Question Powershell virus ?

[Digital~Dreams]

A new one appearing once or twice daily, denying causes no obvious issue... "Windows powershell is trying to communicate with ceseurope.com"

Where has this come from and why ?

[mod edit: made link safer]

 

[Colif]

run malwarebytes? https://www.malwarebytes.com/mwb-download
bitdefender free - https://www.bitdefender.com.au/solutions/free.html

that site not safe, tries to download a file (lucky my browser blocks it)

 

[Digital~Dreams]

run malwarebytes? https://www.malwarebytes.com/mwb-download
bitdefender free - https://www.bitdefender.com.au/solutions/free.html

that site not safe, tries to download a file (lucky my browser blocks it)

Ran malwarebytes and it found a few dodgy items and reg keys (deleted). Yet today the message popped up again !, malware found nothing....

 

[Colif]

did you try bitdefender?
or https://www.hitmanpro.com/en-us

i doubt this will work but
Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't delete anything, it just stops non microsoft programs loading at startup. Easy to reverse

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

its likely that won't fix it but worth a try.

just check windows I guess:

right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter

Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

 

[Digital~Dreams]

did you try bitdefender?
or https://www.hitmanpro.com/en-us

i doubt this will work but
Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't delete anything, it just stops non microsoft programs loading at startup. Easy to reverse

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

its likely that won't fix it but worth a try.

Not impressed with hitman, found lots of false positives and refused to delete anyway as needed to be registered (even though I followed the procedure for free). Thank god it didn't auto delete or would have bust a few of my programs (such as one downloaded direct from Nvidia development).

Clean boot might not be feasable as the message appears randomly around twice a day if pc on most of the time...

ceseurope.com seems to be a printer cartridge recycling company ?. Might just block the comms next time it pops up and hope other powershell functions arent affected in the future.

 

[Colif]

That isn't the original link you got. I edited it as if people searched it, they would have been offered a file.
actual link was cesar europe without the space.

maybe blacklist the site in defender if it lets you

look in scheduled tasks and see if anything set in there.

 

[Digital~Dreams]

Strange, yes tried via android and downloads 'download.bin' without displaying any website. YET eset smart security (that alerts me) gives it a green tick and says 'discovered 1 year ago' ?

 

[Colif]

drop the file on here and see what it thinks
https://www.virustotal.com/gui/home/upload

 

[Ralston18]

Per @Colif

"look in scheduled tasks and see if anything set in there. " Yes.

= = = =

And also search the drive for any Powershell scripts. Files with the extension .ps1

Get-ChildItem cmdlet will do that.

References:

https://shellgeek.com/powershell-se...les_from_subdirectories_that_match_filter_txt

https://superuser.com/questions/1708916/searching-files-by-multiple-search-patterns-in-powershell

For example:

Get-ChildItem -Filter *.ps1 -Recurse

(You may need to add the -Force parameter.)