PtrykPL

Malwarebytes RTP is blocking a lot of IPs from Euro Truck Simulator 2 due to trojan or compromised (sorry if I posted it on wrong place). text.txt

Everytime while starting up Paradox Launcher, malwarebytes is blocking a temporary file. file.zip

I have downloaded and installed TeX Live from https://tug.org/texlive/ . Malwarebytes marked "texaccents.exe" as malware (malware.heurestic.1006). I think it is false positive but I'm not sure. I attach scan results and that file. scan-results.txt texaccents.zip

Ok, thanks for help. I just wanted to make sure that everything is fine, because i heard many different thinghs about that.

I was trying to change password, but these devices still showed. It only dissapears for some time after router reboot. As i said this is probably bug. And i checked few router settings and everything seems to be good. So everything should be fine now? These ip are not anything malicious?

Also i found 4 unknown devices connected to my router. This is very strange. I don't know if this is related to these ip connections. This looks like these devices don't exist. Other people had this problem too. I found it could be error or something like this. Also there is app (i downlaoded it from play store) for my router and i don't see these devices here, so i think thks is error or bug. I have newest router firmware installed. I think this isn't good place to ask about this. I don't think this is caused by any malware.

I was asking for help in one discord server. I asked about other IP adresses too. Two people had same ip adress on their pc. I did kasperky full scan today (with extreme settings) and it didn't detected anything. I checked for updates before scan. And kasperky isn't only one AV that i used to scan. As i said, none of AV detected anything. No detections. Somebody told me something that IP adress could be used to bad thinghs before, but now this is good IP adress. Maybe this is true because many of bad comments have more than 1 year. Also i heard to not always trust these comments in virus total. I also scanned these IP with other websites. And what about these FRST logs? Is everything good with them? Also i found how to make these logs in english.

Update: I was asking about that and some people also have same ip in resource monitor. Also i scanned these IP with other tools and it didn't said anything bad about these IP. I did also scan with malwarebytes anti-rootkit and it doesn't detected anything.

I did scan with FRST again. I'm attaching these new logs. Malwarebytes and adwcleaner didn't found anything. Also I did full scan with Kasperksy. It didn't detected anything. This is how it looks now. I scanned other IP too. These ip don't have many detections in VirusTotal, but very low community score. I don't know if these IP are from Kasperky or not. Also VT says that IP are from GB or Switzerland. Always when I'm checking random IP it shows no detections, but very low community score. I have more examples: https://www.virustotal.com/gui/ip-address/224.0.0.252/community https://www.virustotal.com/gui/ip-address/239.255.255.250/community Addition.txt FRST.txt AdwCleaner[S12].txt mbam.txt

Edit: Somebody told me that is malware, but i still dont know what i should do. I was trying to use TRON but idk if this is good idea.

Hello. First i want to say one thing. I did clean Windows reinstall and didn't installed any bad things from internet. I saw this in resource monitor: I'm worried about 93.184.220.29 ip. Is this something bad? I saw this doesn't have good community score on VirusTotal (https://www.virustotal.com/gui/ip-address/93.184.220.29/community), but only 2 detections. Also this ip connection was from "avp.exe" or other Kasperky things. These ip are sometimes other, but i scanned few of them. Only 93.184.220.29 don't have good community score on VT. Also there was something that ip is from "Egdecast". I don't know what is that. I scanned my PC with Malwarbytes, adwcleaner and Kasperky (and Malwarebytes anti-rootkit). Also i scanned with F-secure router checker. None of antiviruses detected anything. I was asking here before, send FRST logs and somebody said everything is good. Also some people said this is normal if this is from Kaspersky (i have installed Kasperky Security Cloud). These connections are not using many network. There aren't any processes that uses more than 1% of CPU if i'm doing nothing. I checked few processes in Process Explorer and few tinghs in Autoruns. There wasn't anythins suspicious. Could it really be something bad or not? I'm attaching adwcleaner, mbam logs and my old frst logs. AdwCleaner[S11].txt mbam logs.txt Addition.txt FRST.txt

Ok, so everything is fine. Thanks for help.

I forgot to say one thing. I found something about forced system restart in logs (or something like that). This is because I accidentally killed lsass process in process explorer. Also I found few errors with Windows Defender scans or sometching like this (i think in addition.txt). I don't know what happened, but I did more scans. I also did one full scan with Windows Defender, before asking for help here. These scans didn't found anything.

And something changed. Now there are not svchost.exe with session "2" but now it have "1" (I noticed this after I disabled "quick start" option). Path of these processes is still normal (system32). Every svchost process have same path. I scanned svchost.exe file with VirusTotal and there wasn't any detections and file had veryfied Microsoft signature. Yesterday I installed Kaspesky and run few scans. Also I scanned "svchost.exe" with this. Nothing was detected. These processes still doesn't use many CPU and I think PC works fine.

Sorry, but FRST generated logs in my language :/ I didn't even saw the option to change the language. malwarebytes.txt Addition.txt AdwCleaner[S32].txt FRST.txt