Jump to content

Malwarebytes Premium Blocking Swarms of Outbound Connection Attempts

TheThornWithin
 Share

Recommended Posts

TheThornWithin

TheThornWithin

Posted
Posted

I use Malwarebytes Premium and suddenly I am seeing multiple notifications of outbound connection attempts being blocked by Malwarebytes 3.0.

If that isn't bad enough, when I load a web page via a Chrome Incognito window, it is taken over by a page that loads a Comcast survey that replaces the site I was attempting to load.

I have performed both a Threat and Custom full scan with Malwarebytes 3.0 and found nothing. Could someone look at my logs and find what is messing with my PC, please?

FRST.txt

Addition.txt

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Hi TheThornWithin :)

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

  • As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens;
  • As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you;
  • The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system;
  • If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!;
  • If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
  • Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced;
  • I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules;
  • In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process;
  • I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone;
    This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread;


This being said, it's time to clean-up some malware, so let's get started, shall we? :)

I don't see any traces of infection in your logs, so I'll need a bit more information. Can you provide me a couple of the block notifications you're getting from Malwarebytes so I can review them? They are under the Reports tab, and Website blocked entries.

Link to post
Share on other sites
TheThornWithin

TheThornWithin

Posted
  • Author
Posted (edited)

Okey dokey. There's no need for you to feel rushed. I appreciate your time, Yoan. Truly.

I have uBlock Origin and Privacy Badger installed and sometimes use an incognito Chrome browser window to view live video feeds from news websites. The behavior that alarmed me the most occurred when I would open one of these incognito Chrome tabs - the site would start to load normally but then it would suddenly be overtaken by some weird site that would load a survey or some such thing. I am attaching the 3 latest reports you have requested.

malwarebytes_Report1.txt

malwarebytes_Report2.txt

malwarebytes_Report3.txt

I have lots more of these reports. The swarms of these blocked websites started on the 27th of last month. I think there were like 10-15 of them, one right after the other, in successive sessions. VERY alarming.

Edited by TheThornWithin
More info
Link to post
Share on other sites
Aura

Aura

Posted
Posted

The "issue" you're encountering is the same as the one in this thread.

https://forums.malwarebytes.com/topic/202356-appdata-foldersfiles-keep-coming-back-and-website-blocked-notices/?do=findComment&comment=1137613

It looks like some websites you're browsing are probably using the domain shown in your Malwarebytes block for advertising or else, and since uBlock Origin isn't enabled in Incognito, it doesn't block it and tries to connect, but Malwarebytes blocks it.

I found your domain in a similar script to the ones listed in the previous thread.

http://ddecode.com/hexdecoder/?results=7b5e54e59a67369dce7e5f2c67733797

In the end, you're not infected, the websites you visit are using these domains for advertising or else, and Malwarebytes is jumping in to block the connections from being made.

Link to post
Share on other sites
Aura

Aura

Posted
Posted

No problem TheThornWithin, you're welcome :)

On a side note, it seems that the script injecting these ads is added manually to the website (so it might have been compromised at some point). If you don't see the blocks anymore, it's probably because the owner(s) cleaned that script from the code.

Stay safe :) 

Link to post
Share on other sites
Aura

Aura

Posted
Posted

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.