Exploit blocked sysnative/cmd.exe

What's this? I ran scans with all the antimalware software that I used last time I got infected and they all found nothing. Rogue/Sophos etc.

 

Edited by Sergic, 22 September 2023 - 04:07 AM.

Hi
 
Welcome
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary.

Let's begin...

• Highlight the entire content of the quote box below.

Start:: 

SystemRestore: On 

CreateRestorePoint: 

CloseProcesses: 

S3 Browser; %SystemRoot%\System32\browser.dll [X] 

FirewallRules: [{5098D8FC-E718-48C0-B761-2D6F2EA5EDF9}] => (Allow) LPort=54925 

FirewallRules: [{3F776947-6300-4868-B20E-8BAF226D0C25}] => (Allow) LPort=54950 

FirewallRules: [{765679F3-229F-49B3-9627-67F0C5E3798B}] => (Allow) LPort=54955 

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION 

HKU\S-1-5-21-4077029106-1538508914-2289205377-1001\...\Run: [{4C61AA40-5E08-4C1F-B353-3B0A3605E648}] => "C:\Users\Brenn\Desktop\ProtonVPN_win_v1.25.2.exe" /cmdloc "HKCU\Software\Proton Technologies AG AiTemp\{4C61AA40-5E08-4C1F-B353-3B0A3605E648}" (No File) <==== ATTENTION 

GroupPolicy\User: Restriction ? <==== ATTENTION 

S3 HWiNFO_180; \??\C:\Users\Brenn\AppData\Local\Temp\HWiNFO64A_180.SYS [X] <==== ATTENTION 

CustomCLSID: HKU\S-1-5-21-4077029106-1538508914-2289205377-1001_Classes\CLSID\{BCA9D37C-CA60-4160-9115-97A00F24702D}\localserver32 -> "C:\Users\Brenn\AppData\Local\Vivaldi\Application\5.3.2679.70\notification_helper.exe" => No File 

ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File 

ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File 

ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File 

ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File 

ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File 

FirewallRules: [{28FC5DCC-A48D-4662-95AD-627B05B359AF}] => (Allow) BiglyBT.exe => No File 

FirewallRules: [{480C6602-A8F0-4CD4-AA2D-AB8069EA5E9D}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.65.78.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File 

FirewallRules: [{9E6EFAB9-EFA3-4B1E-B67D-E4ECCBA59176}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.65.78.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File 

FirewallRules: [{01DF0815-250E-4BEF-A399-C43432F6D46B}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.65.78.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File 

FirewallRules: [{C9B70DF6-3CB5-42AC-9DE3-6A0E1C192420}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.65.78.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => No File 

FirewallRules: [{794745A0-45DC-4971-9356-8CB762E4AE8D}] => (Allow) BiglyBT.exe => No File 

FirewallRules: [{606790D0-8A26-4223-8C16-BD8823EEDB1A}] => (Allow) BiglyBT.exe => No File 

FirewallRules: [TCP Query User{B1E971DC-B8B2-49EA-A554-0D6B95067BC3}D:\program files\blizzard\starcraft ii\versions\base88500\sc2_x64.exe] => (Allow) D:\program files\blizzard\starcraft ii\versions\base88500\sc2_x64.exe => No File 

FirewallRules: [UDP Query User{84B377AA-0071-4E04-B794-A9BAFB6E8AD4}D:\program files\blizzard\starcraft ii\versions\base88500\sc2_x64.exe] => (Allow) D:\program files\blizzard\starcraft ii\versions\base88500\sc2_x64.exe => No File 

FirewallRules: [{24D6804D-96E3-40D7-8F2F-009F1ED9D507}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Game Transcoder\Plex Game Transcoder.exe => No File 

FirewallRules: [{6A3812FD-6CA9-4E09-A3C5-D5A4E34497A4}] => (Allow) BiglyBT.exe => No File 

FirewallRules: [{D1479971-42E4-4303-8A56-D181B1B96A9E}] => (Allow) BiglyBT.exe => No File 

