Found A Trojan, Did I Fix It?

Greetings and welcome back to the Major Geeks Malware Forum.

Please do this

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------

• Download FRST64 and save the file on your Desktop
• If your computer language is other than English right click on the FRST64 icon and rename it to FRST64english
• Right click on the icon and select Run as administrator
• Note: If you receive any warning about the download it is a false positive and you can ignore it. Click on More info to get the Run anyway option
• Click Yes to the disclaimer
• Click Scan and allow the program to run
• When completed, FRST.txt and Addition.txt reports will be saved on the Desktop
• Please attach the reports to your reply

===================================================

Things I would like to see in your next reply.

• Attached reports

 

Good to see you as well.

We should only handle one computer per topic. I am going to remove the FRST Scan post related to your computer. You can start a separate topic but make sure you post it here.

Regarding the "other" computer Do you recognize LestaStudio?

Please do this.

===================================================

Uninstalling Adobe Flash Player

--------------------

Note: Adobe Flash Player is no longer supported and is a security risk.

• Download Adobe Flash Player Uninstaller and save it to your Desktop
  
• Right click on the icon and select Run as administrator
  
• Click Uninstall then Done to reboot your computer

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Code:

Start::
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
Zip: C:\ProgramData\AVAST Software\Avast\report
Task: {3A623699-8054-4A3C-AB77-40666F0FEF60} - System32\Tasks\Lenovo\Vantage\StartupFixPlan => C:\Program Files (x86)\Lenovo\VantageService\4.2.24.0\\uninstall.exe  /repair (No File) 
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
ContextMenuHandlers2: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
ContextMenuHandlers2: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File 
FirewallRules: [TCP Query User{6BBCB6A8-AB47-4888-A42C-760CFBE45441}C:\users\User\appdata\roaming\zoom\bin\zoom.exe] => (Block) C:\users\User\appdata\roaming\zoom\bin\zoom.exe => No File 
FirewallRules: [UDP Query User{6ACF0395-2E10-4A83-8545-DA948C3B75A3}C:\users\User\appdata\roaming\zoom\bin\zoom.exe] => (Block) C:\users\User\appdata\roaming\zoom\bin\zoom.exe => No File 
FirewallRules: [{69F74FD2-4056-4BA1-A714-77B26836E91E}] => (Allow) C:\Users\User\AppData\Roaming\Zoom\bin\Zoom.exe => No File 
FirewallRules: [{7612B76E-82B6-4EA6-A29E-4AD684F3CD7F}] => (Allow) C:\Users\User\AppData\Roaming\Zoom\bin\airhost.exe => No File 
FirewallRules: [{A49F68E5-B400-4898-B56C-7786861941C0}] => (Allow) C:\Users\User\AppData\Roaming\Zoom\bin\airhost.exe => No File 
C:\ProgramData\TEMP
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create a zipped folder on your Desktop with today's date, example: 02.17.2022_13.24.50.zip. Please attach the file to your reply

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Flash Player uninstalled?
• Fixlog
• Attached file

 

Can you tell me if the web page you were viewing was related to bicycles?

 

Thank you for the clarification.

I consider the Avast "detection" a false positive. I located and reviewed the detection, navigated to the same web site and, without having Avast installed successfully loaded the page without any problem. Avast is showing the web address as Blacklisted, which it is not. Feel free to create an Avast exception for the website.

I am happy to report the computer is clean. There is no need to remove LestaStudio.

 

No, those were empty Firewall rules taking up space but not doing anything.

Avast is falsely identifying the web page as problematic. It is an Avast false positive detection. False positive detections by antivirus programs are common.

My initial guess regarding LestaStudio was that it was related to a game, similar to the other gaming type entries in the FRST.txt report. That is why I asked about it rather than automatically remove it. It is not malicious but if it is not wanted feel free to remove it..

 

I would like to look at the Avast reports again. Please do this.

===================================================

Farbar Recovery Scan Tool Fix

--------------------

• Right click on the FRST64 icon and select Run as administrator
• Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
• There is no need to paste the information anywhere, FRST64 will do it for you

Code:

Start::
Zip: C:\ProgramData\AVAST Software\Avast\report
End::

• Click Fix
• When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
• The tool will create a zipped folder on your Desktop with today's date, example: 02.17.2022_13.24.50.zip. Please attach the file to your reply

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• Fixlog
• Attached file

 

No need to repeat the step on your computer.

I am not sure what happened previously but currently there isn't anything of concern in the latest Avast report. I think things are good.