dugrn

I figured it wad something that I did not know/aware of. I have included my logs for review just in case. I apologize for not putting them up in my original message. mbst-grab-results.zip

bumping for reply

When I open MWB it opens to a completed threat scan with the date and time in which the application was opened. Of course it is impossible to complete a scan at the same time you open MWB. I'm also not getting my MWB popups that a scan was completed. I dug a bit deeper and noticed that my scans were taking much less time than usual. 6-8min as opposed to 15min or longer. I decided to watch a few scans and noticed a few things. 1. When starting the "Scanning startup items" the items scanned was approximately 2,291 and completed at 2,491 2. When it proceeded to "Scanning registry" it jumped to to approximately 134,000 items scanned immediately. While in "Scanning registry it jumped from 134.000 files to 151,000 to 174,000. Then 197,000 to 214,000. 3. When it proceeded to "Scanning file system" the items scanned jumped to 262,000. The file items scanned proceeded normally up to about 285,000 items scanned and all the sudden jumped to 359,000 and finished. 4. After this scan I closed MWB and reopened. The home screen opened to a completed scan with the date and time it opened and the scan time/items scanned we identical to the previous scan.

mbst-grab-results.zip

I guess I’m confused. The last outbound attempt was from a different IP and file (not one drive) on 2/10. In a previous post you said “No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).“ 2/18 was the last daily scan and MB quit running until 3/4 which is what prompted this whole thing.

Actually one of those reports I sent shows it did not come from onedrive. It came c:\windows\system32\svchost.exe and had a different up address. It was actually the last outbound I had. there have been no block events since 2/10

So I reviewed the malicious sites blocked reports. There are multiple from the same IP address And from the same file location over about 45min. 7 hours later on the same day theee were 3 outbound attempts with a different IP address but same file location. The final one of those 3 had the same IP but a different t file location. All of these showed up on detection history with event “RTP detection”. I have uploaded the reports below as well as the scan log I performed based on your instructions scanreport 3-6.txt RTP detection 2-10 1251pm.txt RTP detection 2-10 1158am.txt RTP detection 2-10 721pm.txt RTP detection 2-10 720pm.txt malicioussiteblock.txt

Thanx Maurice i tried removing the password in chrome-did not work. i was wondering if you could look at a malicious site block file for me. I have uploaded below. If I need to start a new thread let me know. i got about 25 of them all on the same day within 15 minutes of each other. malicioussiteblock.txt

Hi Maurice ny scan settings as as they were before all this happened. Threat scan—date/time—Repeats everyday—-scan at next opportunity. MB ran as scheduled today. As for my login in issue, the advice from AdvancedSetup did not work.

I have included the latest scan log (3-4-20) and the last log before MB stopped daily scanning (2-18-20) also, I’m having to eat my password each time I try and log into this site. I cannot log in at all on my pc. I can only log in on my phone. thanx! scanrpt3-4-2020.txt scanrpt2-18-2020.txt

Here are the files. malwarebytes is working now. Between my first post and your reply I restarted my pc, installed the .NET framework 3.5 and 4.8 cumulative update for 2-2020. When I tried to run Malwarebytes after restart it started to scan and then quit. MB restarted and I checked for an update which it needed so I did that. I was able to run a scan after the update. No detections. I typically have daily scans but my last one was 2/18/20. FRST.txt Addition.txt

Malwarebytes will not open or run from shortcut of at the file location.

Here is the log for scan with rootkits MWBlog.txt

Widows defender still not running When I run Chrome with just a blank page I'm getting 11 Google Chrome process. I decided to run Edge for this replay at the same time and it has 9 processes. I did notice the "Tamper Protection" inside the "virus % threat protection settings" was switched to off after the last steps we completed. I turned it back on

Hi Maurice I have completed the 2 steps you requested. FRSTEnglish and AdwCleaner. Logs attached AdwCleaner log report.txt Fixlog.txt