bobneish Posted October 4, 2017 ID:1169458 Share Posted October 4, 2017 I have Malwarebytes Anti-Malware Premium and I get a warning every half hour or so that its blocked a Malicious Website. Its an outgoing connection and this is the warning: oconner.biz But numerous other sites are also blocked I run Malwarebytes, McAfee Internet Security, Zemana Anti Malware and NONE find what my problem is Can you help please?? Link to post Share on other sites More sharing options...
kevinf80 Posted October 4, 2017 ID:1169494 Share Posted October 4, 2017 Hello bobneish and welcome to Malwarebytes, Open Malwarebytes, select > Reports > then checkmark (tick) most recent "Website Block" entry > then select "View Report" > "Export" > Text File (*.txt) name and save that file to Desktop or somewhere of your choice, attach to your reply... Next, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169499 Share Posted October 4, 2017 Kevin Here you go Thanks Bob oconner.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 4, 2017 ID:1169500 Share Posted October 4, 2017 Thanks, you got other logs..? Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169501 Share Posted October 4, 2017 Yes many more - back to feb this year by the looks of it Link to post Share on other sites More sharing options...
kevinf80 Posted October 4, 2017 ID:1169502 Share Posted October 4, 2017 No, I want to see the logs from FRST, instructions in my initial reply to you... I`m offline shortly, will catchup later.. Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169503 Share Posted October 4, 2017 Another mal1.txt Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169504 Share Posted October 4, 2017 OK will do Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169505 Share Posted October 4, 2017 Addition_04-10-2017 10.45.47.txt FRST_04-10-2017 10.45.47.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 4, 2017 ID:1169670 Share Posted October 4, 2017 Thanks for those log, continue as follows: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Please open Malwarebytes Anti-Malware. On the Settings tab > Protection Scroll to and make sure the following are selected:Scan for RootkiteScan within Archives Scroll further to Potential Threat Protection make sure the following are set as follows:Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended) Click on the Scan make sure Threat Scan is selected, A Threat Scan will begin. With some infections, you may or may not see this message box.'Could not load DDA driver' Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions. When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab If asked to restart your computer to complete the removal, please do so When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more to retrieve the log. To get the log from Malwarebytes do the following: Click on the Reports tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Run Chrome clean uo tool, https://www.google.com/chrome/cleanup-tool/ Post the logs from FRST, AdwCleaner and Malwarebytes. Also let me know if the outbound blocks have ceased... Thank you, Kevin.. fixlist.txt Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169686 Share Posted October 4, 2017 Fixlog.txt Fixlog_04-10-2017 19.07.22.txt Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169693 Share Posted October 4, 2017 Can't see an adwCleaner.exe Attached is the txt file after the scan AdwCleaner[S23].txt Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169695 Share Posted October 4, 2017 OK here is the adwCleaner text after restart AdwCleaner[C8].txt Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169703 Share Posted October 4, 2017 Kevin Ran Malwarebytes as directed and nothing found Link to post Share on other sites More sharing options...
bobneish Posted October 4, 2017 Author ID:1169705 Share Posted October 4, 2017 Kevin No good - the redirects are still happening as before Thanks Bob Link to post Share on other sites More sharing options...
kevinf80 Posted October 4, 2017 ID:1169706 Share Posted October 4, 2017 Download RogueKiller and save it on your desktop, ensure to download correct version..RogueKiller (X86)RogueKiller (x64) Exit all running applications. Double-click on RogueKiller.exe to launch the tool. On its first execution, RogueKiller will disply the software license (EULA), click on "Accept" to continue. If RogueKiller is unable to load, do not hesitate to try launching it several times or rename it winlogon. Click "Start Scan" to begin the analysis. This may take some time. Once the scan is complete, click the "Open TXT" button to display the scan report. Copy/Paste it's content in your next reply. Do not use the delete option until i`ve had a look at the log.. Is the problem only with Chrome..? Thanks, Kevin Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169799 Share Posted October 5, 2017 RogueKiller V12.11.18.0 (x64) [Oct 2 2017] (Free) by Adlice Software mail : http://www.adlice.com/contact/ Feedback : https://forum.adlice.com Website : http://www.adlice.com/download/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 10 (10.0.15063) 64 bits version Started in : Normal mode User : bobneish3 [Administrator] Started from : C:\Users\bobneish3\Downloads\RogueKiller_portable64.exe Mode : Scan -- Date : 10/04/2017 21:50:23 (Duration : 00:22:43) ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 0 ¤¤¤ ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ WMI : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: KINGSTON SV300S37A120G +++++ --- User --- [MBR] 5ebc470b5475ca2297083be8adcaccb9 [BSP] 893f6266b8109b05292e94c8a63a3c4e : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1026048 | Size: 113107 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 232671232 | Size: 862 MB User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive1: TOSHIBA DT01ACA200 +++++ --- User --- [MBR] 8c86ff1deaf0797edf6dd7057957ae42 [BSP] 3685014d8a8a1261c1129163ea319b74 : Windows Vista/7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 