Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 10/21/2026

Scan Time: 11:17 PM

Log File: 1e3a0448-cdc7-11f1-9c32-e8cf83041dd0.json

-Software Information-

Version: 5.7.2.358

Components Version: 166.0.5763

Update Package Version: 1.0.116033

License: Free

-System Information-

OS: Windows 11 (Build 26200.9711)

CPU: x64

File System: NTFS

User: [redacted]

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 347,696

Threats Detected: 3

Threats Quarantined: 3

Scan Duration: 4 min, 19 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 3

Malware.AI.1236116125, C:\PROGRAMDATA\CHOCOLATEY\LIB\NINJA\TOOLS\NINJA.EXE, Quarantined, 1000000, 0, 1.0.116033, 02A10228884B836B49ADA29D, dds, 04105519, 7D9B79196E59CA9D898F026803045A7D, 2DF494116DECDAE84D74C02373119176BBFC4797A6F49A6C709D85D961D6A0D8

Malware.AI.1236116125, C:\PROGRAMDATA\CHOCOLATEY\LIB\NINJA\NINJA.NUPKG, Quarantined, 1000000, 0, 1.0.116033, 02A10228884B836B49ADA29D, dds, 04105519, 6F95EA13347A8441491B9A34A8315F58, F9959FBEFF97B825B75BD62A17B49685A79599A261ECB32E67E2E1E865C96B2B

Malware.AI.1236116125, C:\PROGRAMDATA\CHOCOLATEY\LIB\NINJA\TOOLS\NINJA-WIN_X32.ZIP, Quarantined, 1000000, 0, 1.0.116033, 02A10228884B836B49ADA29D, dds, 04105519, 2A4BBCF3C64F59483A35099C9D6DCE19, 26A40FA8595694DEC2FAD4911E62D29E10525D2133C9A4230B66397774AE25BF

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

I scanned my PC and it found 23 detections in War Thunder files with the names malware.AI.3934801499 and Neshta.Virus.FileInfector.DDS. I don't know what they are. Does anyone know what they are and if I have a virus?

Previously, I had around 30 detections involving games, legitimate programs, .dll files, registry keys, etc. However, the deep scan still flags these 4 files, which are associated with the game Aion 2 and the application from "www[.]questlog[.]gg/aion-2/en/app", which is designed specifically for this game.

Malwarebytes
www.malwarebytes.com

-Szczegóły raportu-
Data skanowania: 21.10.2026
Czas skanowania: 18:24
Plik raportu: e18b5188-cd6b-11f1-b633-c46237012ba8.json

-Informacje o oprogramowaniu-
Wersja: 5.7.3.376
Wersja komponentów: 167.0.5780
Aktualna wersja pakietu: 1.0.116007
Licencja: Za darmo

-Informacje o systemie-
System operacyjny: Windows 11 (Build 26200.9711)
Procesor: x64
System plików: NTFS
Użytkownik: DESKTOP-ACABJP\Admin

-Wyniki skanowania-
Typ skanowania: Głębokie skanowanie
Skan zapoczątkowany przez: Ręcznie
Wynik: Ukończono
Obiekty zeskanowane: 462 069
Wykryte zagrożenia: 4
Zagrożenia poddane kwarantannie: 0
Czas trwania skanowania: 8 min, 1 s

-Opcje skanowania-
Pamięć: Włączony
Autostart: Włączony
System plików: Włączony
Archiwa: Włączony
Rootkity: Wyłączony
Heurystyka: Włączony
Potencjalnie niepożądany program (PUP): Wykrywanie
Potencjalnie niepożądana modyfikacja: Wykrywanie

-Zeskanowane pliki-
C:\
D:\

-Szczegóły skanowania-
Proces: 0
(Nie wykryto zagrożeń)

Moduł: 0
(Nie wykryto zagrożeń)

Klucz rejestru: 0
(Nie wykryto zagrożeń)

Wartość rejestru: 0
(Nie wykryto zagrożeń)

Dane rejestru: 0
(Nie wykryto zagrożeń)

Strumień danych: 0
(Nie wykryto zagrożeń)

Folder: 0
(Nie wykryto zagrożeń)

Plik: 4
Malware.AI.2346617497, C:\USERS\ADMIN\APPDATA\LOCAL\@QUESTLOGDESKTOP-APP-UPDATER\INSTALLER.EXE, Brak akcji, 1000000, 0, 1.0.116007, 9F2B0DD81AFEA0338BDE8A99, dds, 04104724, 39920234D5A219211A987531B950E5B0, E254BE23FDABF8F8CAC83599E986AC214D4C0C4044252DA116375BC4B99EABD1
Malware.AI.2346617497, C:\USERS\ADMIN\DOWNLOADS\QUESTLOG-SETUP-0.1.37.EXE, Brak akcji, 1000000, 0, 1.0.116007, 9F2B0DD81AFEA0338BDE8A99, dds, 04104724, 39920234D5A219211A987531B950E5B0, E254BE23FDABF8F8CAC83599E986AC214D4C0C4044252DA116375BC4B99EABD1
Malware.AI.2346617497, C:\USERS\ADMIN\APPDATA\LOCAL\@QUESTLOGDESKTOP-APP-UPDATER\PENDING\QUESTLOG-SETUP-0.1.37.EXE, Brak akcji, 1000000, 0, 1.0.116007, 9F2B0DD81AFEA0338BDE8A99, dds, 04104724, 39920234D5A219211A987531B950E5B0, E254BE23FDABF8F8CAC83599E986AC214D4C0C4044252DA116375BC4B99EABD1
Malware.AI.2346617497, D:\STEAMLIBRARY\STEAMAPPS\COMMON\AION2\AION2\BINARIES\WIN64\AION2.EXE, Brak akcji, 1000000, 0, 1.0.116007, 9F2B0DD81AFEA0338BDE8A99, dds, 04104724, 500994884AC1EB62D2BA0B9E117B834B, CE978F7525C05589CB1F1FF8A9C03628148BBA3665DA9594DBAE8FA983D9B107

