Windows Defender detects Trojan: Script/Ulthar.A!ml.

Solved

hs1949 -

Hello,

I ran a scan on my computer using Windows Defender. Several unwanted items were detected. I let Defender "take action" to try to eliminate these unwanted items. Time passed, and Defender is still working, but the unwanted items are not being removed. My question is how to configure or carry out other actions to eliminate these harmful objects. A big thank you to anyone who can help me.

10 answers

Answer 1 / 10
hs1949 Author
OK, it's done. Thank you a thousand times again.

0
1. bazfile Moderator
  
  You're welcome ;)
  See you on CCM!
  
  0
Answer 2 / 10
bazfile Moderator
OK ;)
You can uninstall FRST, rename the FRST file you downloaded to uninstall, then once the file is renamed, open it; the uninstallation will be done automatically through a restart of the PC.

--
bazfile
Moderator/Security Contributor.
A hello, a response, a thank you is always appreciated.

0
Answer 3 / 10
hs1949 Author
Hello,

Thank you very much for your efficient help. This post is therefore resolved.

With my best regards.

hs1949

0
Answer 4 / 10
hs1949 Author
Sorry, but the screenshot has disappeared.

0
1. bazfile Moderator
  
  The fixlog is fine, anyway it's not because WD said these files were infectious that it's true, WD sometimes makes false alerts with false positives.
  
  0
Answer 5 / 10
hs1949 Author
Hello, Apparently, everything went well. I'm attaching a screenshot of the situation regarding Defender. Now, before doing anything, I'm going to make a system image backup. Thank you very much. A little explanation about the presence of Debian for download. I have several computers, some very old, which are not eligible for Windows 11. So, I looked for a Linux distribution that would work on old PCs, both 32-bit and 64-bit. I tested about forty of them, and I chose Q4OS (based on Debian 11), to my great satisfaction as a newcomer to Linux. My warmest regards. hs1949

0
Answer 6 / 10
hs1949 Author
Hello, here is the link: https://www.cjoint.com/c/LEzkyUT3XzM

0
Answer 7 / 10
hs1949 Author
Hello, I just turned on my computer. I'm seeing your response. I'll take care of it as soon as possible and keep you updated on the progress. A very, very big thank you for such a quick and precise response. See you soon.

0

hs1949 Author

Good evening, here are the two links:

https://www.cjoint.com/c/LEyp7vdtldM

https://www.cjoint.com/c/LEyqarTGi1M

Thank you for the follow-up.

bazfile Moderator

Hello.
This comes from two files (debian-8.11.0-powerpc-DVD-1) that you downloaded which are in:
C:\Users\Henri\Downloads\debian-8.11.0-powerpc-DVD-1
and
C:\Users\Henri\Downloads\debian-8.11.0-powerpc-DVD-1 (1).iso

You can delete them manually or via the following script which will also remove some obsolete processes and an annoying notification in Edge.

Procedure to follow in the indicated order:

1- Open FRST as administrator by right-clicking on FRST and selecting Run as administrator
2 - Copy the entire script from the box below:

Start::
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-18\...\Run: [] => [X]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE (File not found)
Task: {6588B7D1-413D-4149-A5C0-015EAB38F1A7} - System32\Tasks\Opera scheduled Autoupdate 1527579061 => C:\Users\Henri\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (File not found)
Task: {6E5571D2-8B3E-4D9D-8E48-8D003258A53F} - System32\Tasks\Opera scheduled Autoupdate 1549008994 => C:\Users\Henri\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (File not found)
Task: {AF1A4480-ED34-47E9-9A8E-DE5A1049FB6C} - System32\Tasks\BlueStacksHelper => C:\ProgramData\BlueStacks\Client\Helper\BlueStacksHelper.exe (File not found)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [File not found]
S3 MpKsl5d7f2d01; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FFC41DF5-A634-4DD7-893D-A4B3A991BAC4}\MpKslDrv.sys [X]
U3 TrueSight; \??\C:\Windows\System32\drivers\truesight.sys [X]
GroupPolicy: Restriction ? 
GroupPolicy\User: Restriction ? 
Policies: C:\ProgramData\NTUSER.pol: Restriction 
C:\Users\Henri\Downloads\debian-8.11.0-powerpc-DVD-1 (1).iso
C:\Users\Henri\Downloads\debian-8.11.0-powerpc-DVD-1.iso
Edge Notifications: Default -> hxxps://codingcaptcha.com
Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.18.0_neutral__d55gg7py3s0m0 [not found]
Edge Extension: (No name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
CustomCLSID: HKU\S-1-5-21-3813632654-1173275650-3664626441-1001_Classes\CLSID\{9486aaf1-0930-362a-962d-8e6908739c817}\InprocServer32 -> 0x42940E5DE9C7D6011B300F5DE9C7D601010000000100000000000000 => File not found
ContextMenuHandlers1: [FileConverterExtension] -> {af9b72b5-f4e4-44b0-a3d9-b55b748efe90} => C:\Program Files (x86)\File Converter\FileConverterExtension.DLL -> File not found
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> File not found
AlternateDataStreams: C:\ProgramData\TEMP:8FFC7CF4 [250]
SearchScopes: HKU\S-1-5-21-3813632654-1173275650-3664626441-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll File not found
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll File not found
FirewallRules: [{E178AB53-46DA-442B-8D62-9341C068D347}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe => File not found
FirewallRules: [{41E7C867-1B94-4AC6-9D99-C85D8AA5B371}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe => File not found
FirewallRules: [{EA9B0DDC-E6F2-4FC6-9A8E-41FF9C3A8226}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Music Recorder\Streaming Music Recorder.exe => File not found
FirewallRules: [{3ECBB854-BA24-4833-A3BE-F6CE93611372}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Music Recorder\Streaming Music Recorder.exe => File not found
FirewallRules: [{5052015A-D6C1-443C-923A-1D5A241B8A68}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\ApowersoftVideoHelper.dll => File not found
FirewallRules: [{4A27B0C4-EA3A-406A-BC99-2AA4A875868B}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\ApowersoftVideoHelper.dll => File not found
FirewallRules: [{C5952113-1DFB-493C-8F54-DA6716D8DDCC}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe => File not found
FirewallRules: [{C066ADC1-BF5C-4CFF-8C00-14BA3CACD405}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe => File not found
FirewallRules: [{98ACFDFA-9E72-4CC9-BD7E-B7EA93B4B5D5}] => (Allow) C:\Program Files (x86)\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe => File not found
FirewallRules: [{1A18D3DD-84CB-425A-8411-903545CFDD0C}] => (Allow) C:\Program Files (x86)\FormatFactory\FormatFactory.exe => File not found
FirewallRules: [{E33398B8-601F-40F2-9167-2E891AC30F7A}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe => File not found
FirewallRules: [{0ACD8E51-B3AD-45CA-9369-FC473FF73BEB}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe => File not found
FirewallRules: [{A3EBF928-DAE3-4576-838A-FEDA92A8CF81}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe => File not found
FirewallRules: [{F1A4A3CF-23F0-44E4-AA01-AB732D54BF2B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe => File not found
FirewallRules: [{5B31B051-F36F-4BB7-950C-9BA492D9CB3A}] => (Allow) C:\Program Files (x86)\BlueStacks\HD-Player.exe => File not found
FirewallRules: [{CF5ECCD2-7586-456C-9E35-9CAF5A00AABB}] => (Allow) C:\Users\Henri\AppData\Local\Programs\Opera\56.0.3051.52\opera.exe => File not found
FirewallRules: [{F6764975-A776-40EB-9BFB-0FDF4BD43C5D}] => (Allow) C:\Users\Henri\AppData\Local\Programs\Opera\56.0.3051.99\opera.exe => File not found
FirewallRules: [{BE76221C-087A-4074-942B-B6587BF12657}] => (Allow) C:\Users\Henri\AppData\Local\Programs\Opera\71.0.3770.198\opera.exe => File not found
FirewallRules: [{DB28B129-2758-4903-A958-A82D8002A772}] => (Allow) C:\Users\Henri\AppData\Local\Programs\Opera\71.0.3770.228\opera.exe => File not found
FirewallRules: [{2B550AEA-5DC3-49FE-8F9B-B4E532F3CE0B}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe => File not found
FirewallRules: [{27EB652B-8299-41C3-994D-2884EC50E6CA}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe => File not found
EmptyTemp:
End::

3- Once the script is copied click on Fix, FRST will automatically take the script from the clipboard.

Let the fix be done and once it is finished you will be asked to restart your PC, do it as soon as you are prompted, see below.

Then once your computer has restarted:
4- You will have a Fixlog file on your desktop, then upload these reports to https://www.cjoint.com/ see this tutorial then provide the link generated by Cjoint in your next message.

5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

FOR INFORMATION:

Your version of Windows 10 is not up to date, to check this go to this page click on Update now, this will start the download of the Microsoft tool, just open it and it will allow you to update Windows 10 to the latest version and will let you know if it is compatible with your PC, be careful this update takes some time, since you have a laptop plug it in, as it would be a shame to run out of battery before the update is finished.
.

Myst93200
@bazfile
Hello,

I want to delete the same file, would this procedure work for me? Or is it very specific to their case?

0
bazfile Moderator
@Myst93200

would this procedure work for me?

No, the scripts are custom-made and only concern the PC on which the FRST analysis was done.

0

Answer 9 / 10
hs1949 Author
OK, I'll do that. Thank you for the reply.

0
Answer 10 / 10
bazfile Moderator
Hello,
Download FRST once downloaded save it on the desktop then right-click on FRST and choose Run as administrator you will see this:
Click on Scan

Attention, wait for the messages saying that the scan is finished to appear

At the end of the scan, you will have two text files on the desktop FRST and Addition

Then send the FRST and ADDITION reports to CJOINT see THIS TUTORIAL then provide the two links generated by Cjoint in your response.

--
bazfile
Moderator/Security Contributor.
a hello, a response, a thank you are always appreciated.

0

Windows Defender detects Trojan: Script/Ulthar.A!ml.

10 answers

5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

FOR INFORMATION:

Attention, wait for the messages saying that the scan is finished to appear

Find a scanner

Get windows 10 iso image for free

Nvidia shield tv: update to 9.2.4 impossible

Software to work on a pdf

Access to livejournal blocked

Line height not remembered in calc

First pc tip:

Customize and sanctuarize your windows folder icons

Windows 11 search bar isn’t working anymore

Message saying that my phone is compromised