FirewallRules: [{65B59E5D-2FBD-4C41-94F4-5FC026C82A18}] => (Allow) BiglyBT.exe => No File 

HKU\S-1-5-21-4077029106-1538508914-2289205377-1001\...\Run: [{4C61AA40-5E08-4C1F-B353-3B0A3605E648}] => "C:\Users\Brenn\Desktop\ProtonVPN_win_v1.25.2.exe" /cmdloc "HKCU\Software\Proton Technologies AG AiTemp\{4C61AA40-5E08-4C1F-B353-3B0A3605E648}" (No File) <==== ATTENTION 

Task: {61920684-DED1-4AEB-90F1-8D7E2D0C579F} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-4077029106-1538508914-2289205377-1002 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  /reporting (No File) 

Task: {1EBD2F7C-B9A0-4701-BF31-7E4579AD86F5} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-4077029106-1538508914-2289205377-1002 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  (No File) 

CustomCLSID: HKU\S-1-5-21-4077029106-1538508914-2289205377-1001_Classes\CLSID\{05E6467D-3747-4663-B980-4F1973F5EFA7}\localserver32 -> C:\Users\Brenn\AppData\Local\Vivaldi\Application\6.2.3105.48\notification_helper.exe (Vivaldi Technologies AS -> Vivaldi Technologies AS) 

CustomCLSID: HKU\S-1-5-21-4077029106-1538508914-2289205377-1001_Classes\CLSID\{BCA9D37C-CA60-4160-9115-97A00F24702D}\localserver32 -> "C:\Users\Brenn\AppData\Local\Vivaldi\Application\5.3.2679.70\notification_helper.exe" => No File 

HKU\S-1-5-21-4077029106-1538508914-2289205377-1001\...\Run: [{4C61AA40-5E08-4C1F-B353-3B0A3605E648}] => "C:\Users\Brenn\Desktop\ProtonVPN_win_v1.25.2.exe" /cmdloc "HKCU\Software\Proton Technologies AG AiTemp\{4C61AA40-5E08-4C1F-B353-3B0A3605E648}" (No File) <==== ATTENTION 

 

 

Comment: Commands to reset settings and cleanup

 

StartRegedit:

Windows Registry Editor Version 5.00

    

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]

"AutoReboot"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

"NoAutoUpdate"=-

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=dword:00000005

"ConsentPromptBehaviorUser"=dword:00000003

"EnableLUA"=dword:00000001

 

EndRegedit:

 

StartBatch:

  pushd\windows\system32

  bcdedit.exe /export C:\exportBCDfile

  bcdedit.exe /set {default} recoveryenabled yes

  bcdedit /enum

  sfc /scannow

  DISM.exe /Online /Cleanup-image /Restorehealth

  sfc /scannow

Endbatch:

 

StartBatch:

 SETLOCAL ENABLEEXTENSIONS

 echo userprofile=%USERPROFILE%

 if not defined userprofile echo no userprofile&goto :eof

  del /f /q "%userprofile%\AppData\Roaming\Microsoft\*.dl*"

  del /f /q "%userprofile%\AppData\Roaming\Microsoft\*.ex*"

  del /f /q "%userprofile%\AppData\Roaming\Microsoft\*.zi*"

  del /f /q "%userprofile%\AppData\Roaming\Microsoft\*.sy*"

  del /f /q "%userprofile%\AppData\Roaming\{*.*"

  rd /s /q "%userprofile%\AppData\Roaming\discord\Cache"

  rd /s /q "%userprofile%\AppData\Roaming\discord\code cache"

  rd /s /q "%userprofile%\AppData\Roaming\discord\gpucache"

  del /s /q "%userprofile%\AppData\Local\Temp\*.*"

  del /f /q "%userprofile%\AppData\Local\*-gui"

  del /f /q "%userprofile%\AppData\Roaming\*-gui"

 :eof

EndBatch:

 

 

startpowershell:

Write-Output "PowerShell run 1"

 

