Constant Malwarebytes Malicious Website Blocked messages

[bmbite]

Hello. I used a "search all Craigslist" website last night and as soon as I did notifiers from Malwarebytes kept popping up that "Malicious Website Blocked". Only one of the notifiers gives the Domain: fff5ee.com, IP: 31.184.192.90. The other notifiers have no domain listed, but IP: 88.214.193.211 or 95.215.1.57. The Port number is constatly increasing (started in the 50000 range and now is in the 60000 range). The Process is always the same: C:\Windows\SysWOW64\dllhost.exe.

 

Once this started, I shut down everything I was working on and ran CCleaner Free thinking it was just some temp file I picked up on that website where the page didn't fully close. I ran a custom scan with Malwarebytes Anti-Malware Premium including "Scan for Rootikits" of the entire C: drive. It took ~1.5 hours, but it didn't find anything. I also ran a Microsoft Security Essentials Quick scan and didn't find anything. I also tried to access Microsoft Safety Scanner, but got a message that said my settings don't allow it to be downloaded. I've never had a problem downloading it in the past. I disconnected the computer from the internet and it didn't stop the notifier messages. The messages pop up about one every second.

 

Please find attached FRST.txt, Addition.txt as well as snips of the Malwarebytes notifier messages that keep popping up. 

 

Any assistance would be appreciated. Thank you for your time.       

FRST.txt

Addition.txt

Malwarebytes malicious website blocked messages 10-17-14.pdf

[Maurice Naggar]

@ edjhome & @edbr

You both are not allowed to add your malware-removal-help onto the one of the original poster --- this topic is ONLY for BMBITE

I will be deleting both of yours.  Please start your own new and separate help topics  AND put with them the FRST diagnostics.

Please read the forum rules !!

 

read and follow the directions here, skipping any steps you are unable to complete.  Then post a NEW topic here.
One of the expert helpers there will give you one-on-one assistance when one becomes available.
After posting your new post make sure under options that you select Follow this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post the logs there.

Don't post your logs here.

[Maurice Naggar]

These steps are for  member BMBITE only. If you are a casual viewer, do NOT try this on your system!
If you are not  and have a similar problem, do NOT post here;  start your own topic

 

Hello BMBITE and welcome aboard.

 

Your pc has a trojan malware that is sometimes called Poweliks.

Do not do any sort of free wheeling web surfing for the duration.

 

Do not do any self fixing except for those that I guide you to.

If you have questions, stop and ask first  and wait for my reply.

 

Save the attached file Fixlist.txt    to the same location where you have FRST.exe   ---- thats important for the Fix to work.

It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite an existing one please allow)

Run FRST again but this time press the "Fix" button just once and wait.

When finished, it will make a log (fixlog.txt) next to FRST.
Please attach the Fixlog.txt  into a reply.

Fixlist.txt

[Maurice Naggar]

This topic is strictly for the Original Poster. !

Do not follow any custom fixes posted here --- unless you are BMBITE.

[bmbite]

Hello Maurice. Thank you for your help! I've run the fix as you outlined. Please find attached the fixlog.txt.

 

After running the fix, it said it needed to restart the computer, so I let it restart. The pop-up notifiers from Malwarebytes have stopped after the restart. On side a note, the computer is unplugged from the internet (I unplugged it before your assistance.)

 

I'll await your next instructions. I do need to step out in about ten minutes, so I may not be able to do the next steps for an hour or so from now. Thank you.

Fixlog.txt

[Maurice Naggar]

That is a very good start.  Two followups below.

 

A

Please do a Threat & Rootkit Scan:
Start the Anti-Malware program.

Click the Settings icon ( on the top bar) > then click **Detection and Protection** subtab, Detection Options, tick the box 'Scan for rootkits'.
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.

With _some infections_, you may see this message box.
'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.

Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.

After the scan has completed, Click on the **History tab** > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click **'Copy to Clipboard'**
Paste the contents of the clipboard into your reply.
then in the body of  reply box, do a Paste by pressing CTRL+V keys on the keyboard.

 

B

For this you need to be connected to the internet.  This is a online scan.  Have lots of infinite patience.

 

It's important to run this online scan to help look for any remnants that may be lurking. This scan can take upwards of an hour.

1) Turn off your anti-virus software.