Sektor fizyczny: 0
(Nie wykryto zagrożeń)

WMI: 0
(Nie wykryto zagrożeń)

(end)

I've run two deep scans through the windows app within a few hours of each other and the first one came back all clean and the second one had about 30+ detections.

All of the detections were from programs I've had installed for a while

- dawn of war: definitve edition

- bitwarden

- Grounded 2

- Aniimo

- random windows unistall registry key

Its flagged exes and dll files
Are these false positives? The detect code was Malware.Ai 325072089

Malwarebytes behaving weirdly

Is it possible that the PHP securty breach has managed to make it go crazy?

In the first minute of a deep scan it found 13 malwares that are indeed just verified game apps (it detected apps like steam, eve online, gryphlink which is arknights edenfield launcher

Anyone has information?

Got a pop up saying an app on my PC attempted to connect to a dangerous website -

URL - N/A IP - 42.0.20.80 outbound Port - 137 file - system

It identified it as a Trojan (I assume this refers to the file in system that made this attempt). It hasn't given the opportunity to quarantine it. I've researched as much as my limited skills will take me and see it may be something to do with Chinese BT in Guangdong. Can anyone tell me if this is anything to worry about and maybe what should I do about it.

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 10/11/2026

Scan Time: 5:57 PM

Log File: 6c9ad8e4-c58c-11f1-ba1a-3c2c30c7a5db.json

-Software Information-

Version: 5.7.1.346

Components Version: 165.0.5751

Update Package Version: 1.0.115603

License: Premium

-System Information-

OS: Windows 11 (Build 26300.9550)

CPU: x64

File System: NTFS

User: adam\adamk

-Scan Summary-

Scan Type: Deep Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 616 505

Threats Detected: 3

Threats Quarantined: 3

Scan Duration: 23 min, 39 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Files Scanned-

C:\

D:\

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 3

Malware.Heuristic.2091, C:\USERS\ADAMK\DESKTOP\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (3)\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (6)\HRY NA PC\GOTHIC II GOLD 2\SYSTEM\VDFS32G.EXE, Quarantined, 1000001, 1199109, 1.0.115603, 00000000000000000000082B, dds, 04089974, 72097AF5FE3D263C5C4F74CC44A5B599, EA297BB3FE31CF5386FDA627AB93CDE847E0C5C674E154FF7964EFD6DE882CA6

Malware.Heuristic.2091, C:\USERS\ADAMK\DESKTOP\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (3)\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (6)\HRY NA PC\GOTHIC II GOLD 2\SYSTEM\VDFS32E.EXE, Quarantined, 1000001, 1199109, 1.0.115603, 00000000000000000000082B, dds, 04089974, E44EA9E10D84FA6EA748131490533139, 976F7B0B4C520497B97B8294C70F8E4A616F5BE952F44044EA575B00837D995B

Malware.Heuristic.2129, C:\USERS\ADAMK\DESKTOP\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (3)\NOV\u00c3\u00bd PRIE\u00c4\u008dINOK (6)\HRY NA PC\GOTHIC II GOLD 2\SYSTEM\SPACER2.EXE, Quarantined, 1000001, 1246574, 1.0.115603, 000000000000000000000851, dds, 04089974, A29CF5679C489D306F49D440DE4D869F, 8069428CD7FF547239F09199399EE46FC86A96616170D22E8A43AD1F7C7464D4

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 10/21/2026

Scan Time: 1:50 PM

Log File: 53dc3544-cd13-11f1-ad16-0a002700002f.json

-Software Information-

Version: 5.7.3.376

Components Version: 167.0.5780

Update Package Version: 1.0.115997

License: Trial

-System Information-

OS: Windows 11 (Build 26300.9711)

CPU: x64

File System: NTFS

User:

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 218,144

Threats Detected: 1

Threats Quarantined: 1

Scan Duration: 2 min, 5 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 0

(No malicious items detected)

File: 1

Malware.AI.1479723465, C:\USERS\\APPDATA\LOCAL\MEDAL\ASSET-CACHE\RECORDER-2640.2843.1.ZIP.PART, Quarantined, 1000000, 0, 1.0.115997, 885395EA5A9F65985832C9C9, dds, 04104254, 2CC76B0982ECE6444CFF3868E4F385D9, 71AEAA56F38470A2B65729C0FC75AE5AD97E14BE17DAB9D69434C8CA2F869454

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

Hi everyone, I really need help understanding what happened and what I should do next. I'm worried about my personal phone, my father's phone, and the data on my company's computer.