Set-Service -Name "BITS" -StartupType Manual -Verbose

Set-Service -Name "Dhcp" -StartupType Automatic -Verbose

Set-Service -Name "EventLog" -StartupType Automatic -Verbose

Set-Service -Name "EventSystem" -StartupType Automatic -Verbose

Set-Service -Name "nsi" -StartupType Automatic -Verbose

Set-Service -Name "RasMan" -StartupType Manual -Verbose

Set-Service -Name "SDRSVC" -StartupType Manual -Verbose

Set-Service -Name "SstpSvc" -StartupType Manual -Verbose

Set-Service -Name "TrustedInstaller" -StartupType Manual -Verbose

Set-Service -Name "VSS" -StartupType Manual -Verbose

Set-Service -Name "Winmgmt" -StartupType Automatic -Verbose

Set-Service -Name "wuauserv" -StartupType Manual -Verbose

Set-Service -Name "windefend" -StartupType Automatic -Verbose

Set-Service -Name "securityhealthservice" -StartupType Manual -Verbose

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 1

Endpowershell:

 

StartBatch:

net start sdrsvc

net start vss

net start rpcss

net start eventsystem

net start winmgmt

net start msiserver

net start bfe

net start trustedinstaller

net start windefend

net start mpssvc

net start mpsdrv

Winmgmt /salvagerepository

Winmgmt /resetrepository

Winmgmt /resyncperf

Endbatch:

 

exportkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions

 

 

startpowershell:

Write-Output "PowerShell run 2"

 

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted -force

# Check computer status again after setting to make sure changes were applied

    Get-MpComputerStatus

    Get-MpPreference

    Get-MpThreatDetection

# get statuses of services

Get-Service 'Terminal Server' | Select-Object -Property Name, StartType, Status

Get-Service BITS | Select-Object -Property Name, StartType, Status

Get-Service Dhcp | Select-Object -Property Name, StartType, Status

Get-Service EventLog | Select-Object -Property Name, StartType, Status

Get-Service EventSystem | Select-Object -Property Name, StartType, Status

Get-Service mbamservice | Select-Object -Property Name, StartType, Status

Get-Service mpsdrv | Select-Object -Property Name, StartType, Status

Get-Service MpsSvc | Select-Object -Property Name, StartType, Status

Get-Service msiserver | Select-Object -Property Name, StartType, Status

Get-Service nsi | Select-Object -Property Name, StartType, Status

Get-Service RasMan | Select-Object -Property Name, StartType, Status

Get-Service rpcss | Select-Object -Property Name, StartType, Status

Get-Service SDRSVC | Select-Object -Property Name, StartType, Status

Get-Service sense | Select-Object -Property Name, StartType, Status

Get-Service securityhealthservice | Select-Object -Property Name, StartType, Status

Get-Service SstpSvc | Select-Object -Property Name, StartType, Status

Get-Service TrustedInstaller | Select-Object -Property Name, StartType, Status

Get-Service UsoSvc | Select-Object -Property Name, StartType, Status

Get-Service VSS | Select-Object -Property Name, StartType, Status

Get-Service wdnissvc | Select-Object -Property Name, StartType, Status

Get-Service windefend | Select-Object -Property Name, StartType, Status

Get-Service Winmgmt | Select-Object -Property Name, StartType, Status

Get-Service wscsvc | Select-Object -Property Name, StartType, Status

Get-Service wuauserv | Select-Object -Property Name, StartType, Status

New-NetFirewallRule -DisplayName "Block Inb" -Direction Inbound –LocalPort 135-139, 445, 1234, 3389, 5555 -Protocol tcp -Action Block

New-NetFirewallRule -DisplayName "Block Inb" -Direction Inbound –LocalPort 135-139, 445, 1234, 3389, 5555 -Protocol udp -Action Block

wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"}

EndPowerShell:

 

cmd: reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled

exportkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions

exportkey: hkcu\software\classes\ms-settings\shell\open\command

exportkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

exportkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection

exportkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

exportkey: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager

 

