Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

file2.exe wants to make changes to my pc


  • This topic is locked This topic is locked
3 replies to this topic

#1 wishbone346

wishbone346

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:46 PM

Posted 20 February 2016 - 07:19 PM

So for the last couple of days I've been receiving a message at startup on my PC that says that a program called file1.exe wants to make changes to my PC. I reply no or just close the window only to find that malwarebytes discovers PUPs when scanned (between 1 and 3 each time.) I tried a number of things including using ccleaner to scan for errors, AdwCleaner, Comodo anti-virus, and of course malwarebytes. After fixing some issues with ccleaner the program wanting to change my PC changed to file2.exe and now persists no matter what I try. I found file2.exe on my PC under Users\Owner\AppData\Roaming\LocalData and tried deleting it and everything else in that folder but one application named smsc will not delete as it says it is in use, and every time I delete all the others and restart my PC everything seems to have come back. Any help or advice on what to do would be greatly appreciated.



BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:46 PM

Posted 20 February 2016 - 07:24 PM

Hi wishbone346 :)

My name is Aura and I'll be assisting you with your issue. In order to get started, I'll need you to run FRST and provide me the logs it'll output. Follow the instructions below please.

iO3R662.pngFarbar Recovery Scan Tool (FRST) - Scan mode
Follow the instructions below to download and execute a scan on your system with FRST, and provide the logs in your next reply.
  • Right-click on the executable and select Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
  • Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds;
  • Check the Addition.txt option;
  • Click on the Scan button;
  • On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files;
  • Copy and paste the content of FRST.txt in your next reply, and attach Addition.txt to it;
Your next reply should include:
  • Copy/pasted content of the FRST.txt log;
  • Copy/pasted content of the Addition.txt log;

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:46 PM

Posted 23 February 2016 - 12:14 PM

Hi wishbone :)

Are you still with me? Can you follow the instructions in my previous post please? :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,044 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:08:46 PM

Posted 28 May 2016 - 07:22 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users