome

Web Push notifications in Firefox

 

[ 5 ]

I would recommend that you update Windows PowerShell on your system.

Please visit the following link. Download and run the installer and restart the computer.

 

Windows Management Framework 5.1 includes updates to Windows PowerShell
https://www.microsoft.com/en-us/download/details.aspx?id=54616

 

[ 6 ]

WARNING: You need to complete STEP 5 or this step will not run correctly

 

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\GodKnows\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Edited August 15, 2023 by AdvancedSetup
Updated information

[LodeHere]

Thank you very much.

For some time now my restoring directly from a restore point has not worked, but It works with my external drive with a Back-Up on it. So I'll make a new Back-Up first.

I have not used Emsisoft for years now. Was not even aware of it still being there. It's not active as far as I know. Strange.

I'll check it all out and will follow your instructions. Back later.

[LodeHere]

I want to thank you for the work you did helping me, but it looks like my laptop makes it impossible to apply your instructions on it.

As I said, I don't need PsExec but it is also not bothering me. And it is not even malware...  now I feel sorry for having even brought it up here. My apologies.

This is what happened:

Making restore points seems to work, but using them to restore only when I plug in my external drive, which I utilize for storing system images. So I make system images now and then.

Emsisoft Anti-Malware only works on minimum Widows 10 now, a message said when I tried to install it.
But then I utilized their free removal tool, checking all the boxes for complete removal, and the message appeared after using it that Emisoft Anti-Malware was completely removed.

Lately my Windows Defender could not complete updates. So I had it already turned off. (All boxes checked.)
I trust Malwarebytes. So no problem.

CCleaner was hacked in the past, but it finds and  cleans usually a lot of trackers after closing my browser. So I prefer to keep it.

Was not aware of Push Notifications. But I never see notifications. Maybe because of uBlock Origin and/or AdGuard.

I got this laptop EliteBook 850G1 in 2013, and it still does everything I want. Surfing the Internet, watching videos and life news, writing documents, emails, Skype. Never a problem.

Thank you very much again. Also for teaching me not to be so nitpicky, but to be glad things work fine for what I like to do on my laptop.

Lode

Edited August 19, 2023 by LodeHere

[AdvancedSetup]

Okay then. If you're satisfied. I'll go ahead and finish up here and close your topic here @LodeHere

Have a great weekend

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.

 

 

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you