Comment: Use Farbar routine

 

C:\Windows\Temp\*.*

C:\WINDOWS\system32\*.tmp

C:\WINDOWS\system32\drivers\*.tmp

C:\WINDOWS\syswow64\*.tmp

 

startbatch:

del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"

del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\Js\*.*"

del /s /q "%userprofile%\APPDATA\LOCAL\MICROSOFT\WINDOWS\INETCACHE\IE\*.*"

del /s /q "%userprofile%\AppData\Local\Temp\*.exe"

endbatch:

 

CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R 

CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R 

CMD: "C:\Windows\SysWOW64\lodctr.exe" /R 

CMD: "C:\Windows\SYSTEM32\lodctr.exe" /R 

HOSTS:

Removeproxy:

CMD: fltmc instances

CMD: netsh advfirewall reset

CMD: netsh advfirewall set allprofiles state ON

CMD: ipconfig /flushdns

CMD: netsh winsock reset catalog

CMD: netsh int ip reset C:\resettcpip.txt

CMD: Bitsadmin /Reset /Allusers

 

EMPTYTEMP:

End::

• Right click on the highlighted text and select Copy.
• Start FRST (FRST64) with Administrator privileges
• Press the Fix button. FRST will process the lines copied above from the clipboard.
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
 
Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.

When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status

• Delete IFEO keys
• Delete tracing keys
• Delete Prefetch files
• Reset Proxy
• Reset IE Policies
• Reset Chrome policies
• Reset Winsock
• Reset HOSTS file
• Click Scan Now ...
• When the scan has finished a Scan Results window will open.
• Click Cancel (at this point do not attempt to Quarantine anything that is found)
• Now click the Log Files tab ...
• Double click on the latest scan log (Scan logs have a [S0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
• A Notepad file will open containing the results of the scan.

Please post the contents of the file in your next reply.
 

​

Please do the following so that we may take a closer look at your system.
Please restart the computer and do the following.
WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper
NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

As a workaround, to avoid this detection in Malwarebytes, please turn off the following setting in Malwarebytes. Also, check for updates in the general tab.

 

 

Next

Turn off fast startup in Windows.

 

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

 

Restart the computer.

 

Attempt to re-create the issue.

 

We have been notified that this is due to a bug in Malwarebytes. It should be fixed in the coming days.

Do you still want the mbst-grab-results.zip file? Thank you for your time.

How is the computer doing?

I disabled the Security Center register thing and set Self Protection module "early start" OFF. (I left "self protection module" ON)

 

I will post if I get the exploit blocked thing, it seems to happen every day.

 

Computer is fine.

Edited by Sergic, 22 September 2023 - 06:40 PM.

Do you still want the mbst-grab-results.zip file? Thank you for your time.

No. Your computer is clean. How is it doing?

Computer is working fine otherwise. Thankyou! These exploit blocked warnings only showed up a few days ago.

Edited by Sergic, 22 September 2023 - 06:43 PM.

I disabled the Security Center register thing and set Self Protection module "early start" OFF. (I left "self protection module" ON)
 
I will post if I get the exploit blocked thing, it seems to happen every day.
 
Computer is fine.

Very well. Meanwhile, use this application to remove tools used and their quarantined items:
 
Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.

• Put a check mark next to these items:

- Delete tools

- Create Restore Point

- Delete now

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and  delete itself.

A few final recommendations:

• Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
• Make sure you're backing up your files
• Keep all software up to date - PatchMyPC -
• Keep your Operating System up to date and current at all times -
• Further tips to help protect your computer data and improve your privacy:
• Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome:
•   Microsoft Edge:
•   Mozilla Firefox:

uBlock Origin

• Google Chrome:
• Microsoft Edge:
• Mozilla Firefox:

Further reading if you like to keep up on the malware threat scene:
 
Malwarebytes
 
Bleepingcomputer
 
Hopefully, we've been able to assist you with correcting your system issues.
 
Thank you for contacting BleepingComputer. Regards.