Powershell Detection

[SmokeRulz]

Hey there. As of yesterday, I'm now having Malwarebytes blocking an export that's supposedly from Windows Powershell, both times happening shortly after I turn on my computer. Scans from MWB and Windows Security are showing up nothing. I've seen that there's year-old topics here on the forum where this happened to people, and it's hard to tell whether it's a false positive or actual malware, though it seems to be malware in most cases.

I've attached the two log reports from MWB when the blocks happened, although they're nearly identical.

9-8.txt 9-9.txt

[Maurice Naggar]

Hello. @SmokeRulz My name is Maurice. I will guide you. 

Take actions to have Windows show all folders, plus Turn Off Windows Fast start option.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

[SmokeRulz]

Done with both.

[Maurice Naggar]

That exploit message may just be a false positive. But we need to see lots of detail.

I would like a report set for review. This is a report only.
Please download MALWAREBYTES MBST Support Tool
Right-click click on the exe and select Run as Administrator & reply YES & allow to proceed. Next click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

[SmokeRulz]

Done, here's the ZIP.

mbst-grab-results.zip

[Maurice Naggar]

I'm not seeing a obvious indicator of a malware threat.

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

[SmokeRulz]

Done. Didn't detect anything.

AdwCleaner[S00].txt

[Maurice Naggar]

The Adwcleaner report is fine. 

One other scan here.

TrendMicro HouseCall scan
from this Link

First, Download & Save to your Downloads folder the appropriate HouseCallLauncher
Once the download is complete, go to where the Housecalllauncher is saved & double-click it to start it.

The program will check with TrendMicro & do a update run.

Next it will show the Disclosure window.

Click Next to proceed.

The end user license agreement is presented.   Click the Accept radio button & click Next to proceed.

I suggest a CUSTOM scan on C drive.

IF you wish a Full scan or a Custom scan, first click on the Settings

then you can select which drives you want to include in the scan.

The default is a Quick scan.

Click Scan now when ready.

The scan progress will then be displayed.   Monitor the progress or just leave it alone until it finishes this phase.

When the scan phase has completed, if any items are tagged, you will see a list, showing  the file & its location, the classification of the threat, the type, risk, and Action option.

If you see an item that you know is safe, you can click the Action  , and select Ignore.

When all done & ready, click the Fix now button.
The "Summary" at the end at "Review Results" is what matters.

[SmokeRulz]

Alright! That took HOURS to scan, but it finished. It found 1 threat, but it was just a JPG file of some artwork, so it was a false positive. Nothing else was found.

[Maurice Naggar]

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

Farbar  FRSTENGLISH program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[SmokeRulz]

Done.

Also worth noting that MWB hasn't had a Powershell block popup on my last few restarts. Is it maybe because disabled Fast Startup? My computer seems to be starting up just as fast as before, so I fail to see what that setting was even doing while on, ha.

Fixlog.txt

[Maurice Naggar]

Windows' Fast start is alright....as long as your machine does not get into a pesky situation, or an involved one like this here. Fast start can interfere with cleanup attempts. I am very glad to hear that there has not been a repeat "Block" event. 

The custom-run is good. The Windows System File Checker has made some corrections.

Windows Resource Protection found corrupt files and successfully repaired them.

This last run has completed what was originally intended. 

Please at this point, do a new scan with Malwarebytes. Advise me on the result.

[SmokeRulz]

Finally done. I did a full file system scan and it took 9 hours to get done.

It found 1 temporary file on my D drive that it deemed malicious and I've now quarantined. Presumably it can be safely deleted?

[Maurice Naggar]

YES, any .tmp or .temp file is fair game for deletion.

[SmokeRulz]

Alrighty, it's gone. No other issues were found.

[Maurice Naggar]

If you yourself "tweaked" or "amped up" on your own any Application Behavior Protection setting within Malwarebytes....let me know. In the SECURITY tab of Malwarebytes, we need "Brute force protection" to be OFF.

Can you check if the "Penetration testing" toggle in the UI is ON ? If it is ON, please turn it OFF and Hit Apply

You can find it by going to Security->Exploit Protection->Advanced settings.  Press Restore Defaults. Press Apply button.

[SmokeRulz]

Both of those settings are indeed off. I've never touched any of the advanced settings in MWB. The most I've done is set up a nightly scan in the scheduler.

[Maurice Naggar]

Alright. Thank you. We have already done some other scans. Now 1 adjustment & 1 new scan.

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

[ 2   Do a custom scan with Microsoft Defender Antivirus ]

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select CUSTOM scan & then pick the C drive  & have it go forward.

Once it has started the scan phase, you can go take a long break.   Let me know the results.

[SmokeRulz]

Finally home from work. I checked and everything was a-ok and I ran the custom scan in Windows Security. It found one questionable thing: PiriformBundler bloatware from when I used to use CCleaner many many years ago. After looking into it I had it wiped from the computer.

[Maurice Naggar]

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will remove 2 unnecessary scheduled tasks. This run will be extra quick.

Please Close all open work before you actually do begin this run.

Farbar  FRSTENGLISH program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt<- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[SmokeRulz]

Done.

Fixlog.txt

[Maurice Naggar]

Thanks. Very good. Hoping there will be no further repeat of the exploit message/notice about 

Exploit.PayloadProcessBlock

Do keep your eyes open over the next 24, 36, 48 hours. 😄

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you