Which app's process is this

[pchelp]

https://imgur.com/a/HR9AjlV

[Levent]

That screenshot gives nothing of value. Why does that even matter anyways? Run malwarebytes if you are thinking you got compromised with viruses.

[podkall]

can you find it in Task Manager? the fact that it uses less than 1MB makes it much less concerning

[pchelp]

15 minutes ago, Levent said:

That screenshot gives nothing of value. Why does that even matter anyways? Run malwarebytes if you are thinking you got compromised with viruses.

Malwarebytes, KVRT, Windows defender found nothing. All is well then?

Different question, scanning a pc with anti virus's, does it lead to more writes for a ssd?

[pchelp]

12 minutes ago, podkall said:

can you find it in Task Manager? the fact that it uses less than 1MB makes it much less concerning

No can't find it in the task manager. Is there a way to find what that is actually?

[Levent]

2 minutes ago, pchelp said:

Malwarebytes, KVRT, Windows defender found nothing. All is well then?

Different question, scanning a pc with anti virus's, does it lead to more writes for a ssd?

If you read a book, does that mean you wrote on it? 
 

No.

 

If the results are clear in three different AVs, one would assume they are good.

[pchelp]

6 minutes ago, Levent said:

If you read a book, does that mean you wrote on it? 

I didn't get the context of this.

Different question, scanning a pc with anti virus's, does it lead to more writes for a ssd?

[Kilrah]

No.

 

Search for that file name and you'll see where it is, folder might tell you what it belongs to.

[podkall]

2 hours ago, pchelp said:

I didn't get the context of this.

Different question, scanning a pc with anti virus's, does it lead to more writes for a ssd?

no, scanning is reading, just like you scan the book with your eyes when you read it

[pchelp]

@podkall @Levent @Kilrah

Update-

Malwarebytes found these today

Registry Value: 2
PUM.Optional.DisableMRT, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,
PUM.Optional.DisableMRT, HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,

https://www.malwarebytes.com/blog/detections/pum-optional

What exactly do you think are these? I have very limited softwares installed in this pc and that too related to work. Though I have installed O&Oshutpup 10, wpd10 and privatezilla to reduce telemetry and what not 6 months back. Can these be the issue? The pc works fine btw.

[podkall]

1 hour ago, pchelp said:

@podkall @Levent @Kilrah

Update-

Malwarebytes found these today

Registry Value: 2
PUM.Optional.DisableMRT, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,
PUM.Optional.DisableMRT, HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,

https://www.malwarebytes.com/blog/detections/pum-optional

What exactly do you think are these? I have very limited softwares installed in this pc and that too related to work. Though I have installed O&Oshutpup 10, wpd10 and privatezilla to reduce telemetry and what not 6 months back. Can these be the issue? The pc works fine btw.

quotes must be orange to work like this @podkall after you start typing someone's nick the selection should appear,

 

it's possible these are malwares, are are some of these paths familiar to any programs you use? because whatever Malwarebytes finds as malware it wants to remove, but of course only if you tell it to remove those files.

 

PUM translates to "potential unwanted modification" so it's possible it's one of those programs' fingerprints

 

I'm only quoting @Kilrah and @Levent because you intended to quote them an hour ago, maybe they have some more input on this, but I'm just assuming

[pchelp]

On 5/28/2024 at 7:49 PM, podkall said:

quotes must be orange to work like this @podkall after you start typing someone's nick the selection should appear,

 

it's possible these are malwares, are are some of these paths familiar to any programs you use? because whatever Malwarebytes finds as malware it wants to remove, but of course only if you tell it to remove those files.

 

PUM translates to "potential unwanted modification" so it's possible it's one of those programs' fingerprints

 

I'm only quoting @Kilrah and @Levent because you intended to quote them an hour ago, maybe they have some more input on this, but I'm just assuming

Thanks for replying and for correcting me. These two malwares are now in quarantine. How can i find their path? MalwareBytes just shows this

Registry Value: 2
PUM.Optional.DisableMRT, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,
PUM.Optional.DisableMRT, HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,

[podkall]

2 hours ago, pchelp said:

Thanks for replying and for correcting me. These two malwares are now in quarantine. How can i find their path? MalwareBytes just shows this

Registry Value: 2
PUM.Optional.DisableMRT, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,
PUM.Optional.DisableMRT, HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, No Action By User, 7430, 676881, 1.0.85157, , ame, , ,

mrt is apparently microsoft's malicious software removal tool, not sure if the problem is that it's disabled, you can remove it if you have no software that could potentially disable that feature, it's possiblet he anti-spying software disables mrt to make anti-spy changes,

 

if the software doesn't need to be running or doing something on startup, it's fine to just remove this scanned threat

[pchelp]

On 5/30/2024 at 11:07 AM, podkall said:

mrt is apparently microsoft's malicious software removal tool, not sure if the problem is that it's disabled, you can remove it if you have no software that could potentially disable that feature, it's possiblet he anti-spying software disables mrt to make anti-spy changes,

 

if the software doesn't need to be running or doing something on startup, it's fine to just remove this scanned threat

I did not disable mrt or anything but I am using O&O, WPD and Privatezilla. Can these cause issues like this?

