All Activity

@hake I am going to suggest you make the following change so Malwarebytes and Windows security(Defender) can work alongside each other to protect you. Please make the following change in Malwarebytes if you're using the Premium or Trial version Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the Security, or General in V5 tab. Then turn off "Always register Malwarebytes in the Windows Security Center" Restart the computer

Your requested copy of mbst-grab-results.zip is attached. mbst-grab-results.zip

I don't know if it's a coincidence but after installing this extension which has more than 4 million installations, I found my Facebook broken and I have 2-factor validation on Facebook so it's impossible that someone could have entered in any other way.

i'm sorry but should i run scans and run it in advanced mode or just follow the steps you mentioned

Hello, The block will be removed. Thank you!

It was blocked because of RDP attacks that happened in the past, it was old block. Since there were not recent attacks reported IP address is clean and safe now. Have a great day!

Thank you for the log @alpalacio01 Please run the following and I'll check back on you tomorrow. It's past midnight for me Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop. (Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021) Download: Kaspersky Virus Removal Tool https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe How to run a scan with Kaspersky Virus Removal Tool 2020 https://support.kaspersky.com/15674 How to run Kaspersky Virus Removal Tool 2020 in the advanced mode https://support.kaspersky.com/15680 How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan https://support.kaspersky.com/15681 Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you

Hello, The block has been removed and the domain is accessible. Thank you

Ufile.io/200pn909 Logs after run live system

Seems to work now actually, I forced an update: So that's good. But, do you have any more information I could provide to our customer as to why this happened and how you resolved the issue on your end? And maybe most importantly, should we expect other similar anti-virus programs to give us a block as well?

Hello, The block will be removed. Thank you!

Thank you, how long should I expect to wait before we see an effect? Still getting the block, and I believe I have an update installation of Malwarebytes

Hello, The domain is legitimately blocked due to the malvertising links related to it. http://link.space/@vikaxx?of=9148 https://link.space/@Girlsnearbyy?fbclid=PAAabOHlIq0fSXk328oE3ooC2PkjOzAJbengALHAo2askVcMBvjGkI5Vh8kgI_aem_AcmbR7rZvk85upD-RLed0PEutyjNVmoIn1indjwBCwUCRvx9wHMotCOUSeu8Mv47x68 ETC.. Thank you

Hello, The block will be removed. Thank you!

Hello, The block will be removed and the domain will be added to the Whitelist. Sorry for the inconvenience!

I asked for that file since the hash of the scheduled task on VT seemed to call that executable https://www.virustotal.com/gui/file/a8d9ead432f952fb686324e764e9568a50df6c24469b27252f50adee01c1ba72 <Command>C:\Windows\Microsoft.NET\Framework\v3.5\mscorsvw.exe</Command> <WorkingDirectory>C:\Windows\Microsoft.NET\Framework\v3.5</WorkingDirectory> <Arguments>-pool us1.ethermine.org:4444 -pool2 us2.ethermine.org:4444 -wal 0x4F0e95dC520AA6d96B20c594e87285994C94A82B.MyRig -proto 3</Arguments> Would be nice for us to have the file that the scheduled task is calling.

Here are the Farbar files, I can submit the logs of my adwcleaner and Malwarebytes scans but I have done multiple of each prior to messaging you in addition to the steps above. Addition.txt FRST.txt

I'm not really sure myself. I don't use Google Chrome and certainly don't sync ANY browser period. It makes things easy but you run into issues like this all the time where you end up fighting clean up and infecting other devices with junk and unwanted objects. You might be able to search online to see what the expected behavior is.

Please run a new scan with AutoRuns and save the file and attach

@alpalacio01 Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Then be patient for the next expert to take your case. Thank you

Please run the requested scans @rehabsnu and post back the logs

Thank you for the log it found one issue and corrected. Please run the following Please download and run the following Kaspersky Virus Removal Tool 2020 and save it to your Desktop. (Kaspersky Virus Removal Tool version 20.0.10.0 was released on November 9, 2021) Download: Kaspersky Virus Removal Tool https://devbuilds.s.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe How to run a scan with Kaspersky Virus Removal Tool 2020 https://support.kaspersky.com/15674 How to run Kaspersky Virus Removal Tool 2020 in the advanced mode https://support.kaspersky.com/15680 How to restore a file removed during Kaspersky Virus Removal Tool 2020 scan https://support.kaspersky.com/15681 Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\{your user name}\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20210123_113021.klr Right-click direct onto that report, select > open with > Notepad. Save that file and attach it to your reply. To start the scan select OK in the "Run" box. A EULA window will open, tick all confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed... Thank you

For the past hour an a half there has been an attempt at opening malicious websites every 2 or so minutes. They are getting blocked by Malwarebytes which is good but the issue is seemingly undetectable by Malwarebytes. Is there a way for me to fix this?

Thank you for the log. No issues found. The other scanner may have removed the issue. Please run the following Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: If you have not done so already - Enable System Protection and create a NEW System Restore Point Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Show-Hidden-Folders-Files-Extensions Please run the following scans: Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Thank you

Hi We have 2 different screenshots The last one may be error from VPN ? Kind regards Flemming