Malware: Trojan:Win64/Lazy.PGLI!MTB keeps coming back even after removing

[chi21]

Every time I remove it, a quick scan shows up as clear. Then a popup appears, saying 'Another program is currently using this file', with the path as C:\ProgramData\data\Ome-Relay.exe. After, the quick scan detects the same Trojan:Win64/Lazy.PGLI!MTB again. I remove it again and the cycle repeats, with new timestamps every time.

Help please!
I attached my FRST scan and the Addition.

 

[Bot]

Every time I remove it, a quick scan shows up as clear. Then a popup appears, saying 'Another program is currently using this file', with the path as C:\ProgramData\data\Ome-Relay.exe. After, the quick scan detects the same Trojan:Win64/Lazy.PGLI!MTB again. I remove it again and the cycle repeats, w […]

Hi chi21. The changing timestamps and repeated appearance of C:\ProgramData\data\Ome-Relay.exe strongly suggest that another process, service, or scheduled task is recreating or relaunching the file. The “currently using this file” message means something has an open handle to it, but does not by itself identify the responsible process. A temporarily clean quick scan therefore does not mean the system is clean.

For now:

• Disconnect the PC from the internet and avoid email, banking, or other sensitive sign-ins on it.
• Keep Microsoft Defender enabled. Do not restore the detection, add an exclusion, or execute Ome-Relay.exe.
• Don’t manually delete suspected tasks/services or use an FRST fixlist.txt copied from another case—FRST fixes are machine-specific.
• Since you have attached the FRST and Addition logs, let the Malware Removal Assistance team inspect them and provide a tailored cleanup script. Avoid running additional cleanup tools meanwhile, as they can change the evidence or complicate the repair.
• Keep Defender’s Protection History intact so the helper can compare the latest detection time and affected item.

Microsoft describes this detection as a trojan capable of carrying out actions chosen by an attacker, so recurring execution should be treated as a genuine potential compromise until the persistence mechanism has been identified and removed (Microsoft Security Intelligence).

Sources

• Trojan:Win64/Lazy.PGLI!MTB

 

[chi21]

I think I may have found a suspicious exe called ZoneDispa that is only running in task manager when the virus is detected and gone when I remove the threat. It was created around the time the threat was first detected. Its path is C:\ProgramData, 112KB, and the only digital signature is an embedded signature with the name CHENGDU YIWO Tech Development Co., Ltd. Could someone let me know if this seems malicious? I ran it through Virus Total which came back as fine, but it still seems a bit weird.

 

[Dansharu]

I think ZoneDispa does indeed came with that Ome-Relay. After I look through Ome-Relay's folder which is "data", it created very recent and maybe around the time this virus got installed to my PC. I then deleted the "data" and the other suspicious folders that also created recently, including ZoneDispa. Still waiting if the pop-up will appear again or not.



Edit: The pop up no longer appear, I have been waiting for it around Ten minutes more while the pop up appear around 3 to 5 mins. I think it safe to assume those files I said were the reason.
Edit2: While looking for another suspicious file, I found another "data" folder that include XPFix.exe under [User > Username> AppData > Roaming] that I find it suspicious (created recently around the time I got the virus) so I deleted it too! And if there is RenPy folder while you never play any visual novel games that use RenPy engine, delete the folder too! (There is suspicious folder called "Game - ID" which a save folder from a game without a name, delete this "Game - ID" folder if you have other visual novel save files under RenPy folder so you don't have to delete the RenPy folder. If you don't care about RenPy folder then just delete the RenPy folder!)

 

[Dansharu]

I think ZoneDispa does indeed came with that Ome-Relay. After I look through Ome-Relay's folder which is "data", it created very recent and maybe around the time this virus got installed to my PC. I then deleted the "data" folder, including ZoneDispa. Still waiting if the pop-up will appear again or not

 

[Bot]

The lack of another pop-up is useful evidence that one of the deleted components was involved, but ten quiet minutes does not establish that the system is clean. It may only mean the visible payload has stopped while a scheduled task, service, or another stage remains.

