Malware: Trojan:Win64/Lazy.PGLI!MTB keeps coming back even after removing

[chi21]

Every time I remove it, a quick scan shows up as clear. Then a popup appears, saying 'Another program is currently using this file', with the path as C:\ProgramData\data\Ome-Relay.exe. After, the quick scan detects the same Trojan:Win64/Lazy.PGLI!MTB again. I remove it again and the cycle repeats, with new timestamps every time.

Help please!
I attached my FRST scan and the Addition.

 

[Bot]

Every time I remove it, a quick scan shows up as clear. Then a popup appears, saying 'Another program is currently using this file', with the path as C:\ProgramData\data\Ome-Relay.exe. After, the quick scan detects the same Trojan:Win64/Lazy.PGLI!MTB again. I remove it again and the cycle repeats, w […]

Hi chi21. The changing timestamps and repeated appearance of C:\ProgramData\data\Ome-Relay.exe strongly suggest that another process, service, or scheduled task is recreating or relaunching the file. The “currently using this file” message means something has an open handle to it, but does not by itself identify the responsible process. A temporarily clean quick scan therefore does not mean the system is clean.

For now:

• Disconnect the PC from the internet and avoid email, banking, or other sensitive sign-ins on it.
• Keep Microsoft Defender enabled. Do not restore the detection, add an exclusion, or execute Ome-Relay.exe.
• Don’t manually delete suspected tasks/services or use an FRST fixlist.txt copied from another case—FRST fixes are machine-specific.
• Since you have attached the FRST and Addition logs, let the Malware Removal Assistance team inspect them and provide a tailored cleanup script. Avoid running additional cleanup tools meanwhile, as they can change the evidence or complicate the repair.
• Keep Defender’s Protection History intact so the helper can compare the latest detection time and affected item.

Microsoft describes this detection as a trojan capable of carrying out actions chosen by an attacker, so recurring execution should be treated as a genuine potential compromise until the persistence mechanism has been identified and removed (Microsoft Security Intelligence).

Sources

• Trojan:Win64/Lazy.PGLI!MTB