Script from nowhere. Help Needed

Discussion in 'Scripting' started by jindogae, Jan 6, 2019.

  1. jindogae

    jindogae MDL Novice

    Jan 5, 2019
    3
    1
    0
    I'm new to this site so not sure if this is the correct place to post this.
    After attempting to (re)activate office 2013 ProPlus on a Win10 X64 system a command prompt keeps appearing on every system boot.
    [​IMG]
    I have no idea where it comes from or how it suddenly appeared, and I have no idea of how to stop (delete) it from happening.
    The top of the prompt says bhrudwfi while the path refers to an exe file, sqwbsrtb.exe. When it first appeared it was considered a trojan by HitmanPro and has supposedly been deleted but as indicated the prompt appears on every reboot.
    Any thoughts, ideas, suggestions are welcomed.
    Cheers.
     
  2. boyonthebus

    boyonthebus MDL Expert

    Sep 16, 2018
    1,168
    752
    60
    What did you use for your activation? Some strange file from a warez site?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. jindogae

    jindogae MDL Novice

    Jan 5, 2019
    3
    1
    0
    MSToolkit, which I've used in the past without any issues.
     
  4. Sajjo

    Sajjo MDL Member

    Feb 6, 2018
    2,252
    3,260
    90
    #4 Sajjo, Jan 6, 2019
    Last edited: Jan 6, 2019
    Post SHA-1 of your Office 2013 install image, if you didn't use an activator my guess is you used a non-genuine image slipstreamed with xtra "tools"
    :)
    Valid sha-1 of recent and latest Microsoft Toolkit
    d27c2bf4df12d7d2b662dc9e0a3cc9645ebf1e2e *MTKV261.exe
    63a19d4e6a2a51b3ec965caa01216a240899d0e4 *MTKV262.exe
    c422fe44f61b234235e1bed793aefa88826275d6 *MTKV263.exe
    2b6d05f9cde75049414433994ab5482c2795086d *MTKV264.exe
     
  5. jindogae

    jindogae MDL Novice

    Jan 5, 2019
    3
    1
    0
    Hi. I used Microsoft Toolkit 2.5 which I've used for several years on both mine and my daughters' systems. And have been running Office 2013 since it's inception without any issues until now when it took at least a dozen attempts to (re)activate Office.

    I have looked for a 'clean' copy of the ltests toolkit but without success, and I believe it is no longer being developed.
     
  6. Sajjo

    Sajjo MDL Member

    Feb 6, 2018
    2,252
    3,260
    90
    #6 Sajjo, Jan 6, 2019
    Last edited: Jan 6, 2019
    5671c239b85ec01c33c4eb155caa0dfa6c57e509 *MTKV250.exe
    Latest and recommended (if you like to use Microsoft Toolkit):
    2b6d05f9cde75049414433994ab5482c2795086d *MTKV264.exe

    Keep in mind:

    Create AV engine exception rule for above tool and use "Settings -> LocalHost Bypass -> Use TAP Adapter"
     
  7. tommy_vercetti

    tommy_vercetti MDL Member

    Apr 3, 2008
    158
    17
    10
    Also run Malwarebytes to check for any malware on your system
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...