RTP Detection - is any action required?

[fspriggs]

What's the best course of action to follow after real-time protection steps in?  I ran a full malwarebytes scan that returned nothing.  Thanks. 

[AdvancedSetup]

Hello @fspriggs

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

[fspriggs]

I sent them to you via direct message, I'm more comfortable doing it that way.  Thank you. 

[AdvancedSetup]

Hello @fspriggs

 

This IP was blocked on these dates:   65.21.181.164

"detectionDateTime": "2023-08-25T21:20:08Z",
"detectionDateTime": "2023-08-25T21:03:12Z",

It has since been removed from our list and is no longer blocked.

 

Please click on the small gear icon and on the General tab click to check for updates.

Then scan the computer with a normal Threat Scan and post back the results. I expect it will be clean.

 

Then go ahead and run the following for me.

 

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

• Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• If Microsoft SmartScreen blocks the download, click through to save the file
• This tool is safe.   Smartscreen is overly sensitive.
• If SmartScreen blocks the file from running click on More info and Run anyway
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

 

Thank you

 

 

[fspriggs]

I sent them to you.  What about the RTP detections that occurred today and yesterday?  

[AdvancedSetup]

There are no detections shown for today in the logs you supplied. Only these two

[AdvancedSetup]

That is an MWAC block. Let me check that one

 

[AdvancedSetup]

That one is odd as the CMD.exe should have triggered the main program logging normally.

Let me have you run the following and see what it can find.

 

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 

Select the     Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed...   Thank you

 

 

[fspriggs]

Nothing was found and the report folder is empty.

 

[AdvancedSetup]

Thank you for the screenshot about the program.

Let's try one more scanner from Microsoft

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

Thank you

 

[fspriggs]

There was nothing in the scan.  There were also some additional blocks this morning when the computer came online from sleep.

Screenshots below.  I will send you the log. 

 

 

[AdvancedSetup]

Please post the Protection Logs from today

 

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

 

[fspriggs]

I just sent them.  Thanks for your help. 

[Maurice Naggar]

Hello @fspriggs Tell me, have the "Exploit" messages ceased ? Are there any "Exploit" notices today?

Tell me, does your system have a Brother printer, or a Epson printer ?

[Maurice Naggar]

I would like a report set for review. This is a report only.

Please download MALWAREBYTES MBST Support Tool
Be sure it is SAVEd.

Do a RIGHT-click on mb-support-1.9.2.9nn,exe & select "Run as administrator" and reply YES and ALLOW it to proceed.

click Advanced >>> then Gather Logs

Have patience till the run has finished. It may take several minutes to fully generate the report.
Attach the mbst-grab-results.zip from the Desktop to your reply..

[fspriggs]

Hi @Maurice Naggar - I ran the MBST support tool and a variety of scanners with the help of @AdvancedSetup, when this post began.  They didn't find anything.  

The RTP is still occurring, usually after the computer awakes from sleep.

Yes, I do have a Brother printer that I've used with this computer for a few years now.  How does that potentially clash with the Malwarebytes software? 

Thank you for your reply!    

[Maurice Naggar]

Hello. I suggest you Uninstall 

Brother PowerEnage

See my posts on this other Topic  The others on this thread had same issues you described. 

[AdvancedSetup]

Hello @fspriggs

 

How are things going? Do you still need further assistance or should we go ahead and close the topic at this time?

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks