It always starts happening at about 10:30pm each night without fail, and I can't for the life of me figure out why. Googling doesn't reveal anything, and I'm at a loss as to what to do to keep it from coming back. What should I be doing?
DNS Changer Trojan
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
A week or so ago, Malwarebytes on my PC began picking up a lot of strange outgoing connections, and AVG detected the DNS Changer Trojan. Scanning with Malwarebytes picked up a bunch of nasty malwares related to DNS Changer. So, as you do, I removed them, but the very next night they were back, and for no good reason, as I was playing Civ6 at the time. The wife has also had the alerts about them come up, during her Sims sessions. It's not dependent on the PC being in use, either, as I've come back to the computer after having left it idling and found the alerts up on the screen as well.
It always starts happening at about 10:30pm each night without fail, and I can't for the life of me figure out why. Googling doesn't reveal anything, and I'm at a loss as to what to do to keep it from coming back. What should I be doing?
It always starts happening at about 10:30pm each night without fail, and I can't for the life of me figure out why. Googling doesn't reveal anything, and I'm at a loss as to what to do to keep it from coming back. What should I be doing?
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
-
Qikz
- Member ♥
- Joined in 2011
Go into safe mode and run malwarebytes from there.
The Watching Artist wrote:I feel so inept next to Stay Dead...
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
Can you copy and paste the text from the boxes in image 2, i need to see the whole command.
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
Can you copy and paste the text from the boxes in image 2, i need to see the whole command.
Program/Script: C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe
Start in: C:\Windows\system32\WindowsPowershell\v1.0
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
Can you copy and paste the text from the boxes in image 2, i need to see the whole command.Program/Script: C:\Windows\system32\WindowsPowershell\v1.0\powershell.exeStart in: C:\Windows\system32\WindowsPowershell\v1.0
Thanks, well in itself it isn't suspicious as it is just PowerShell being launched, but I dont understand why it would be being launched.
If it was me I would disable it (right click the option in task scheduler and select Disable) then see what happens, there is a risk however it is there for a reason (what that is I dont know, and I can't think why it would be there) and it breaks something so I would avoid rebooting "just in case" until after the time the issue you see with malwarebytes etc. normally happens, if it doesn't happen then I would think we gotit, leave it disabled, if it happens that was something else you can probably re-enable the task.
-
Karl
- Consider The Following
- Joined in 2008
- Contact:
Err, you can see the arguments on his first screenshot. It's launching an 'encoded command', which is a common obfuscation vector for malware. It's definitely that service, so go ahead and disable it, then boot into Safe Mode and run your antivirus suite again.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
Karl wrote:Err, you can see the arguments on his first screenshot. It's launching an 'encoded command', which is a common obfuscation vector for malware. It's definitely that service, so go ahead and disable it, then boot into Safe Mode and run your antivirus suite again.
gooseberry fool so it does!
Sorry I looked at the window and totally didn't see the mouse over tool tip doodal
Yeah thats the shitter, disable away.
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Alvin Flummux wrote:Errkal wrote:Check task scheduler, if it is starting at a certain time odds are there is a task that is being fired.
This looks suspicious, and the start time matches up perfectly. Should I just go ahead and delete it, or is there a more permanent fix? Or is that the permanent fix?
I've never encountered anything quite like this before, so I'm not sure what I should be doing.
Possible, it is the right time, if you right click and choose "properties" then go to the "Actions" tab what is written in the "Details" column.
Can you select edit and copy the various boxes, the "arguments" on is the important one here as it tells power shell when to do when fired
Can you copy and paste the text from the boxes in image 2, i need to see the whole command.Program/Script: C:\Windows\system32\WindowsPowershell\v1.0\powershell.exeStart in: C:\Windows\system32\WindowsPowershell\v1.0
Thanks, well in itself it isn't suspicious as it is just PowerShell being launched, but I dont understand why it would be being launched.
If it was me I would disable it (right click the option in task scheduler and select Disable) then see what happens, there is a risk however it is there for a reason (what that is I dont know, and I can't think why it would be there) and it breaks something so I would avoid rebooting "just in case" until after the time the issue you see with malwarebytes etc. normally happens, if it doesn't happen then I would think we gotit, leave it disabled, if it happens that was something else you can probably re-enable the task.
Thanks for the help, man! We'll see what happens tonight. Fingers crossed.
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Alvin Flummux
- Member
- Joined in 2008
- Location: Wilmington, OH, USA
- Contact:
First night with the thing disabled: No Malwarebytes or AVG alerts, no trojans detected during scans.
While I'll be watching for any changes over the coming days, for now I think I'm good!
Now I wonder if I shouldn't just delete it...
While I'll be watching for any changes over the coming days, for now I think I'm good!
Now I wonder if I shouldn't just delete it...
Jupiter is in your sun sign this week, making it pretty crowded in there, what with Jupiter being the largest of the planets and all.
-
Errkal
- Social Sec.
- Joined in 2011
- Location: Hastings
- Contact:
The task?
Can do, leave it a couple of days to be 100% but deleting will be fine.
Can do, leave it a couple of days to be 100% but deleting will be fine.
Who is online
Users browsing this forum: abcd, Alvin Flummux, Benzin, Bing [Bot], BTB, D_C, Fries. Wedges. Crisps?, Grumpy David, ignition, Irene Demova, jiggles, lex-man, Lime, Lotus, Memento Mori, Peter Crisp, Preezy, Shafto, Slayerx, Slimgrady, Tafdolphin, Tineash and 46 guests
