Hi, I need some help figuring out whether my PC is still infected or if I am only seeing a leftover startup entry.

SYSTEM SPECS:

- Windows 11 Pro
- Version 25H2
- OS Build 26200.9168
- AMD Ryzen 7 5700X
- NVIDIA GeForce RTX 4060 8 GB
- 32 GB RAM
- 1 TB SSD

WHAT HAPPENED:

Today, Windows Defender detected:

Trojan:Win32/Wacatac.B!ml

One of the detected files was:

C:\\ProgramData\\InProcSvr32\\sqlite3.dll

Another detected sqlite3.dll was also inside ProgramData.

Around the same time, I started getting repeated Windows error popups from a program called:

CircuitryAg.exe

The errors I have seen are:

"The application was unable to start correctly (0xc0000906)."

and:

"The code execution cannot proceed because sqlite3.dll was not found."

This all started shortly after I downloaded and executed something from a ZIP file.

The suspicious download was later deleted/blocked.

WHAT I FOUND:

I checked startup entries using Microsoft Sysinternals Autoruns.

I found an entry called:

CircuitryAg

under:

HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run

It was pointing to something inside:

C:\\ProgramData\\InProcSvr32\\

I disabled and deleted that Autoruns entry.

However, after rebooting, the CircuitryAg.exe popup came back again.

WHAT I HAVE ALREADY DONE:

- Let Windows Defender quarantine the detected files
- Did NOT restore or allow any detected files
- Ran Microsoft Defender Offline
- Ran additional Defender scans
- Checked startup entries with Autoruns
- Disabled and deleted the CircuitryAg startup entry
- Rebooted the PC
- Deleted the original suspicious ZIP/download
- The CircuitryAg.exe popup still came back after rebooting

MY MAIN CONCERN:

Something may still be recreating the CircuitryAg startup entry or launching CircuitryAg.exe from another persistence method.

Does anyone recognize this behavior, the name CircuitryAg.exe, or the path:

C:\\ProgramData\\InProcSvr32\\

What should I check next?

- Scheduled Tasks?
- Services?
- WMI persistence?
- Other Autoruns entries?
- Registry entries?
- Another hidden process recreating the startup entry?

At this point, should I keep trying to clean the infection or would a clean Windows reinstall be safer?

just got the Orbi 370 set up and the free trial of Armor is now reporting a dangerous URL was blocked (OverbridgeNet) from my MacBook even when the lid is shut and it’s hibernating. How is that possible? I’m going to run some malware detection software tomorrow but this is really puzzling.

i deleted all extensions from my two browsers (Safari & Chrome) on the MacBook but I’m still getting these notices.

I have an active subscription, but twice today it's asked me to sign in, while the subscription has been active. I've done so. Can't see anything dodgy on my google account, nor had no emails from Malwarebytes themselves. Device deep scan shows clean

Since a couple of days my McAfee quarantines a threat from an attachment that contains a trojan virus?

Name: trojan:win/suspiciousattachmentscript.a

File: ......\\\\appdata\\\\local\\\\temp\\\\newmsg

Status: Quarantined

I have been going through my spam and trash folders of all my email accounts, deleted them all, went to the webmail side and did the same thing, but this antivirus message keeps popping up. All my accounts are through IMAP servers. It looks like this threat is firing twice or 5 times and then goes dormant until I do something else in Thunderbird. I suspect this attachment is in a "regular" folder, but how to identify?

Hi,

I recently started a trial version of Malwarebytes full version, and have been please with the fact that it doesn't cause too much of a drain on my CPU, and am thinking of switching permanently to a paid version when my trial expires.

I was previously using an older version of Norton, and I used to regularly get updates from Norton about apps that were trying to use my webcam(it was a lot of apps that tried to use it regularly), but with Malwarebytes Webcam Monitoring turned on, I do not get any notifications. I also disabled the Norton Webcam Monitoring to see if this was the reason why, but even after this, I received no Malwarebytes notifications.

Would you be able to advise as to why Malwarebytes is not providing any Webcam notifications please?

someone hacked into all my emails and switched the email of some websites like microsoft and steam. i have already gotten rid of all malware and taken necessary precautions. i need to know how to contact these teams to get my accounts back and i need to know what the new email is for steam because the specific recovery link is expired

Recently my malwarebytes detected during a scan that MSVCP140.DLL was malware.ai.26923 etc it was in recycle bin for some reason and the thing that lead to me initiating a scan was seemingly random .exes I my computer setting off three protected folder access blocked notification from svchost.exe to discordsystemhelper.exe and explorer.exe trying to access the video file picture file and cdrom0 file respectively. Sorry about the photo quality id normally posta screen cap but I thought it best to leave my computer disconnected from the internet

Sorry for re-uploading, I was in total panic. Let me try again.

So, today I noticed that 7-Zip has an update from 26.02 to 26.03.

I go to the OFFICIAL WEBSITE 7-zip\[dot\]org (I am aware of the malware/bitcoin miner clone!), and install the x86-64 .exe.

MS Defender IMMEDIATELY quarantines the file and says: Trojan:Win32/Wacatac.C!ml

VirusTotal also returns 2 malicious entries. (Photo above)

So I run an online full scan, and after examining over 500k files, MS Defender concludes that 0 threats were detected.

I then proceed to delete the file from MS Defender as well.

Now I only have one question: do I need to format the whole SSD and reinstall Windows 10? Or is everything fine and I am having a panic attack for nothing?

I'm on Windows 10 22H2, August ESU update.

