Msbuild trying to connect to gamorar.cc everyday

Question

Msbuild trying to connect to gamorar.cc everyday

czarnypolak 20

I tried to download some files from the net and i caught malware, did scans on malwarebytes etc and everything seemed fine, but latelly im getting bombed by notifications that PC is trying to connect to some shady sites (gamorar.cc) and its flagged as trojan, i got some links to FRST64, i want to avoid doing clean install of Windows if possible, but if theres nothing left to fix that I will do just that

https://gofile.io/d/EAHagN heres the link to the files
User's image

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

_AW_ 69,416 Volunteer Moderator

Save Fixlist.txt to your Downloads folder.
Close any apps with unsaved work.
Run FRST64English.exe and click "Fix".
The computer will reboot to complete the procedure.

Please upload Fixlog.txt so that the remainder of the infection can be removed.

czarnypolak 20 Reputation points

2026-07-13T05:35:39.8833333+00:00

https://gofile.io/d/dOWraV Theres the link, thank you in advance

_AW_ 69,416 Volunteer Moderator

That all looks good. To remove the rest, click Copy in the code box below, then run FRST64English and click Fix. FRST64 will read the instructions direct from the clipboard.

start::
2021-11-06 15:08 - 2021-11-06 15:08 - 009322303 ___RH [E5032AE3E4857463F376017D2F1736B8] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\AjaxMin.csproj
2021-11-06 15:08 - 2021-11-06 15:08 - 000203272 ___RH [ED0048103DDFBA23221DEE4EE945B774] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\AjaxMin.csproj.user
2021-11-06 15:08 - 2021-11-06 15:08 - 000168564 ___RH [02C61F60D598BE2363DDC680E5241BF2] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\AjaxMin.Shared.props
2021-11-06 15:08 - 2021-11-06 15:08 - 000000099 ___RH [1FCAE7AE625D861AC7655713C89EAE05] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\cache_6d599a.cfg
2021-11-06 15:08 - 2021-11-06 15:08 - 000000218 ___RH [9807A5E0810D03D4DBFC412B788B2207] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\cache_ac9828.log
2021-11-06 15:08 - 2021-11-06 15:08 - 000631356 ___RH [68042085BBC15BB106CC0C3D7BDE3D4D] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\Internal.targets
2021-11-06 15:08 - 2021-11-06 15:08 - 000000113 ___RH [793EA253651844322492F6741EB55813] () C:\Users\czarnypolak\AppData\Roaming\Microsoft\Protect\telemetry_f2.cache
end::

czarnypolak 20 Reputation points

2026-07-13T06:16:14.6566667+00:00

Thank you kind sir, i thought i gonna have to do a clean install!
_AW_ 69,416 Reputation points Volunteer Moderator

2026-07-13T06:18:10.27+00:00

You're welcome :)

To remove the Farbar scanner and its folders, rename it to uninstall.exe and run it. A reboot will be required.
YaBoiii MG 0 Reputation points

2026-07-13T12:45:38.9933333+00:00

Hey, @_AW_ ! I’m having the same exact problem. Could I send you my frst file? No rush at all! I’m at work right now myself but I can remote to my pc and get you that file whenever is convenient for you
_AW_ 69,416 Reputation points Volunteer Moderator

2026-07-13T12:57:13.66+00:00

That's fine, though I'll shortly be going offline for the night.
YaBoiii MG 0 Reputation points

2026-07-13T13:01:02.7633333+00:00

No worries! Should I have msbuild.exe running while I do the scan? I have it terminated for the time being
_AW_ 69,416 Reputation points Volunteer Moderator

2026-07-13T13:03:46.74+00:00

That's fine to leave it terminated.
YaBoiii MG 0 Reputation points

2026-07-13T13:14:34.89+00:00

Forgot I had yesterday’s scan on my phone already! Haven’t made any changes so should be the same
_AW_ 69,416 Reputation points Volunteer Moderator

2026-07-13T13:32:50.7066667+00:00

It looks like the active part has already been removed. The following folders likely came when the malware initially ran.

2026-07-12 11:46 - 2026-07-12 11:46 - 000000000 ____D C:\Users\mgera\AppData\Local\Yandex

2026-07-12 11:45 - 2026-07-12 11:45 - 000000000 ____D C:\Users\mgera\AppData\Roaming\webhook_utility

2026-07-12 11:45 - 2026-07-12 11:45 - 000000000 ____D C:\ProgramData\webhook_utility
YaBoiii MG 0 Reputation points

2026-07-13T13:35:49.7966667+00:00

Understood! I’ll take a close look at these when I have the time. Thank you so so much!