Found more processes

 

https://imgur.com/a/TQYBnRT

 

https://imgur.com/a/oNTNYRm

 

Am I fcked? Ran kvrt+MalwareBytes again everything is clean. What should I do now?

 

 

Edit-

Right clicked on it but it doesn't work. Kept the cursor on it and it showed locations, too bad I cleared the usage history for the process in the main post

 

https://imgur.com/a/W4syDvv

 

 

+ @Godlygamer23 @Kilrah @Levent

 

Edit 1-

Can't find these locations/folders in C:\Users\xxxx\AppData\Local\Temp

[podkall]

5 hours ago, pchelp said:

Can't find these locations/folders in C:\Users\xxxx\AppData\Local\Temp

I don't know what these are, do you have "show hidden folders" enabled in the File Explorer?

[pchelp]

18 hours ago, podkall said:

I don't know what these are, do you have "show hidden folders" enabled in the File Explorer?

Yes that option is already enabled. I think I need to format the os. Two questions, I have c and d drive partitioned in this drive. If I reinstall windows on c drive then will this spyware or whatever it is go away or formatting the whole drive, including d drive is necessary?

 

Is it safe to copy inportant files and folders from this pc to somewhere else? As windows defender, kvrt and malwarebytes are still saying that everything's clean.

[podkall]

7 minutes ago, pchelp said:

Yes that option is already enabled. I think I need to format the os. Two questions, I have c and d drive partitioned in this drive. If I reinstall windows on c drive then will this spyware or whatever it is go away or formatting the whole drive, including d drive is necessary?

 

Is it safe to copy inportant files and folders from this pc to somewhere else? As windows defender, kvrt and malwarebytes are still saying that everything's clean.

Not sure if that's possible, also doing this would probably erase some game's progress as well,

 

if Malwarebytes says everything is ok, I'd trust it.

 

You can try running this program before Malwarebytes and then scanning with MB after the program finishes what it's doing:

 

https://www.bleepingcomputer.com/download/rkill/

[pchelp]

2 minutes ago, podkall said:

Not sure if that's possible, also doing this would probably erase some game's progress as well,

 

if Malwarebytes says everything is ok, I'd trust it.

 

You can try running this program before Malwarebytes and then scanning with MB after the program finishes what it's doing:

 

https://www.bleepingcomputer.com/download/rkill/

Ran rkill

Windows Version: Windows 10 Home

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Automatic Updates Disabled

   [HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
   "NoAutoUpdate" = dword:00000001

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * No issues found.

 

Scanned with malwarebytes later and still everything is clean. While you are right but I don't want to take any risks. Those kinda crappy files shouldn't be in the internet usage for no apparent reason and then there is nothing in their file location

 

Two questions, I have c and d drive partitioned in this drive. If I reinstall windows on c drive then will this spyware or whatever it is go away or formatting the whole drive, including d drive is necessary?

Is it safe to copy inportant files and folders from this pc to somewhere else? As windows defender, kvrt and malwarebytes are still saying that everything's clean.

[podkall]

12 minutes ago, pchelp said:

Scanned with malwarebytes later and still everything is clean. While you are right but I don't want to take any risks. Those kinda crappy files shouldn't be in the internet usage for no apparent reason and then there is nothing in their file location

where are you seeing the usage?

[podkall]

14 minutes ago, pchelp said:

As windows defender, kvrt and malwarebytes are still saying that everything's clean.

maybe everything is clean, those files using barely 1MB, what can you do with 1MB? not a lot, barely anything

 

if there's nothing suspicious running, there's nothing harmful, 99% of malwares get installed because people download something or click on some ad, if you don't do that you are safe

[pchelp]

43 minutes ago, podkall said:

where are you seeing the usage?

Settings>network>status> data usage

[pchelp]

39 minutes ago, podkall said:

maybe everything is clean, those files using barely 1MB, what can you do with 1MB? not a lot, barely anything

 

if there's nothing suspicious running, there's nothing harmful, 99% of malwares get installed because people download something or click on some ad, if you don't do that you are safe

Check the screenshots here under Edit

Those are 10+MB

[podkall]

9 minutes ago, pchelp said:

Check the screenshots here under Edit

Those are 10+MB

I see files with { brackets and random letters and numbers in my temp folder, but haven't seen any random letter number exe files using internet:

 

[pchelp]

4 minutes ago, podkall said:

I see files with { brackets and random letters and numbers in my temp folder, but haven't seen any random letter number exe files using internet:

 

That's the whole point of my last post. I can't find any folders that are mentioned in those screenshots. There are other folders which start with { but not the one's which have those .exe files which is using the internet in the background.

[podkall]

29 minutes ago, pchelp said:

That's the whole point of my last post. I can't find any folders that are mentioned in those screenshots. There are other folders which start with { but not the one's which have those .exe files which is using the internet in the background.

actual username, appdata, local