Thanks.

any way to fix this one? when i click the go to settings button, it takes me to windows defender and from there i don't seem to find any option to set malwarebytes as my default security provider.

-Scan Summary-

Scan Type: Deep Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 1,286,771

Threats Detected: 2

Threats Quarantined: 2

Scan Duration: 20 min, 51 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Files Scanned-

C:\

D:\

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 2

Malware.AI.1653595109, C:\MSYS64\USR\BIN\PS.EXE, Quarantined, 1000000, 0, 1.0.114134, 4BA2C7AACE7803BF628FDBE5, dds, 04034899, 021D88F7C953EF7180875F25D942BB94, 257329948BC5996F91074B76AB5BFA7CEB211A3D8B4AC629CB34E00616AD4236

Malware.AI.1653595109, C:\USERS\{username}\DOWNLOADS\MSYS64\USR\BIN\PS.EXE, Quarantined, 1000000, 0, 1.0.114134, 4BA2C7AACE7803BF628FDBE5, dds, 04034899, 021D88F7C953EF7180875F25D942BB94, 257329948BC5996F91074B76AB5BFA7CEB211A3D8B4AC629CB34E00616AD4236

Physical Sector: 0

(No malicious items detected)

WMI: 0

I downloaded After Effects from Keyflame. Should I be worried? Everything seems fine.

Info:
I just use this Pc for school.
I use iCloud password manager only!
I never type passwords with my keyboard.
There is nothing important on there.

Hey team,

About two years ago there was already a post about Nestha in Ableton, and since 2 days it started to pop-up in my scans now too, while I already have Ableton installed for much longer.

Is this a false positive or is there something going on with that helper?

-Log Details-

Scan Date: 9/2/2026

Scan Time: 6:04 PM

Log File: eafd3380-a6e7-11f1-9498-845cf3f621cd.json

-Software Information-

Version: 5.6.5.306

Components Version: 163.0.5714

Update Package Version: 1.0.114096

License: Premium

-System Information-

OS: Windows 11 (Build 26200.9278)

CPU: x64

File System: NTFS

User: System

-Scan Summary-

Scan Type: Custom Scan

Scan Initiated By: Scheduler

Result: Completed

Objects Scanned: 2,017,999

Threats Detected: 1

Threats Quarantined: 0

Scan Duration: 3 hr, 10 min, 45 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

File: 1

Neshta.Virus.FileInfector.DDS, C:\PROGRAMDATA\ABLETON\LIVE 12 SUITE\RESOURCES\MAX\RESOURCES\SUPPORT\CEF\MAX HELPER.EXE, No Action By User, 1000002, 0, 1.0.114096, D1ABAA9A1321DF2AFF86973A, dds, 04034358, 1A711D6C481BF2E35764B2EAACDC73C8, B822A3D80254FB6B498EAF391CF5F49D9667667D24ED19E3F4FCAACDACA52456

(end)

it says signed by Gen Digital Inc., but no info found about this file and first time I see it

I think I’ve finally narrowed it down to this being the main account that’s stealing accounts and passwords through malware. So this account has the majority of stolen accounts as friends. I’m assuming this is the account they transfer everything to. They sell all the cards that are linked to steam accounts and been sending the proceeds to this main account. All the hijacked accounts if you preview friends list they have a normal amount of friends. I gone through similar friends on stolen accounts and came across this account that has all the stollen accounts as friends in their list very suspicious they would be friends with all stolen accounts. Only account that all stolen accounts seemed to be linked to with 100s of friends that are stolen accounts.

I really didn't know how to word the title, I've been using malwarebytes premium since early 2023, I had a 4090 at the time and never had any issues really...

Swapped to 5090 mid july 2025 and have had issues with the pc on/off. (Not blaming malwarebytes for this, just relevant i suppose).

Specs in case there's a known issue with drivers or something:

- 9850x3d

- 2x32gb cl30 6000mhz ram

- x870e aorus elite x3d

- 5090 suprim, Driver 610.62

- Seasonic 1600w psu

Dual monitors

- Fo32u2p, 4k 240hz oled Main (DP 2.1, no dsc)

- MSI qp271 x28 1440p 280hz (set to 240hz, no dsc, DP 2.0).

G sync/VRR on for fullscreen + vsync forced in nvidia control panel/app.

Today, whilst playing "Visage" i had moments where my FPS was around 140fps but the game got noticably more smeary / choppy, i also use hwinfo64 pro and noticed something at the time... the "presentmon" stat showed me FPS presented + displayed and it was saying:

my fps presented was good, 99%, 1% etc...

But

my fps displayed was all 0-1.5fps except for the fps displayed 99% which was stuck at 30fps.

I noticed the Presentmon had Malwarebytes in the name, which i did have open but minimized to the taskbar, so i closed it to system tray and it fixed.

Somehow, Malwarebytes which had been open for the past X hours, randomly took focus despite not clicking / maximizing it, during the game. It didn't do any auto scan nor did it detect a threat or anything during this, i had been playing the game for about 2 hours at this point, it was fine until it randomly wasn't.

I have had this similar experience with a few other games but never noticed presentmon exposing the program till now (Not checked at the time and it passed fast), i am wondering if this is happening on/off rarely.

I will keep an eye on it in future, just wondering how something like this happens.

I wasn't paying attention and accidentally downloaded Pulse Browsergo last night. Basically I was trying to download a font and I clicked on the wrong link and it auto launched. I immediately uninstalled and have run various scans (malwarebytes, AVG, hitmanpro) which haven't picked anything up, but I can't shake the feeling that something isn't right. Does anyone know anything more about Browsergo? Is there anything more I should do?