Question GOM Player set my antivirus on fire. The program is preventing me from deleting it.

[kubrat]

I downloaded GOM Player from here - (Potential virus source removed by moderator)

As soon as the download was completed, my Windows virus protection went on fire.

When I tried to delete the program, I was prevented from doing so due to endless loading and a "fail to respond" message.

I restarted my PC, but same thing happened until I deleted the entire folder that GOM Player was in, along with all the programs in the folder.

I performed a quick scan of my PC, and it says there's no virus, but I'm not sure if that's enough.

Is my PC still at risk? What should I do?

I would appreciate your help. Thanks!

Update: I did a full scan, and threats were found. Uploading an image.

Scan Result:

https://imgur.com/a/HmCUsVw

View: https://imgur.com/a/HmCUsVw

Another updated:
I did a second scan and initially blocked the threats and then I tried to remove them but it wasn't performing the action. I did another full scan and now it shows no threats.

Adding an Image of the latest scan I performed:

https://imgur.com/a/4GWiehl

View: https://imgur.com/a/4GWiehl


I am trying to see if the threats are actually deleted and not just blocked/quarantined.

Is there anything else I can do to make sure there are no viruses on my PC?

Update:
I decided to do a clean install of Windows. Interesting that when I decided to back up important files on a flash drive (like documents and photos, none of which were in the same folder as the problem software,nor were they related to it) a WIndows Firewall pop appeared again, warning I had an PUA coin miner.

Anyway, I backed up my important files and continued to clean install - deleted all partitions etc.
Immediately after installation I scanned the PC and no threats appeared. Then I added the back up files and scanned them and no threats appeared either.

Hopefully the system is indeed clean.

That GOM Player was real pain in the ass, even though I didn't even install it - it just downloaded and started messing with the Firewall. The software, along with its site should have been flagged now.

 

[kerberos_20]

it should show up as PUA.win32/GOMLab.A which doesnt pose security risk, but is classified as unwanted app, can slow down performance or reliability or change system behaviour
you can add exception to your antivirus if you want to use it

btw your scan show some bitcoin miner, if its not yours, delete those

 

[kubrat]

it should show up as PUA.win32/GOMLab.A which doesnt pose security risk, but is classified as unwanted app, can slow down performance or reliability or change system behaviour
you can add exception to your antivirus if you want to use it

btw your scan show some bitcoin miner, if its not yours, delete those

Yeah, I remember briefly seeing it was something puawin32.
I have not installed any miners.

As I mentioned, the program was preventing me to remove it as whenever I right click on it (with the intention to delete it), it pretty much caused a constant loading and I couldn't do anything but restart the PC.

Also, I have over 20 warning messages, as the Firewall kept alerting me with a new message every second, one after another. Not receiving any messages, after the scan and after I asked Firewall to take actions against the threats.

I initially blocked the threats and then I tried to remove them but it wasn't performing the action. I did another full scan and now it shows no threats.

I am trying to see if the threats are actually deleted and not just blocked/quarantined.

Is there anything else I can do to make sure there are no viruses on my PC?

 

[Cilantro7536]

Hello,

Typically, you can probably follow at least 3 different paths:

• Scan with multiple tools. For example, full-scan in safe mode with Window defender, and then follow up with MalwareByte scan for one time, etc., and trust that the tools have gotten everything.
• Nuke the OS and reinstall, and reinstall the software carefully. This is usually the surest way.
• Walk through a process with a "trusted" stranger such as what's available in BleepingComputer/MalwareTips forums.

 

[JohnBonhamsGhost]

check through "Protection History",
document where all original threats were located,
boot into Safe Mode and physically remove all of those documented locations if the locations still exist.

 

[kubrat]

Hello,

Typically, you can probably follow at least 3 different paths:

• Scan with multiple tools. For example, full-scan in safe mode with Window defender, and then follow up with MalwareByte scan for one time, etc., and trust that the tools have gotten everything.
• Nuke the OS and reinstall, and reinstall the software carefully. This is usually the surest way.
• Walk through a process with a "trusted" stranger such as what's available in BleepingComputer/MalwareTips forums.

I did a clean install of Windows and scanned it after installation and then I added my back up files and scanned them as well - no threats were found.

 

[kubrat]

check through "Protection History",
document where all original threats were located,
boot into Safe Mode and physically remove all of those documented locations if the locations still exist.

I did check the "Protection history'' but it showed that some files were blocked, with no information of the files location. When I click on the blocked files it asked me to allow access which I did not do.

Anyway, I did a clean install of Windows and scanned it after installation and then I added my back up files and scanned them as well - no threats were found.