inbound and outbound connection blocked by malwarebytes

[dididi]

So, last week have been receiving warning that malwarebytes is blocking various outbound and inbound connection, either from deluge or chrome, never had this problem before, this been happening for almost 1 week, im going to post a few reports bellow so you guys what is the best for me to do:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/29/17
Protection Event Time: 9:50 PM
Log File: d437f2fc-a557-11e7-8130-f079595ef4da.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.188
Update Package Version: 1.0.2916
License: Trial

-System Information-
OS: Windows 10 (Build 15063.608)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: 
IP Address: 185.82.216.57
Port: [64534]
Type: Inbound
File: C:\Program Files (x86)\Deluge\deluge.exe

(end)

---------------------------------------------------------------------------

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/27/17
Protection Event Time: 7:38 PM
Log File: 1d1b79f4-a3b3-11e7-83de-f079595ef4da.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.188
Update Package Version: 1.0.2899
License: Trial

-System Information-
OS: Windows 10 (Build 15063.608)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: 
IP Address: 194.228.13.101
Port: [64272]
Type: Inbound
File: C:\Program Files (x86)\Deluge\deluge.exe

(end)

---------------------------------------------------------------------------

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/30/17
Protection Event Time: 11:34 AM
Log File: e14f85ea-a5ca-11e7-8aab-f079595ef4da.json
Administrator: Yes

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.188
Update Package Version: 1.0.2920
License: Trial

-System Information-
OS: Windows 10 (Build 15063.608)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: 
IP Address: 185.82.216.57
Port: [51574]
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(end)

[kevinf80]

Hello dididi and welcome to Malwarebytes,

Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/   Deluge is BitTorrent Client, Malwarebytes will alert to inbound/outbound connections. If you used another BitTorrent Client susch as uTorrent the same thing will happen, using such programs for P2P transfers is a prime conduit for picking up infections...   Let me see the requested logs...   Thanks,   Kevin...

[dididi]

1 hour ago, kevinf80 said:

Hello dididi and welcome to Malwarebytes,

Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/   Deluge is BitTorrent Client, Malwarebytes will alert to inbound/outbound connections. If you used another BitTorrent Client susch as uTorrent the same thing will happen, using such programs for P2P transfers is a prime conduit for picking up infections...   Let me see the requested logs...   Thanks,   Kevin...

I've attached what you've asked, thanks.

Addition.txt

Edited September 30, 2017 by dididi

[kevinf80]

I also need the primary log, FRST.txt.

[dididi]

11 minutes ago, kevinf80 said:

I also need the primary log, FRST.txt.

sorry, here it is:

FRST.txt

Edited September 30, 2017 by dididi

[kevinf80]

Thanks for the logs, Chrome has two malicious extensions, we`ll shift those with FRST....

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

As a backup we`ll also run AdwCleaner...

Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Let me see those logs in your reply.... Also let me know if the blocks cease from Chrome.... Regarding Deluge, because of its nature you`ll either have to remove it, add it as an exclusion in Malwarebytes, or just accept the blocks will happen... Thanks, Kevin....

 

 

 

fixlist.txt

[dididi]

11 minutes ago, kevinf80 said:

Thanks for the logs, Chrome has two malicious extensions, we`ll shift those with FRST....

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

As a backup we`ll also run AdwCleaner...

Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Let me see those logs in your reply.... Also let me know if the blocks cease from Chrome.... Regarding Deluge, because of its nature you`ll either have to remove it, add it as an exclusion in Malwarebytes, or just accept the blocks will happen... Thanks, Kevin....

 

 

 

fixlist.txt

Fixlog.txt

i think it was due to deluge, only thing strange is they only started 1 week ago and i've been using deluge for 1 year, but i guess this things can happen and it's always good to at least receive those warnings, meaning that malwarebytes is doing the job.

AdwCleaner[S0].txt

[kevinf80]

Can I see the log from FRST fix, "fixlog.txt" Yes any type of BitTorrent Client will more than likely be blocked by Malwarebytes, such software usually is responsible for many threads we check with malware/infection etc....

What is happening with your system now, any issues or concerns....

Edited September 30, 2017 by kevinf80
typing error

[dididi]

3 minutes ago, kevinf80 said:

Can I see the log from FRST fix, "fixlog.txt" Yes any type of BitTorrent Client will more than likely be blocked by Malwarebytes, such software usually is responsible for many threads we check with malware/infection etc....

What is happening with your system now, any issues or concerns....

i have kaspersky, malwarebytes, did everything, didn't encounter any type of threat and it's free of adw,

Fixlog.txt    this one right?

[kevinf80]

For some reason your Hosts file was not replaced after removal by FRST... Go to the following link to fix that problem....

http://www.thewindowsclub.com/how-to-set-the-windows-7-hosts-file-back-to-default

Next,

You should be good to go if the hosts completes, to clean up etc run the following:

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[dididi]

15 minutes ago, kevinf80 said:

For some reason your Hosts file was not replaced after removal by FRST... Go to the following link to fix that problem....

http://www.thewindowsclub.com/how-to-set-the-windows-7-hosts-file-back-to-default

Next,

You should be good to go if the hosts completes, to clean up etc run the following:

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

Thanks for helping me, have a nice day

[kevinf80]

You`re very welcome dididi, comeback anytime....

Regards,

Kevin...

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!