Weird behavior, possible Trojan

frankmanguiob · 08 Feb 2017

Symptoms:
1. Volume icon appears with a red cross even though all sound devices are working.
2. With UAC set to default, a notification pops up at startup asking my permission to run explorer.exe
3. I can't run some programs.
4. Malwarebytes web protection suddenly disabled and can't be re-enabled. I'm using the latest one.
5. System restore fails all the time, so can't go that path either.

I suspect it is malware that targets/makes a fake explorer.exe, but not entirely convinced since there is only one instance and the CPU load is not constantly high. but I want to know if anyone has encountered this before and might point me int the right direction, like the name of the malware, perhaps.

Thanks, everyone!

Bree · 08 Feb 2017

frankmanguiob said:

4. Malwarebytes web protection suddenly disabled and can't be re-enabled. I'm using the latest one.

Welcome to TenForums @frankmanguiob

Have you tried a scan with Malwarebyte Chameleon? If you are using 3, see:
Malwarebytes | Chameleon - Free Malware Removal Tool

There's also Defender Offline.
Windows Defender Offline Scan in Windows 10

cottonball · 08 Feb 2017

frankmanguiob,

Welcome to TenForums!

You can give this tool a try to see what it finds...

Please use the Farbar Recovery Scan Tool Download
Save FRST to your Desktop.
[Note: You need to run the version compatible with your system: 32 bit or 64 bit]

Double-click FRST to run it.
When the tool opens click Yes to the disclaimer.
Next, press the Scan button.

When done, the tool makes a log (FRST.txt) on the Desktop.
Also, the first time the tool is run, it makes another log: (Addition.txt).

Please attach both reports in your reply.

Note: FYI, MBAM v3 has experienced problems lately.

frankmanguiob · 09 Feb 2017

@Bree

Thanks! Chameleon ran but it didn't detect anything. Defender offline doesn't work for some reason. I can't even view event logs.

frankmanguiob · 09 Feb 2017

-duplicate-

frankmanguiob · 09 Feb 2017

-duplicate-

frankmanguiob · 09 Feb 2017

Hi cottonball,

Thanks!

Please see the attached.

Cheers,
Frank

cottonball · 11 Feb 2017

frankmanguiob,

My apology for the delay.

Can't remember getting a notification of your reply.

Looked at the reports provided, and did not see malware.

You may want to run a System File Check on the OS:
SFC Command - Run in Windows 10

Use: Option Three

If you see: Windows Resource Protection found integrity violations

Then, please reboot, and run the sfc /scannow command again.

Sometimes it takes running the sfc /scannow command up to 3 times before all is fixed.

If no luck, and still looking at integrity violation, please use Option Five: To View Only the "SFC" Scan Results from the CBS.LOG

Next, attach the sfcdetails.txt in you reply for someone to look at.