Jump to content

Multiple restarts due to cleaning


Go to solution Solved by Kiwifruit,

Recommended Posts

Hi, I've seen others with this issue but no solution seems to work for my installation. When I start or reboot my Windows 11 PC I get multiple popup's asking me to restart to complete the cleaning process. I do this but the next time all the same popup messages appear again. I have attached the log file for this. - Thanks in advance for any help.

ESET-Internet-Security-Log.txt

Link to comment
Share on other sites

  • Administrators

It is probably some php files where ESET detects PHP/Agent.VQ upon create by ZohoWorkDriveTS which seems to be an alternative to Google Drive for desktop.

It is not clear what are the files like D:\ZohoWorkDriveTS_15214227173253408199101426494295781001\.~$zstmp\Dno1y00967e349b4bf4e1f8ea8e48422f80a5e;kxltr97ca298838e74620a03135297a113d93~, whether C:\Program Files (x86)\Zoho\ZohoWorkDriveTS\bin\ZohoTS.exe creates them them because there are some PHP files being synced or they are some auxiliary files needed during sync by ZohoTS.exe.

Please provide logs collected with ESET Log Collector and make sure to collect quarantined files.

Link to comment
Share on other sites

Hi Marcos, I have attached the log but unsure if I included the quarantined files. I was unable to find a checkbox for them. Cheers, David.

eis_logs.zip

Link to comment
Share on other sites

  • Administrators

Do you recognize this code which is highly suspicious? If not, it's very likely malicious and the detection is correct. If you think it's legit and you use it on purpose, could you provide more details on how it is used?

image.png

Link to comment
Share on other sites

  • Solution

Hi Marcos, I discovered it was from a compromised website that had been stored on the Zoho Workdrive and set to sync with my PC. I removed it from the sync list and the problem has been solved. Thank you for your valuable assistance. David.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...