Exploit.T1003 credential access RTP Notification

[Carthus]

I received a RTP detection after starting up my PC. Notification says wmiprvse.exe was responsible. Is this a false positive? Scans come back clean

Malwarebytes Exploit Blocked Report 2024-10-02 011559.txt

[AdvancedSetup]

Hello @Carthus

Let's go ahead and scan your system and see what we can find

 

 

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:  Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:  Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[Carthus]

Will do, here are the requested logs

AdwCleaner[C04].txt Malwarebytes Scan Report 2024-10-03 003134.txt FRST.txt Addition.txt

[AdvancedSetup]

Please open Malwarebytes

Then click on Settings on the left, then on Protection

Click the Advanced settings 

Then click the Restore default setting button

 

That should stop the issue. Please do not make changes there unless you're experienced and know what and why to change

Thank you

 

 

[Carthus]

Got it. So my device is clean? Thank you for your help I appreciate it

[AdvancedSetup]

Correct. The logs do not show any signs of an infection.

 

[Carthus]

Excellent. Thanks again,have a good one

[AdvancedSetup]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks