CarlIdaho

Thank you, Devin Collins, for such quick action on this. When I started my computer this morning I received no notifications about riskware in NordVPN. I even changed servers a couple of times and there were no notifications associated with that activity as well. Carl

For the past day, Malwarebytes has been blocking a portion of NordVPN.com because of "Riskware". More specifically, it is blocking outgoing communication with "applytics.zwyr157wwiu6eior.com". The alert will show a few times when NordVPN is connecting to a server and then it will not alert again until I am connecting to a new/different VPN server. As far as I can tell, NordVPN has not updated recently so nothing should have changed in the nordvpn.com file. Can help me understand what's going on here? I've attached the log files. Carl mbst-grab-results.zip

Avast and Malwarebytes have been running side by side with no problems at all. I was hoping that by disabling the Avast Shields that I would be able to try out Defender Antivirus. It looks like I'm going to have to uninstall Avast completely to give Defender Antivirus a try. Thank you for your help, @dcollins

@dcollins, I expanded the Security and Viewed installed antivirus apps. Avast is listed as "Snoozed" and Windows Defender Antivirus is listed as "Off". If I click on Avast in the little dialogue box, I have the option of turning Avast on. But I don't get a similar option when I click on the Windows Defender Antivirus listing.

Unfortunately, setting Malwarebytes to never register didn't work for me. I've done that and rebooted a couple of times, but I'm still blocked from turning on Defender. (I've verified that the Never Turn On setting was retained through the reboots.) Windows 10 Professional - 64bit, Creater's Update. I have Malwarebytes 3.0 active and Windows Defender active (Avast is installed by all protections are turned off), but Windows will not let me turn on the Defender Antivirus module.

Thank you again, Kevin, and thank you for the help in doing the cleanup of the tools. I've also read through the Security and best practices links. Some of that I've been doing, but I could do better. Carl

Kevin, it appears to be gone -- defeated. Between multiple MBAM scans, Antivirus scans, including for root-kits, and the suggestions that you made above, something seems to have worked and gotten rid of it. I also trashed a few extensions that I had added several days ago. Thank you for the suggestions about rkill and the Farbar Recovery Scan Tool. I suspect that one of them probably did the trick, but since I had my browser closed and didn't check after each of the tools I'm not sure which one (or if it was a combination). Since it is gone, and since I'm not entirely comfortable publicly posting the detailed information about my system that the Farbar report contains, I haven't attached the logs. The Malwarebytes report did not report finding any problems, nothing put into the quarantine, and no PUP's treated as malware. That is why I suspect it was one of the other two programs that you recommended. Thank you! Carl

Starting yesterday, MBAM is frequently blocking cdn.vssadd.com from reaching the web. I have updated and then scanned with MBAM, and updated and done both a full scan and a boot-time scan by Avast Premier. I also scanned for bad extensions with Avast. None of those found a trace of vssadd, yet it keeps trying to contact the web. I also had a problem for a while with my browser thinking that I was in Romania instead of the U.S. I use Chrome64 on Windows 10 Professional. How do I find what is causing the attempts to reach "cdn.vssadd.com"?