I'm having trouble with repeated warnings in my NAV history log. These seemed to appear after my wife unavoidably clicked a bad link (red close X seemed disguised as proceed). It was one of those phony system/virus checkers and seemed to go after windows explorer. I don't recall the "trade" name.
- I keep getting the following log entries: "Unauthorized access blocked (Send Terminate Message to Window)" The actor is c:\windows\explorer.exe. The target is C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
- I ran an NAV full system scan without issues
- I ran AdAware scan without issues
- I ran HiJackThis and reviewed the log files. I was able to verify the unknown .exe files with Google. I'm not an expert, but there didn't seem to be suspect lines (i.e. items with no tags, strange directories, etc).
- I ran Malwarebytes and got the following two entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0)
c:\RECYCLER\ADAPT_Installer.exe (Heuristics.Malware)
I was able to clean/remove both without issue. (sorry didn't save the log when cleaned but OK)
- I ran Malwarebytes in Safe Mode, and got no new entries
- I ran RegMon and and Process Explorer to look for strange processes. Nothing obvious; no two sets of explorer.exe running. No items seeming to link explorer.exe and ccSvcHst.exe. However, there were hundreds of lines with unintelligible key codes...
Not sure where to turn next. Not sure of the possible threat level, but seems bad that an actor is attempting to shut down ccSvcHst.exe. Would be happy to post HJT logs or other.
Thanks!