1907627 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive2: WD 1600BEV External USB Device +++++ --- User --- [MBR] 2529ae28d6d701022fc01df77636b5bb [BSP] ddb7b9a8e5272fca95431ec2614be9c8 : Windows XP MBR Code Partition table: 0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 152625 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive3: WD My Passport 0748 USB Device +++++ --- User --- [MBR] 54a63c93d74fd4ae657c694fde21c436 [BSP] 192d6987226952e0b1fc779dc897cd78 : Windows XP MBR Code Partition table: 0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953836 MB [Windows XP Bootstrap | Windows XP Bootloader] User = LL1 ... OK Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive4: WD My Passport 259F USB Device +++++ --- User --- [MBR] b749ca3279980e04af4acfc8f6e210f5 [BSP] 7fd284fb52c67c795cf1eb3c56d573d7 : Empty MBR Code Partition table: 0 - My Passport | Offset (sectors): 2048 | Size: 1907695 MB User = LL1 ... OK Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive5: Generic STORAGE DEVICE USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive6: Generic STORAGE DEVICE USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive7: Generic STORAGE DEVICE USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive8: Generic STORAGE DEVICE USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive9: Generic- SD/MMC USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive10: Generic- Compact Flash USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive11: Generic- SM/xD-Picture USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive12: Generic- MS/MS-Pro USB Device +++++ Error reading User MBR! ([15] The device is not ready. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] The request is not supported. ) +++++ PhysicalDrive13: WD My Passport 0748 USB Device +++++ --- User --- [MBR] 0064e617d6d916f0c20706ffd372a0bf [BSP] 7461a67adc1dcbeaf1e57feb53ab5f30 : Windows XP|VT.Unknown MBR Code Partition table: 0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953836 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK Error reading LL2 MBR! ([32] The request is not supported. ) Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169800 Share Posted October 5, 2017 Seems to be only Chrome but difficult to tell because I only use chrome How do I check it's not a router infection (I have a BT hub) Best Bob Link to post Share on other sites More sharing options...
kevinf80 Posted October 5, 2017 ID:1169804 Share Posted October 5, 2017 Hiya Bob Lets try a clean install for Chrome, see if that makes any difference... If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Remove all synced data from Chrome go here: https://support.google.com/chrome/answer/6386691?hl=en-GB follow those instructions... It is essntial that any/all synced data is removed when the browser is hijacked or exploited in anyway... Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Install Google Chrome : Install Adblock Plus to Chrome: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb Install DrWeb Link Ant-virus Link Checker: https://chrome.google.com/webstore/detail/drweb-anti-virus-link-che/aleggpabliehgbeagmfhnodcijcmbonb?hl=en Does that help...? Which version of BT Hub do you have.. Thanks, Kevin Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169836 Share Posted October 5, 2017 Kevin Carried all that out to the letter - still the same Thanks again Bob Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169837 Share Posted October 5, 2017 BT homehub 3 Link to post Share on other sites More sharing options...
kevinf80 Posted October 5, 2017 ID:1169838 Share Posted October 5, 2017 Hello Bob Is this issue only happening with Chrome, have you tried another browser such as Firefox, Internet Explorer or Edge.... You mention your router as a possiblity, yes it happen with routers. A simple fix is to reset the router, instructions at following link: http://bt.custhelp.com/app/answers/detail/a_id/11386/~/how-do-i-reset-my-bt-hub-to-its-factory-settings%3F Expand the version applicable to your hub.... Let me know if the reset helps.. Thanks, Kevin Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169839 Share Posted October 5, 2017 Kevin I have been living with this problem for quite a while and most of the procedures you suggested and carried out in sequence, I had already tried without success. My final port in a storm is this forum but I'm at my wit's end about the cause Thanks for helping Bob Link to post Share on other sites More sharing options...
bobneish Posted October 5, 2017 Author ID:1169840 Share Posted October 5, 2017 Kevin Tried that reset of the hub but to no avail Link to post Share on other sites More sharing options...
kevinf80 Posted October 5, 2017 ID:1169842 Share Posted October 5, 2017 Hiya Bob, Yes very frustrating for sure, can you explain exactly what is happening. From your replies I assume the Malwarebytes block only when you are using Chrome, is that correct......? I want you to run a scan with GMER, this tool can cause your system to crash when any security is active. Hence I need you to turn off all security before the scan is started.. Please download Gmer from Here by clicking on the "Download EXE" Button. Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent. If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO. In the right panel, you will see several boxes that have been checked. Uncheck the following ...Sections IAT/EAT Show All ( should be unchecked by default ) Leave everything else as it is. Close all other running Programs as well as your Browsers. Click the Scan button & wait for it to finish. Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop. Please post the content of the ark.txt here. **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries **If GMER crashes** Follow the instructions here and disable your security temporarily… Thanks, Kevin Link to post Share on other sites More sharing options...
Recommended Posts