Dansharu’s XPFix.exe finding is particularly concerning. CYFIRMA documented a DeerStealer infection chain that dropped an executable with that name and used it to establish a scheduled task. Their sample’s SHA-256 was:

5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146

A filename match alone does not prove that Dansharu had that exact sample—the reported folder also differs—but it is enough that I would treat the machine as potentially compromised rather than merely untidy.

Regarding chi21’s ZoneDispa: CHENGDU Yiwo is the company behind EaseUS; EaseUS confirms that publisher relationship. Therefore, that signature name is not inherently malicious. However:

• A signed legitimate component can be bundled into or abused by a malicious chain.
• Renaming a signed executable does not necessarily invalidate its embedded signature.
• A valid signature identifies the signed file’s publisher; it does not explain why that file appeared in C:\ProgramData and ran alongside the detection.
• A clean VirusTotal result is useful but not an acquittal—new or signed malware chains can initially receive few or no detections.

Please stop deleting folders merely because their names or timestamps look odd. In particular, %AppData%\Roaming\RenPy is commonly legitimate save/configuration storage for Ren’Py applications, and deleting Game - ID or the entire Ren’Py folder by name could simply destroy legitimate saves. Folder whack-a-mole is not a reliable cleanup method.

Both computers need to be handled separately:

• chi21: leave the attached FRST logs for the Malware Removal Assistance team to examine.
• Dansharu: open your own Malware Removal Assistance request with fresh FRST and Addition logs. Do not use any fix prepared for chi21’s machine.
• Keep each affected PC disconnected where practical and avoid signing into important accounts on it.
• Because suspicious executables were observed running, protect important accounts from a trusted device: change unique passwords beginning with email/password-manager accounts, revoke active sessions, enable MFA, and check email recovery details and forwarding rules. This is precautionary; the present evidence does not prove that credentials were stolen.

Do not restore or execute the deleted files to compare them. If a VirusTotal analysis link or SHA-256 was already saved, include that non-sensitive identifier in the relevant assistance thread.

Sources

• DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities - CYFIRMA
• Legal statement of EaseUS trademarks

 

[Dansharu]

I found another file which also has ANOTHER Ome-Relay.exe!!

I was checking again (really paranoid myself) through my Microsoft Defender and look at the History. Then, I look up the Malware source and found severals files and folders that also created the same time as when the Microsoft Defender detected the Malware.

For mine, the folder name is "w7hy7wOYCDTqesyu", it contain another Ome-Relay which can explain why that Ome-Relay pop-up appearing since two Ome-Relay seems to run at the same time. I don't know if it the same to you since its under Temporary files. Though I don't think its still active if we already did and delete what I said on my previous post.

I can't guarentee it will make our PC clean now, so if you feel unsafe you should reset/restart clean factory your PC.

 

[Dansharu]

I think this is the last one (not sure) from this Malware, I found two suspicious Scheduled Tasks that located just at the Drive and not inside Windows folder since the factory built-in systems usually located at Windows folder.

When I checked what does it do, BAM!! Both of it has a Scheduled Task to start a program which is Ome-Relay.exe!! Though it won't able to run it since I already deleted TWO Ome-Relay.exe

Besure to disable it first then delete the Scheduled Task!

 

[Bot]

Hi chi21 and Dansharu,

I went through chi21's Addition.txt and all the screenshots posted here. Between the two of you, the whole chain is now visible.

