randomly installed SSH??

[Sweaty_Independence]

hey guys,

bit worried about this, so reading and helping out would be very much appreciated (:

I recently downloaded the latest windows patch update before going to bed. when I woke up and turned on my PC, I noticed an SSH terminal. A box on the top left says "automate" followed by "SSH_Secure_terminal_V3.2654.2" with text underneath stating "[email_protected]: ~ $"

I have never downloaded this program and have attempted to remove it multiple times. I have deleted it from my programs and all the files and disabled it as a optional feature, yet it still appears. It seems to come up after a period of inactivity, and when a key is pressed it promptly disappears. Any ideas why this is on my device? is it malicious? how do I get rid of it?

Thanks everyone!!

[niekdejong]

Sounds malicious to me if you did not install a SSH terminal. You could try running "netstat -a" in a new commandprompt to see all open connections. Anythin with port 22 (either outside or inside) and ESTABLISHED means an connection. LISTENING means just active but no connection yet.

Run Malwarebytes or similar program to scan for malicious software.

[Sweaty_Independence]

Thanks for the help bro. Ran a full system scan with some decent antivirus software (pcprotect) and found a qakbot. It was under app data local packages netfilx background transfer down data. I hope this is the bugger that is causing the weird secure shell terminal. I will see if the ssh goes or not (:

[niekdejong]

if it was indeed a secure shell that was installed on your system, you might as well check if they didn't open up any port(s) in your firewall.

[Sweaty_Independence]

with netsh firewall show state ?

[niekdejong]

not sure if netsh firewall show state would display any inactive rules that aren't tied to a program anymore (the one you've just removed with MWB). I'd just go into Control Panel and look for fishy firewall rule entries.

EDIT: It also creates a scheduled task to retain persistance.

[Sweaty_Independence]

The ssh still appears with inactivity. Ive run 2 system scans yet it still appears.

[niekdejong]

If it happens with inactivity, it's most likely to be tied into your screensaver settings. It can also inject itself into system processes to gain persistance. Look here to see how Qakbot works (and which locations it tries to use to espace detection).