RTP Detection Outbound Connection From Explorer.exe

[SiddharthaLahiri]

Hi, Malwarebytes flagged an RTP DETECTION Outbound Connection from C:\Windows\SysWOW64\explorer.exe.

Before this I saw activity on my steam account relating to steam community purchases that I didn't make. My account itself doesn't seem to be compromised so my only guess was someone has remote access of my laptop where steam is running. Thus I installed Malwarebytes to do a full scan. The first scan flagged quite a few malwares and Trojans that were installed onto my system32 folder on c drive so I quarantined and deleted them. Now I keep getting this flag everytime I connect my laptop to the internet.

Can anyone help me and tell me what to do? Currently running a custom scan on c drive with the toolkit detection on and no internet access to my laptop. 

[Porthos]

10 minutes ago, SiddharthaLahiri said:

Currently running a custom scan on c drive with the toolkit detection on and no internet access to my laptop. 

When running scans, by not having internet access you are disabling the cloud detections.

 

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

Edited April 26 by Porthos

[SiddharthaLahiri]

I ran adwcleaner everything seems clean except a Tencent file...I quarantined and deleted it.

AdwCleaner[C00].txt

 

also here's the log file for the flag i keep getting. it happens every 2 minutes with internet access on.

Malwarebytes Website Blocked Report 2024-04-26 033101.txt

 

[SiddharthaLahiri]

The malwarebyte scan is complete and it flagged a file in my onedrive directory as malware. 

[SiddharthaLahiri]

10 minutes ago, SiddharthaLahiri said:

The malwarebyte scan is complete and it flagged a file in my onedrive directory as malware. 

here's the log file.

Malwarebytes Scan Report 2024-04-26 013700.txt

 

[SiddharthaLahiri]

i restarted my pc and the used the Farbar recovery scan tool. Here's the log file.

FRST.txt

[AdvancedSetup]

Hello @SiddharthaLahiri

Please run the following

 

Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop.

(Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021)

Download: Kaspersky Virus Removal Tool

https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe

How to run a scan with Kaspersky Virus Removal Tool 2020
https://support.kaspersky.com/15674

How to run Kaspersky Virus Removal Tool 2020 in the advanced mode
https://support.kaspersky.com/15680

How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan
https://support.kaspersky.com/15681

 

Select the     Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt   Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box.   That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed...   Thank you

 

 

[SiddharthaLahiri]

I did the scan with and it didn't find any threats...is there anything else I should do?

report_2024.04.26_12.12.35.klr.txt

[AdvancedSetup]

Are you still getting a block alert from Malwarebytes or Windows Defender?

 

Please get me new, fresh updated logs

 

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

 

Scan with FSS Farbar Service Scanner
https://forums.malwarebytes.com/topic/306736-scan-with-fss-farbar-service-scanner/

 

 

Scan with Farbar Recovery Scan Tool
https://forums.malwarebytes.com/topic/306601-scan-with-farbar-recovery-scan-tool/

 

[SiddharthaLahiri]

hi thank you so much for all the help and support so far!! I am no longer getting any block alerts after restarting my system as previously mentioned.

here's the security check logSecurityCheck.txt

here's the fss service scanner log FSS.txt

here's the recovery scan logs Addition.txtFRST.txt

 

[AdvancedSetup]

Please make the following change in Malwarebytes if you're using the Premium or Trial version

• Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the General tab.
• Then turn off "Always register Malwarebytes in the Windows Security Center"
• Restart the computer

It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article and setup exclusions
between Malwarebytes and Windows Defender

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

 

 

 

 

Next, Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRST64.exe

Save the attached file:  FIXLIST.TXT to this folder D:\downloads\programs\

NOTE. It's important that both files, FRST64.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[AdvancedSetup]

After you have completed the FIXLIST above, please do the following

Please uninstall, update, or otherwise address the following as appropriate for your computer.

• 7-Zip 21.01 alpha (x64) v.21.01 alpha Warning! Download Update | Uninstall old version and install new one.
• Discord v.1.0.9008 Warning! Download Update
• HandBrake 1.5.1 v.1.5.1 Warning! Download Update
• Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
• Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 v.14.36.32532.0 Warning! Download Update
• NVIDIA GeForce Experience 3.27.0.120 v.3.27.0.120 Warning! Download Update
• ProtonVPN v.1.18.5 Warning! Download Update
• Telegram Desktop v.4.9.9 Warning! Download Update
• WinRAR 6.02 (64-bit) v.6.02.0 Warning! Download Update
• Zoom v.5.17.11 (34827) Warning! Download Update

Then RESTART the computer and check for Windows Updates and install any found

 

[SiddharthaLahiri]

hi, I ran the farbar program fix and restarted my system,

here's the log

Fixlog.txt

currently installing the updates mentioned.

[AdvancedSetup]

Great, the FIX log looks good. It also found and fixed some other Windows issues.

Once you're done updating Windows and Application restart the computer again and let me know if there are still any signs of infection or any other unresolved issues

Thanks