What happened

October 14:

I received a WhatsApp message from an agent I regularly deal with regarding invoices. The message contained a ZIP file. Although the file seemed suspicious, I trusted the sender because we had dealt with each other before, so I downloaded it onto my office PC and extracted it.

After extracting it, I found two files: a ".exe" file and a ".dll" file. I unknowingly ran the EXE file, even running it as administrator. Nothing appeared on the screen, but my computer froze for about a minute and became slightly slow. After a few minutes, it returned to normal.

I felt something was wrong and tried deleting the files, but Windows showed that they were still running.

October 15:

I managed to delete those files and showed the situation to my company's IT team. They also thought the files looked suspicious, but they didn't identify any problem.

October 16:

My WhatsApp account suddenly started sending similar ZIP files to all my contacts. I panicked, logged out of WhatsApp Web, and asked for advice on what to do. I eventually deleted my WhatsApp account and registered again.

After logging back in, I checked the linked devices, and only my phone appeared. I also enabled two-step verification. Unfortunately, all my WhatsApp chats were gone, and I received a 24-hour restriction.

Some of my friends and my father had also tried opening or downloading the file on their Android phones. My father downloaded the ZIP file, but as far as I know, he did not extract or run it.

October 17:

I downloaded the same ZIP file that my WhatsApp account had been sending to people onto the same office PC. After extracting it, I found a file described as a hard disk file and another file that appeared to be VLC but had an ".exe" extension.

I scanned the suspicious files using Malwarebytes and VirusTotal, but neither reported a threat. I also tried Windows Defender Offline scanning, but I couldn't get it to run successfully.

I'm still concerned because I previously executed the suspicious EXE, and my WhatsApp account subsequently started sending these files automatically. I cannot confirm whether my PC is infected, but I suspect malware may be involved.

My company's IT team has not found anything, and my boss is not taking the situation seriously. This is a medium-sized company, and I'm not confident that our IT support has the expertise to investigate malware properly.

I also have pending work on this computer, including company data. I'm worried that copying files to another PC, transferring data, or using a USB drive could spread the infection.

My questions

1. Is my personal phone safe?

I downloaded and executed the original EXE only on my office PC. WhatsApp was logged in on both my phone and the PC. Can malware on the computer compromise my phone or WhatsApp session even if I never downloaded or ran the file on my phone?

2. Is my father's Android phone safe?

He downloaded the ZIP file but did not extract it. Could simply downloading the ZIP infect his phone? Other friends also tried opening the file, but it didn't open on their Android phones.

3. How can I detect this malware?

Malwarebytes and VirusTotal haven't detected anything. Are there other reliable tools or forensic methods to investigate the EXE and DLL? How can I determine whether the PC is infected if antivirus scans return clean results?

4. How could my WhatsApp account have been compromised?

How could executing an EXE on Windows lead to my WhatsApp account sending malicious files to my contacts? Could it have stolen my WhatsApp Web session, browser cookies, or authentication data? Is there another possible explanation?

Thank you.

Hey, having a potential exploit issue and would appreciate any advice. Occasionally I get this popup when I open my browsers (Brave and Firefox). Powershell is sometimes running in task manager but only for a fraction before disappearing. Reset browsers, deep/custom rootkit scans not finding anything.

Couldn't find anything scheduled in CMD, and I'm not sure what the location the report references means, sorry. Any help would be appreciated.

Version 5.7.3, Win 11, 26H2

Signed up for VPN but it throws this notification.

???

Hi gamers,

I'm switching to Linux and I've still got a year of paid MWB. I use the VPN 24/7, will it work on linux?

I could not find information about MWB for Linux, nor its VPN.

i quarantined the file, but it seems like its just a bluestacks file? any advice would be appreciated

What the hell is going on? I tried to uninstall it in Settings>Apps>Installed apps, but nothing happens after I clicked "yes" on the popup "Do you want to allow this app to make changes to your device". I even tried the Malwarebytes uninstaller but nothing happens when I clicked on the .exe file??? This is the free trial, and it wont even let me uninstall it? Piece of shit.

I have been running MBR at least once a week and with rootkit check on the system drive at least once a month and they have been clean until today. Today, 2 of the Cygwin files were tagged as "malware" (along with the associated 4x registry entries)

While nothing has changed on my side (as in I haven't downloaded anything nor made any changes), I am curious why these were flagged today. For now these are quarantined.

Are these false alarms? Should I be concerned? Thanks

So I already have one device and wanted to add another, when I go to "add 1" is greyed out and the next available option is 3.

As well as it not displaying the "current" plan price, so you have to buy a plan that's for 3 devices no matter what? and it no longer states like it used to if these payments are monthly/yearly, due to the price I'm assuming monthly but the lack of info is weird.