MSBuild.exe contacting gamorar.cc every 10 minutes Need FRST Fixlist

Question

MSBuild.exe contacting gamorar.cc every 10 minutes Need FRST Fixlist

Emanuele Gioè 20

Hello, MalwareBytes keeps blocking connections from MSBuild.exe to gamorar.cc every 10 minutes. Regular antivirus scans show nothing. I have ran Farbar Recovery Scan Tool (FRST) as suggested in similar threads.

Here is the link to my FRST and Addition logs: https://drive.google.com/drive/folders/1qbEJX-vNHi4IxaNaHlO5LRlR7Rnez8wv?usp=sharing

Could an expert review these .txt files and provide a Fixlist.txt to remove this threat?

Thanks in advance to whoever may help me!

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Ramesh 181.6K Volunteer Moderator

Please run the fixlist below.

Download fixlist.txt
Save Fixlist.txt to the same folder as FRST64English.exe.
Close all programs.
Launch the Farbar Scanner tool and click "Fix".
Restart Windows if prompted.
Upload the output log file (FixLog.txt) in your next reply.

NOTE: The fixlist.txt script was written specifically for this user and for use on that particular machine. It is not recommended to run it on another machine, and don't run the same fixlist.txt more than once.

Sung Kim 0 Reputation points

2026-07-12T23:10:51.0833333+00:00

Yo this is completely unrelated to this question, but your answer to an NET 3.5 question years ago helped my ass so much. Saved me at least 10 more minutes of suffering. I gotta say you are a hero and bless you lmao.
Ramesh 181.6K Reputation points Volunteer Moderator

2026-07-13T03:11:50.5633333+00:00

You're welcome @Sung Kim
Emanuele Gioè 20 Reputation points

2026-07-13T15:13:54.85+00:00

Hello again and thanks for your time, here is the fixlog.txt

I did as requested in your answer.

https://drive.google.com/drive/folders/1baob_TmjVfAR8Lwnv0aOVgLtyzB-X-wJ?usp=sharing
Ramesh 181.6K Reputation points Volunteer Moderator

2026-07-13T15:59:40.66+00:00

Do you still get the MSBuild.exe notification?
Emanuele Gioè 20 Reputation points

2026-07-13T16:01:33.63+00:00

No I dont. I have MalwareBytes opened right now and the notification doesn't appear anymore.
Ramesh 181.6K Reputation points Volunteer Moderator

2026-07-13T16:10:52.44+00:00
Great. The fixlist disabled an unknown service named "WOW21_Service".

If you don't recognize it, delete the service by running the following command:

sc.exe delete WOW21_Service

Then, delete or rename the following directory.

C:\Program Files\WOW21
Emanuele Gioè 20 Reputation points

2026-07-13T16:16:43.4+00:00

Alright, I did that. Thanks again for the much needed help!
Ramesh 181.6K Reputation points Volunteer Moderator

2026-07-13T16:18:02.2133333+00:00

You're welcome!

Ramesh 181.6K Volunteer Moderator

Additional note:

Turn off Malwarebytes temporarily so that Defender enables itself.

Then, delete all of the following exclusions in Defender.

C:\Program Files\WOW21
C:\Windows\TEMP\ErgSSFAH3NpS7
C:\Windows\TEMP\ErgSSFAH3NpS7\motore.cmd
C:\Program Files\WOW21\WOW21_Service.exe
SppExtComObjHook.dll
C:\Users\Computer\AppData\Local\Nova
Z:\Giochi\Crimson Desert
Z:\qBit torrent\Crimson Desert [DODI Repack]
Z:\qBit torrent\Crimson Desert

Once done, re-enable Malwarebytes if you plan to use it.