Ransomware Warning Using MS Paint

Norton 360 for Windows
1

Last night, I got a Ransomware warning while saving a jpg file in MSPaint,exe. I was surprised to see this, but I decidied to block the app until I was sure there was nothing wrong. I can still save a file, but not in the same name, in the same folder.

According to the warning, the severity of the threat is HIGH. When I looked in the security history, File Insight found nothing with MSPaint. I have scanned my computer several times with Smart Scan and a Full Scan and nothing is found.

I found 2 versions of Paint on my computer and both were modified on 3/6 at 1:03 AM, and according to the search engine

the app has zero bytes, which seems strange. Since last night, I have had trouble entering passwords. Maybe it’s the keyboard, but I sometimes have trouble entering my Windows 11 password and passwords for Word and Excel.

1 Like
2

The real Paint program only exists in one place:

C:\Windows\System32\mspaint.exe
If it’s in another path, something is wrong.

What to do now (safe step-by-step):

1 - Open Norton 360.

2 - Go to Security → Security History.

3 - Look at the ransomware alert and note:

File path
Process name
4 - If it’s not C:\Windows\System32\mspaint.exe, it’s probably malware.

After that:

5 - Run a Full Scan in Norton.

6 - Also run Power Eraser within Norton (an aggressive tool against hidden threats).

7 - Check if there were any files blocked by ransomware protection.

3

Neither of the two versions of Paint are in the sysem32 folder. One is in:

C:\Users\gm681\AppData\Local\Microsoft\WindowsApps

the other is in this location: C:\Users\gm681\AppData\Local\Microsoft\WindowsApps\Microsoft.Paint_8wekyb3d8bbwe.

Both are 0 bytes, which makes no sense to me.

When I check them in the security history, on one occasion, I was told it’s been out for 16 days, but many users have it and it looks clean. On other occasions, I get a message saying it’s so new it’s unproven.

When I find them using Agent Ransack, and I check file insight, I get a “something went wrong” message.

I found an entry in the security history that says “mspaint.exe prevented from accessing your undefined file,” and this was when I was warned about Ransomware.

I don;t know what it means by “undefined file,” it was a jpg img that was already on my computer and previously screened.

I have noticed repeated entries “Rule IGMP(2) traffic with (224.02.2.2) being blocked,but not listed a threat, just “info.”

Occasionally, I see “remote access protection disabled” and “intrusion signatures disabled,”. They are referred to as HIGH severity.

I did en Agent Ransack search that shows right at the time these two MSPaint.exe files were modified, there were a lot Windows Update files (ETL files) being modified on my computer/

4

I forgot to mention in my last post that I used the Power Eraser, looking for Rootkits and it turned up nothing.

I’ve used the System File Checker and it said there were no integrity violations.

Every Smart Scan and Full Scan turns up nothing.

I mentioned in my last post that I do see Remote Access Protection and Intrusion Signatures Disabled, but much of that, not all of that is followed up by them being re-enabled, so those instances may be occurring when I shut down my computer and then re-start it,

5

@gamott2015 Are you by chance running Windows 11 S mode and using the Microsoft Store version?

Here is some better information for you about the file “Microsoft.Paint_8wekyb3d8bbwe.”

FYI: These store apps are UWP are a not generally located in the Windows32 directory.

AI Overview

Microsoft Paint (Package Family Name:

Microsoft.Paint_8wekyb3d8bbwe) is the default, modern raster graphics editor in Windows 10/11, featuring layers, transparency, and AI-powered Cocreator tools. It is a UWP app, typically located in C:\Program Files\WindowsApps\, and can be updated or reinstalled via the [Microsoft Store]**(Redirect Notice)

SA

6

I’m unfamiliar with Windows 11 S Mode,and I bought my computer from Best Buy, using the Windows 11 system they provided me, and downloading all Windows updates,

I’ve used Agent Ransack to see what files were updated around this time, and right as this version of MSPaint was being modified, they were a lot of log files in Windows Update folders were being mo

7

I found this article online about Ransomware using MSPaint:

8

I just removed MSpaint.exe from my system. There is no trace of the 2 zero byte files under that name, I’ve downloaded the install file from Microsoft, but I’m not sure if I’m going to use it now. I have another photo editor which seems safer and knowing that Paint can be used by ransomware, I just might keep it off my system.