View original (French)

Data leak

Benmic31 -  

Hello,

I have been receiving emails for 5 to 6 days now asking me to validate logins to various sites, which I did not initiate. This affects personal, administrative, or other accounts, more or less important. I have done some checks and made important changes to passwords and email accounts.

From a more technical standpoint, I would like to investigate the security of my PC more deeply to figure out where this could be coming from.

Thank you for your attention.


7 answers

  1.  bazfile Moderator

    Hello @Benmic31 StatusMember.

    To check the PC in depth, do the following.

    Download .
    Once downloaded save FRST to the desktop then right-click FRST and choose Run as administrator which gives this:

    Wait for the message the tool is ready to run to appear then click Analyze.

    Warning, wait for the messages stating that the analysis is finished to appear.

    At the end of the analysis the two reports FRST and Addition will be on the desktop.

    Upload the FRST and ADDITION reports to .

    Then attach the two links generated by in your reply.

    For information :

    If opening FRST triggers a Microsoft Defender alert, ignore it and click on More information then Run anyway, see below.

    bazfile
    Moderator/Security Contributor.
    a greeting, a reply, a thank you always pleases.

    0
    1. Benmic31 Author
      0
      1. Benmic31 Author

        It shows an invalid server response.

        0
      2. bazfile Moderator
        @Benmic31

        @Benmic31 StatusMember .

        I just tried it and it works, try again and if it's the same, put the files on

        0
    2. Benmic31 Author

      no, it doesn’t work, I’ll do it with the secure link, thanks

      https://transfert.free.fr/paOJ0H3

      0
      1. Benmic31 Author

        actually I live in England, it only works with the VPN.

        0
        2. Benmic31 Author
          <para>For the result of the files you asked for, what does it look like?</para> <para>thanks</para>
          0
          1. bazfile Moderator

            @Benmic31 StatusMember.

            There is nothing on the PC; the leaks do not come from the PC, there are just a few orphaned/obsolete processes and settings. If you want to delete them, do the following:

            Procedure to follow in the indicated order:

            1- Open FRST as administrator; to do this, right-click FRST and choose Run as administrator
            2 - Copy the entire script that is in the box that follows:

            Start:: CreateRestorePoint: CloseProcesses: Task: {761E43D7-87B8-487D-93EE-6B8F87D5E141} - System32\Tasks\AMDInstallUEP => C:\Program Files\AMD\InstallUEP\AMDInstallUEP.exe (No file) Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No file) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [No file] S3 atvi-hrist_msstore; \??\C:\XboxGames\Call of Duty- Modern Warfare 2\Content\Randgrid.sys (No file) GroupPolicy: Restriction - Chrome GroupPolicy-Firefox: Restriction Policies: C:\ProgramData\NTUSER.pol: Restriction HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction HKLM\SOFTWARE\Policies\BraveSoftware\Brave: Restriction AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [136] AlternateDataStreams: C:\Users\Fami\Application Data:c15540c89c88cd704ccd25de5f07f873 [394] AlternateDataStreams: C:\Users\Fami\Downloads\ChatGPT Image 3 août 2026, 12_58_20.png:mshield [112] AlternateDataStreams: C:\Users\Fami\Downloads\ChatGPT Image 3 août 2026, 14_25_56.png:mshield [112] AlternateDataStreams: C:\Users\Fami\Downloads\Job Applicants Privacy Notice.pdf:mshield [325] AlternateDataStreams: C:\Users\Fami\Downloads\MICHEL BENECH CV august 2026.pdf:mshield [655] AlternateDataStreams: C:\Users\Fami\Downloads\prise sang maman.pdf:mshield [93] AlternateDataStreams: C:\Users\Fami\Downloads\The Trachtenberg Speed System of Basic Mathematics.pdf:mshield [215] AlternateDataStreams: C:\Users\Fami\AppData\Roaming:c15540c89c88cd704ccd25de5f07f873 [394] End::

            3- Once the script is copied, click Fix; FRST automatically takes the script from the clipboard.


            Let the correction run; once it is finished you will be asked to restart your PC, do it as soon as it is requested, see below.

            Then, once your computer restarts:
            4- You will have a Fixlog file on your desktop; then send this report fixlog to .

            Then give the link generated by in your reply.

            bazfile
            Moderator/Security Contributor.
            a hello, a response, a thank you always please.

            0
            1. Benmic31 Author

              here is the link: https://pjjoint.malekal.com/files.php?read=20260909_91b9628d715a53a4

              0
              1. bazfile Moderator

                @Benmic31 StatusMember .

                The fixlog is OK.


                Uninstall FRST, rename the FRST file you downloaded, rename it to uninstall, and once the file is renamed, open it; the uninstallation will automatically occur via a restart of the PC.

                0