Windows 10: Weird behavior, possible Trojan

Symptoms:
1. Volume icon appears with a red cross even though all sound devices are working.
2. With UAC set to default, a notification pops up at startup asking my permission to run explorer.exe
3. I can't run some programs.
4. Malwarebytes web protection suddenly disabled and can't be re-enabled. I'm using the latest one.
5. System restore fails all the time, so can't go that path either.

I suspect it is malware that targets/makes a fake explorer.exe, but not entirely convinced since there is only one instance and the CPU load is not constantly high. but I want to know if anyone has encountered this before and might point me int the right direction, like the name of the malware, perhaps.

Thanks, everyone!

:)

 

I Have Been Infected with Trojan and Anti-Virus Couldn't Remove it

Generic Trojan means based on behavior , they have been detected as Trojan but it is doesn't necessary means they are Trojan and harmful and it could be false positive.

Especially, the files names are belong to safe Windows files but there might be a possibility that there might be new malware pretend to be safe and take these names. If possible copy these files and place them in a zip file and submit them to Microsoft
Malware Protection Center:

Submit a file for malware analysis - Windows Defender Security Intelligence

There are many safe process in Windows with name svchost.exe , so having these processes doesn't mean your PC is necessary infected.

 

Weird Behavior.

jurgen73 wrote:



ActiveSync does not recognize phone even if windows says is ready to use.



Does this happen all the time?

 

Welcome to TenForums @frankmanguiob

Have you tried a scan with Malwarebyte Chameleon? If you are using 3, see:
Malwarebytes | Chameleon - Free Malware Removal Tool

There's also Defender Offline.
Windows Defender Offline Scan in Windows 10

 

frankmanguiob,

Welcome to TenForums!

You can give this tool a try to see what it finds...

Please use the Farbar Recovery Scan Tool Download
Save FRST to your Desktop.
[Note: You need to run the version compatible with your system: 32 bit or 64 bit]

Double-click FRST to run it.
When the tool opens click Yes to the disclaimer.
Next, press the Scan button.

When done, the tool makes a log (FRST.txt) on the Desktop.
Also, the first time the tool is run, it makes another log: (Addition.txt).

Please attach both reports in your reply.


Note: FYI, MBAM v3 has experienced problems lately.

 

@Bree

Thanks! Chameleon ran but it didn't detect anything. Defender offline doesn't work for some reason. I can't even view event logs.

 

Hi cottonball,

Thanks!

Please see the attached.

Cheers,
Frank

 

frankmanguiob,

My apology for the delay. *Redface Can't remember getting a notification of your reply.

Looked at the reports provided, and did not see malware.

You may want to run a System File Check on the OS:
SFC Command - Run in Windows 10

Use: Option Three

If you see: Windows Resource Protection found integrity violations

Then, please reboot, and run the sfc /scannow command again.

Sometimes it takes running the sfc /scannow command up to 3 times before all is fixed.

If no luck, and still looking at integrity violation, please use Option Five: To View Only the "SFC" Scan Results from the CBS.LOG

Next, attach the sfcdetails.txt in you reply for someone to look at.