What the evidence shows​

• ZoneDispa.exe is the detected process, not a bystander. chi21's Addition.txt has seven Defender events on 23-10-2026 (22:03 to 23:26). Every one of them is Trojan:Win64/Lazy.PGLI!MTB with Process Name: C:\ProgramData\ZoneDispa.exe.
• Why VirusTotal says it is clean: the EXE itself carries a real EaseUS (CHENGDU YIWO) signature. This campaign drops a legitimate signed program into ProgramData next to its own files and lets that program load them, so the EXE scans clean while the running process gets flagged. The same pattern, with signed Tenorshare and PassMark EXEs and an XPFix.exe, was cleaned in this earlier Lazy.PGLI case.
• When it arrived: chi21's Explorer screenshot shows C:\ProgramData\data and ZoneDispa.exe both created at 23-10-2026 17:12. The Windows hosts file was changed later that same evening (19:58).
• Why it keeps coming back: Dansharu's Task Scheduler screenshots show two tasks in the root of the library that both run C:\ProgramData\data\Ome-Relay.exe:
  • connectorhost_v8 runs at every logon.
  • EncryptDocker_v3_arm runs daily and then repeats every few minutes.
  That repeating task explains the "Another program is currently using this file" popup every 3 to 5 minutes. It is also why deleting the files or letting Defender quarantine them never stuck: the tasks are still there, and something just keeps putting the files back.
• Likely source: chi21's installed programs and firewall rules show a DODI repack and games run from Downloads. A cracked game, repack or "DLC unlocker" downloaded on 23-10 is the most likely origin. Please don't run any of those installers again.

Note: only Addition.txt is attached. FRST.txt, the main log that lists services, tasks and startup entries, is missing. The fix below therefore targets only what is confirmed above.

chi21: FRST fix​

• Right-click FRST64 (in your Downloads folder) and select Run as administrator. If it asks to update, say yes.
• Highlight everything in the code box below and press Ctrl + C. FRST reads it from the clipboard, so you don't need to paste it anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
Powershell: Get-ScheduledTask | Where-Object { (($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join ' ') -match 'Ome-Relay|ZoneDispa|ProgramData\\data' } | ForEach-Object { Write-Output ('Removed task: ' + $_.TaskPath + $_.TaskName); Unregister-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -Confirm:$false }
C:\ProgramData\ZoneDispa.exe
C:\ProgramData\data
Hosts:
EmptyTemp:
End::

• Click Fix. The PC will restart. Afterwards, a Fixlog.txt will be on the desktop.

What each part does:

• The Powershell line removes only scheduled tasks whose action points to Ome-Relay, ZoneDispa or ProgramData\data, whatever random names they have on your PC. Fixlog will list each task it removed.
• The two paths below it remove the files Defender keeps detecting.
• Hosts: resets the hosts file, which was modified on the day of the infection.
• EmptyTemp: clears temporary files. It also removes cookies, so some websites will ask you to sign in again.

After the restart:

1. Leave the PC running for about 15 minutes. If the popup or a new Lazy.PGLI detection appears, write down the exact time.
2. Run a Microsoft Defender Offline scan: Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now.
3. Run FRST again and press Scan.

In your next reply, please attach:

• Fixlog.txt
• a fresh FRST.txt and Addition.txt (please check that both are attached)

Dansharu: your PC​

Good detective work on the two tasks. You found the actual persistence. Because your PC is a separate machine, nothing in the fixlist above applies to it. To finish:

1. Make sure connectorhost_v8 and EncryptDocker_v3_arm are deleted, not just disabled, in Task Scheduler → Task Scheduler Library.
2. In the same list, open copy_dlc_unlocker and the PlatformExperiencesHelper_... tasks, and check the path on the Actions tab. "DLC unlocker" tools are a common carrier for this kind of malware. If any of them points into ProgramData, AppData or a random-looking folder, post a screenshot. StartCN and StartDVR belong to AMD Radeon Software and can stay.
3. Your Recycle Bin screenshot shows that you also deleted C:\ProgramData\Realtek and C:\ProgramData\regid.1991-06.com.microsoft. Those are normal driver and Windows folders, so please restore those two from the Recycle Bin. Do not restore data, Ome-Relay or ZoneDispa.
4. Run a Microsoft Defender Offline scan.
5. For a proper check, open your own thread in this forum with fresh FRST.txt and Addition.txt logs.

For both of you: accounts​

Loaders like this one are often used to deliver password stealers, and XPFix.exe has been seen in a DeerStealer chain. Neither log proves anything was stolen. To be safe, though, from another device (a phone is fine):

• Change the passwords of accounts used in the browser on that PC, starting with email, then Microsoft, Steam, Roblox and Discord.
• Sign out all other sessions and turn on two-factor authentication.

Resetting Windows would remove the malware, but it does not undo stolen passwords or session cookies. That is why the account step matters either way.