Guest E.P. Posted June 15 Share Posted June 15 I got a random detection warning inside the windows files Log C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\15ffc5d9-25b2-4a9d-8b1c-4b49e14e95e4\content.bin » ZIP » GamingServicesTcui-Package_13.78.12002.0_x64.appx » ZIP » gamingservicestcui/presentationcore.dll - ML/Augur trojan - deleted (after the next restart) [2] The warning informed me that it was unable to clean it automatically and prompted me to choose an action. I impulsively clicked on delete and confirmed my choice. It then told me to restart the computer in order to complete the deletion. (The posted above log was copied after the restart from logs). The "GamingServicesTcui" part seems pretty legit to my untrained eye so my question is whether or not this was a false positive, and if yes, was it harmful that I deleted the detection. If it was not a false positive, do I need to worry and change all passwords, since it might've dealt dmg/stolen info/tokens before it was detected and deleted. PS: I downloaded a game yesterday, that has been around for less than 2 months from Steam, and since the detection is in some kind of "gaming" file, could it be from it? I also deleted some of the Windows "stock" gaming related apps like Xbox-something or at least the ones Windows allowed me to delete a few days ago, if that adds any valuable info regarding this matter. PS 2: I found the log in the Computer scan section and the scanned folder name was "Idle-state scanning" (after clicking on this, I filtered for only the "warnings" and "critical") Thanks in advance for the time taken to read and respond to this. Have a good one! Link to comment
Administrators Marcos 4,838 Posted June 15 Administrators Share Posted June 15 Please provide logs collected with ESET Log Collector. Link to comment
Guest E.P. Posted June 15 Share Posted June 15 Should I collect all logs, and if yes, should I protect them with password? Could the logs be used maliciously against me in any way? Do they have sensitive/personal/identifiable info? Link to comment
Guest E.P. Posted June 15 Share Posted June 15 1 hour ago, Marcos said: Please provide logs collected with ESET Log Collector. Should I collect all logs, and if yes, should I protect them with password? Could the logs be used maliciously against me in any way? Do they have sensitive/personal/identifiable info? Link to comment
Administrators Marcos 4,838 Posted June 15 Administrators Share Posted June 15 Default set of logs is ok. Just in case, also select bigger quarantined files to collect. Link to comment
Guest E.P. Posted June 15 Share Posted June 15 18 minutes ago, Marcos said: Default set of logs is ok. Just in case, also select bigger quarantined files to collect. How and where do I send the zip? Link to comment
Administrators Marcos 4,838 Posted June 15 Administrators Share Posted June 15 You can upload the logs here unless too big. Only ESET staff can access attachments. Link to comment
Guest E.P. Posted June 15 Share Posted June 15 1 hour ago, Marcos said: You can upload the logs here unless too big. Only ESET staff can access attachments. How do I send attachments here? The only option I see is the insert image from URL, but I can't use that. Link to comment
Guest E.P. Posted June 15 Share Posted June 15 1 hour ago, Marcos said: You can upload the logs here unless too big. Only ESET staff can access attachments. How do I send an attachment here? Link to comment
itman 1,594 Posted June 15 Share Posted June 15 2 hours ago, Guest E.P. said: How do I send an attachment here? Link to comment
Guest E.P. Posted June 15 Share Posted June 15 1 hour ago, itman said: I do not have that option. I can only "insert image from URL". Would you like me to send it to you via email instead? Maybe cuz I'm guest? Idk. Link to comment
itman 1,594 Posted June 15 Share Posted June 15 1 minute ago, Guest E.P. said: Maybe cuz I'm guest? Idk. That might be the reason. You can upload the zipped logs folder to a file sharing web site. Then Private Message @Marcos with provided access link, etc. to download the file. Link to comment
Administrators Marcos 4,838 Posted June 15 Administrators Share Posted June 15 It's likely because you have posted as a guest without logging in first. Please sign up for this forum, re-post in the appropriate product forum and enclose a link to this topic. Link to comment
Recommended Posts