2) Click Start>All Programs and locate Internet Explorer (64-bit). Right click to run as Administrator

3) Next, click on the following link ==> http://www.eset.com/onlinescan/

4) Click on the "ESET Online Scanner" button.

5) Put a check in the box that says "YES, I accept the Terms of Use."

6) Click the 'Start' button just to the right of the checkbox.

7) UNCHECK the box that says "Remove found threats" (this is very important).

8) Click on "Advanced settings".

9) Put a check in the box that says "Scan for potentially unsafe applications".

10Verify that "Scan for potentially unwanted applications" is also checked.

11) Verify that "Enable Anti-Stealth technology" is also checked.

12) Click the 'Start' button in the lower-right corner of the page, and it will begin downloading it's database, and then it will start scanning.

13) When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."

14) Save that text file on your desktop, and then attach it to a reply for me.

15) Close the ESET online scan.

15) Re-enable your Antivirus.

I will take a look at the log, and let you know if anything needs to be removed.

[bmbite]

Hello Maurice. Thank you for your response.

A. Threat & Rootkit Scan completed as outlined above. It appears nothing was found. I've attached the Application Log as a .txt since I'm communicating with you via a different computer.

 

B. The Eset online scan was completed as you outlined above. I did it through Firefox because IE 11 was blocking the pop-up from them. No threats were found. I've attached a screen capture of the results.

 

Please let me know if you think I should do any additional steps. Thanks again for your help!

 

 

MB scan log 10-18-14.txt

[Maurice Naggar]

That is very good.

Have you noticed any other IP blocks, since then?  Any signs of "fff5ee(dot)com"" ?

 

Your are doing well.  Just would suggest one more special scan.  It will not take a whole lot of time.

 

You will want to print out or copy these instructions to Notepad for offline reference!
These steps are for  Bmbite   only. If you are a casual viewer, do NOT try this on your system!
If you are not  and have a similar problem, do NOT post here;  start your own topic

Do not run or start any other programs while these utilities and tools are in use!
Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=
Close any of your open programs while you run these tools.

On most all of the following programs and tools, you will need to do a right-click on the program link or shortcut or desktop icon (as appropriate) and then select "Run as Administrator". Please remember that as you go along and use these tools, each in turn.

If you have a prior copy of Combofix, delete it now

Download Combofix from any of the links below, and SAVE it to your Desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your Desktop and not run straight away from download **

Turn OFF your antivirus, otherwise it will interfere.  How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs


Have infinite patience during the run & scan by Combofix. It has many phases:  some 50+ stages
It will display it's "stage" within the Command prompt window. Do NOT panic if it seems slow to change ! It has lots of work.
You may notice the desktop icons disappear. Do NOT panic, as that is expected behavior.
Combofix my take as little as 10 minutes and perhaps as much as 30-40 minutes. Time taken will depend on speed of your system and how much there is to scan & how much it needs to clean.

If this is on a notebook system, make sure first the notebook is connected to wall-power  (AC power)or a UPS system


Important:  Have no other programs running.  Your Task Bar should be clear of any program entries including your Browser.
Right- click on Combo-Fix.exe on your Desktop and select "Run as Administrator".

• A window may open with a warning or prompts.  Accept the EULA and follow the prompts during the start phase of Combofix.
  
  When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.  
 

A file will be created at => C:\Combofix.txt.  

Notes:
[1] IF after Combofix reboot you get the message

Illegal operation attempted on registry key that has been marked for deletion

....please reboot the computer, this should resolve the problem. You may have reboot the pc a second time if needed.

[2] Do not mouseclick combofix's window nor run any program while Combofix is running.
That may cause it to stall.

[3]When all done, IF Combofix did not do a Restart...then ... I need for you to Restart the system fresh

Reply & Copy & Paste contents of the C:\Combofix.txt log
and tell me, How is the system now

Re-enable your antivirus program.

 

[bmbite]

Hello Maurice. ComboFix has completed. I didn't receive any driver errors or anything, so I manually restarted the computer. Please find attached the ComboFix.txt log.

 

The computer is working fine. I haven't seen any Malicious Website Blocked messages since before your fix from FRST.

 

Should I delete ComboFix from my desktop?

 

Thank you!

 

ComboFix.txt

[Maurice Naggar]

We can wrap this up now. I see that you are clear of your original issues.
If you have a problem with these steps, or something does not quite work here, do let me know.

The following few steps will remove tools we used. Advise me after you have completed the cleanups.

