[BookWorm Deluxe Wordlist Editor]

Log for staff.

 

File: 1
Malware.AI.4262924630, C:\MALWARE TEST NO WD\BOOKWORM_WORDLIST_EDITOR-WIN-X64.EXE, No Action By User, 1000000, -32042666, 1.0.83878, 916BBBCEA1C37093FE171156, dds, 02796101, D92AF4F86FFE9ABEB7F9EE1C6C007F78, EB3AE3AFEE198DF6FAEA8DF91CF386BE975F3FE144E648272AE585101B0EDD36

 

 

[[ RESOLVED ] Cannot update to version 5]

@GhostX

I see your issue. The stand-alone VPN is blocking the installation since it is integrated with MB5.

If your VPN key is the same as your Premium key, Uninstall both, and then you will be able to install MB5.

 

[Blocked domain]

@INF4ME Do you have a screenshot or log from Malwarebytes of the block?

[blocked and scanning as clean]

4 hours ago, ZenaHayward said:

This Ip is used by the hosting service 123Reg and is for all. My website is clean!!

 

Does not matter. As long as the IP is being misused by others on the IP it will remain blocked.

You will need to request a new IP from your host which with some hosts easier said than done.

[[ RESOLVED ] Cannot update to version 5]

@GhostX

Please do the following so that we may take a closer look at your system.

 

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and then do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine 
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

 

Thank you

[Slido gives Exploit.OfficeLoadingPointsAbuse message and block]

2 hours ago, geoffnewson said:

Slido updater is failing with Exploit.OfficeLoadingPointsAbuse, likely false positive.

Abbiamo bisogno del registro di rilevamento di Malwarebytes per assisterti.

[hacked by discord scam]

@arthurvasz

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

[Urgent: Removal of Malicious Malware from dubaivacancy.ae Detected by CyRad]

1 minute ago, Adil1000 said:

I kindly request your immediate assistance in removing the detected malware from our domain. We understand the severity of the situation and are committed to taking swift and decisive action to mitigate any potential risks associated with this threat.

Malwarebytes is not blocking your site and does not clean websites.

Malwarebytes is not associated with ANY of the vendors listed on Virus Total. Please contact those vendors directly.

https://github.com/yaronelh/False-Positive-Center

https://docs.virustotal.com/docs/false-positive-contacts

[Trojan Detection - False Positive]

Log for staff

 

-Website Data-
Category: Trojan
Domain: rvahj.org.au
IP Address: 172.67.157.219
Port: 443
Type: Outbound
File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

 

 

[malwarebytes anti rootkit]

1 minute ago, XDDDDDDD said:

the version of the anti root kit was v 1.10.3.1001

Where did you get it from? The stand-alone has been discontinued.

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

[smtp server for Whois.com being blocked]

For staff, The block seems to be an IP block.

-Website Data-
Category: Malware
Domain:
IP Address: 208.91.198.143
Port: 443
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

[Website blocked due to a suspicious TLD]

This block happens because your users have enabled the NON-DEFAULT setting mentioned previously.

[False Positive - Windows SVC Host?]

1 hour ago, Porthos said:

Then be patient for the next expert to take your case.

 

2 minutes ago, RainOnThem said:

Hello....any updates?

 

[Google/Chrome/updater.exe and Trojan.MalPack.Generic are not deleatable]

11 minutes ago, mekpsy said:

I hope I did it right!

You missed the following.

Quote

Please rename FRST.EXE or FRST64.EXE to FRSTEnglish.exe

 

[FileUploader.exe false positive]

On 2/19/2024 at 11:41 AM, z_o_o_m said:

Thanks. I thought that it would be better to stay in the same thread when it is the same issue with the same app.

Old topics are overlooked. New topics get noticed.

[Outlook to Onenote being Blocked by Malwarebytes]

In the advanced exploit protection settings uncheck the following.

["Browser infected" notice]

1 hour ago, Wurlitzerwilly said:

That's going to be difficult, I'm afraid. It's a small notice that slides in from the RHS, stays for about 10 seconds, then slides out again.

Please reference the below Malwarebytes Labs article on Browser Push Notifications.
Look for the section "How do I disable them?"
Browser push notifications: a feature asking to be abused

Assuming you use Safari.

Apple Safari
Customize website notifications in Safari on Mac

[Google/Chrome/updater.exe and Trojan.MalPack.Generic are not deleatable]

@mekpsy

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

[False Positive - Windows SVC Host?]

2 minutes ago, RainOnThem said:

Share them here, or in a support ticket?

I have moved your post to the malware removal section.

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case.

 

Thank you

[atlanticyachtandship.com FP]

Log for staff.

 

 

-Website Data-
Category: RiskWare
Domain: atlanticyachtandship.com
IP Address: 8.29.155.201
Port: 443
Type: Outbound
File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

 

(end)

[MWB 5 VPN]

49 minutes ago, MJL said:

Still do not appreciate why this is happening.

It is most likely looking for a VPN subscription. I personally would not block it. If it can easily be checked, it might not be checked as often.

[MWB 5 VPN]

On 4/6/2024 at 11:10 AM, MJL said:

However, what is more disconcerting is that MWB is attempting to communicate with a server in Sweden (IP address 45.83.223.233) host ipv4.am.i.mullvad.net every 1/2 second. This is being blocked by the web filter on my router (Arista Untangle) under the Category "Proxy Avoidance and Anonymizers" .

Can someone explain what is going on and why and how to turn off this communication?

@MJLYou might have better luck contacting support. How to contact support

[MWB 5 VPN on main screen unwanted]

12 minutes ago, keith_thfc said:

I don't use the VPN service so this is just marketing spam which (as a paying customer) I don't appreciate. 

Why is there no option to remove this from the dashboard? 

@keith_thfcThere are many discussions about the VPN here but you added to a topic that is different as even if was hideable, It does not answer the topic starter's question.

The company is trying to find a way to make users like you happy. It is undergoing lots of discussion behind the scenes.

[Clicked atch in spoofed emails, MalwareBytes Premium scan OK. What Next?]

@Dave_247 I removed the post with the attachments and forwarded them for someone to look at.

[Clicked atch in spoofed emails, MalwareBytes Premium scan OK. What Next?]

40 minutes ago, Dave_247 said:

Am just afraid that something may have executed in the background and installed malware, as the same e-mails were reportedly sent to nearly a hundred people in our neighborhood.

Thank you very much, we really appreciate your advice on the matter!

Is this the "error" you saw?

I don't think you "got" anything. I asked someone to look at the emails to chime in as well.