Build 14371 and 14372 Anomoly .b8527aa

COMPUTIAC said:

OK, was it more than just this ?

Build 14371 and 14372 Anomoly .b8527aa - Page 2 - Windows 10 Forums

Methinks this nasty was enough!

Rootkit.Fileless.MTGen, C:\Users\nlrai\AppData\Local\6d52e7\5e805e.bat, , [58cfdd24861477bf89c8fd9d798b7a86],

Note that it has a batch file included! Not that I know all that much, but it met its match with Simrick! :)

I had printed some coupons, but hadn't installed any coupon printers.

I also installed PDF Xchange from Tracker Software.

Simrick thinks one or the other carried in the virus. However, I'm not too suspicious of PDF Xchange because y'all discussed it in that "useless" thread. :)

COMPUTIAC said:

PDF Xchange did cause an unexplained problem with my 'puter. I had to remove it to stop the problem.

Oh, my! What was it doing?

COMPUTIAC said:

It was causing this in Reliability Monitor every morning I started the 'puter.
Below is the first day I installed it and had 844 event's, all the same.



It did the same thing four days in a row. Then I removed it and reinstalled it.

The next morning it did this again.



No one could replicate it on their 'puter's at all and I'm not saying it will do anything to yours
but be aware of what it did do to mine.

Y'know, since you had that, maybe you should run Malwarebytes too.

Simrick and I didn't think my problem was a rootkit, but that's what it turned out to be. And! Windows Defender didn't find it!

COMPUTIAC said:

I do run Malwarebytes and Superantispyware I have the scheduled to scan every Sunday morning.
I don't have much confidence in Defender at all.

OK, then I'd guess we can rule out PDF-Xchange as the culprit. Which means it's the coupon thing that I absolutely know I didn't install on my computer.

Not gonna click on any more "Print Coupon" buttons either!

Wynona said:

OK, then I'd guess we can rule out PDF-Xchange as the culprit. Which means it's the coupon thing that I absolutely know I didn't install on my computer.

Not gonna click on any more "Print Coupon" buttons either!

Wynona, I don't know what to say. We may never know the method of infection. For all we know it could have been a compromised web site. Hard to say with a file-less rootkit, because they delete their files after they attack, and just sit in the registry.

Since the second MBAM scan came up clean, I guess you can mark this thread as solved. :)