Windows 10: Virus Found in the Unistore Temp Directory by F-Secure

All,

I am running a Windows 10 Operating System and I use F-Secure as my Anti-Virus.

I'm constantly getting popup alerts of virus removal.

The location is C:\Users\Myuser\AppData\Local\Comms\Unistore\Data\Temp

I will also say, I am no where near an Admin Account on this computer.

My question is that I am actively monitoring this Directory and I am seeing temp files being added and removed. Below are a couple of the file names.

Templedse0160f00000000031000.dat
Templedse0160f00000000038103.dat

Can someone explain what these are for, and why is this directory adding and removing in real time.

:)

 

Windows 10 Pro - Unistack / Unistore - High Data / CPU Usage

Hi All,

You are right in that this is the temp mail folder, if you receive an an email that contains a virus this directory will go "skitzoid". In no time flat it will be full of logs and if you look at the content of the log files it is taking key narrative for
later recovery. I found the virus JS/Locky.D!Eldorado was causing me issues. I ran system mechanic and emptied the relevant directory and all returned to normal.

 

Vodafone firmware update failed

Just found a list of virus that affect mobiles on the F-Secure site

http://mobile.f-secure.com/news/index.html

 

Your best bet is to upload all the files in that folder to virustotal.com and let it scan them. It uses 50+ different antivirus programs, so you'll definitely find out if it's a legitimate threat or a false positive.

 

I just checked the directory and there are no files in that folder now. So I can't scan them.

I will keep that link in mind though.

Thank you.

 

ulricken,

Are you running any backup software or use the Mail app?

 

It's possible that Windows may be hiding the files in that folder. Open File Explorer, click on View at the top, click on Options, click on Change Folder and Search Options, click on View, jncheck Hide Protected Operating System Files, click Apply and OK. Reopen that folder you mentioned and if anythings there upload it to VirusTotal. Otherwise go back and recheck the Hide Protected Operating System Files, Apply and OK when your done.

 

From what I can find, it apears the Windows 10 local mail files for the Mail app are stored here:

C:\Users\<username>\AppData\Local\Comms\Unistore\Data\Temp

The Comms\Unistore subdirectories in AppData are used for Windows apps.

Also found F-Secure, and other AV programs are tagging this as a false positive.

 

Well then, if that's the case I'd use a different companies Antivirus. Try Bitdefender or Kaspersky. If they say it's a threat it is. Rescan them and make a list of which Antivirus programs said it was a threat and post it in this thread.

 

You can also download and run Adwcleaner, Junkware Removal Tool and ZHPCleaner. Run those 3 in that order, let each remove what it finds and restart your pc after each one is run.

 

Best thing is to use VirusTotal. There are quite a few scanning engines used there.

Navigate to the files, one at a time, double click on it so the file name is populated, then click: Scan it!

IMPORTANT! If the file is listed as already analyzed, click on: Reanalyse file now

Once completed, highlight the the address bar, and provide the link in your reply.

@ulricken, are you still with us?