We have to remove Combofix and all its associated folders. By whichever name you named it, ( you had named it ComboFix    
put that name in the RUN box stated just below.
The "/uninstall" in the Run line below is to start Combofix for it's cleanup & removal function.
Note the space before the slash mark.
The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.
 

• Highlight the line in this CODEBOX.
  Select & Copy the entire line within this codebox (so that it is in Windows clipboard memory)
   

  c:\users\B\Desktop\ComboFix.exe /uninstall

• Start >> type in cmd >> press the Ctrl+Shift+Enter keyboard combination and cmd.exe will be launched as if you selected Run as Administrator. You will then see a User Account Control prompt asking if you would like to allow the Command Prompt to be able to make changes on your computer. Click on the Yes button and you will now be at the Elevated Command Prompt.
  
  Do a Right click within the command prompt window and select Paste.  This must show the line from Codebox above.
  Then tap Enter

IF in the case Combofix un-install has an issue, skip that step.

NEXT
 

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Delete the following if still present:
FRST64.exe

FRST.txt

Fixlist.txt

Fixlog.txt

Addition.txt

 

Uninstall these Java related items thru Control Panel

Java 7 Update 67
Java Auto Updater
JavaFX 2.1.1

 

IF you must have Java, get the latest version from Sun, which now is Version 8 release 25.

You may use Control Panel >> Programs and Features and uninstall ESET Online scan.

Safer practices & malware prevention

 

Get and put in place our  Anti-Exploit
http://www.malwarebytes.org/products/antiexploit/

• Have a hardware router between the incoming internet-modem and your computer.
• Use a Standard user account rather than an administrator-rights account when "surfing" the web.
• Configure your Antivirus software to check for updates daily, at a time in which you are sure the computer will be on.
• Check in at Windows Update and install any Important Updates offered.
• Make certain that Automatic Updates is enabled.
  How to configure and use Automatic Updates in Windows
  http://support.microsoft.com/kb/306525
   
• Check on other update issues as well, by getting, installing and using Secunia Personal Software Inspector (OSI) on a monthly basis.
  See How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector
   
   
• Download, install, and keep updated Spyware Blaster (free): http://www.brightfort.com/spywareblaster.html (all Protections should be enabled at all times)
  Tutorial for Spywareblaster: Using SpywareBlaster to protect your computer from Spyware, Hijackers, and Malware
• I'd recommend that you get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm
  See the FAQ page http://mvps.org/winhelp2002/hostsfaq.htm
  That would help to keep your browser away from known spyware/malware sites.
  Get notified when the MVPS HOSTS file is updated
  http://winhelp2002.mvps.org/updates.htm
  
   
• Make regular backups of your system to removable media: DVD, USB external hard drive, etc.
  Having a total image backup of your system stored on DVD/CD is highly important.
  Get and make use of imaging-backup utilities and save them to offline media. That way you have something to fall back to if a disaster hits.
   
  How to create a Windows system image in Windows 7 and Windows 8
  http://www.bleepingcomputer.com/tutorials/create-system-image-in-windows-7-8/
  
  How to use System Image Recovery in the Windows 7 and Windows 8 Recovery Environment
  http://www.bleepingcomputer.com/tutorials/system-image-recovery-in-windows-7-8/
  
  
   
• Consider using Web of Trust WOT add-on for your browser(s)
  http://www.mywot.com/en/download
  http://www.mywot.com/en/faq/add-on
• Take extreme care if you share USB-flash/thumb drives from other people {even from friends, roommates, relatives}
  Don't plug in an unknown flash/thumb drive into your PC.
  IF you must do so, hold down the SHIFT-key when you insert the drive.
  Scan any file with your Antivirus prior to opening or using.
  
  On some regular schedule, it is a good idea to do an online scan for viruses and malware. Here is a very short list of sites where this may be done:
  
  ESET Online Scanner
  
  BitDefender Quickscan
  
  Trend Micro Housecall
  
  F-Secure Online Scanner
  
  Microsoft Safety Scanner
  
  Panda ActiveScan
   
• See Six tips to help you stay safer online
• Never, ever download free games, free tools, videos, mutli-media files or anything free unless you can be absolutely sure the source is safe !

We are finished here. Best regards.

[bmbite]

Hello Maurice. I've completed the clean up. I'm also working through each of your recommendations. Thank you so much for all of your detailed help!

[Maurice Naggar]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.