computer communicating with url that has trojan on it

[Steve2018]

Hi,

I just installed the new version of Malwarebytes and it started notifying me that it was blocking the (see below). After googling the domain name and running a Sucuri scan I see that the website has a trojan on it. 

I appreciate any help you could give me! Thanks

 

 

OS: Windows 10 (Build 15063.674)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: bangkokdynamics.com
IP Address: 203.150.228.152
Port: [62409]
Type: Outbound
File: C:\Users\wis\AppData\Local\Google\Chrome\Application\chrome.exe

FRST.txt

Addition.txt

malwatebytes scan.txt

[kevinf80]

Hello Steve2018 and welcome to Malwarebytes,

Continue with the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Scan with ZOEK Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one) *.exe Mirror http://smeenk.247fixes.com/Tools/zoek.exe Temporary disable your AntiVirus and AntiSpyware protection - instructions here or here   Right-click on icon and select Run as Administrator to start the tool. Wait patiently until the main console will appear, it may take a minute or two. In the main box please paste in the following script:   Quote createsrpoint; autoclean; emptyclsid; emptyalltemp; ipconfig /flushdns >>"%temp%\log.txt";b iedefaults; FFdefaults; CHRdefaults; Make sure that Scan All Users option is checked. Push Run Script and wait patiently. The scan may take a couple of minutes. When the scan completes, a zoek-results logfile should open in notepad. If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive) Please include its content in your next reply. Don't forget to re-enable security software! Let me see those logs, also let me know if the outbound calls have ceased.... Thank you, Kevin...

fixlist.txt

[kevinf80]

Any progress...?

[Steve2018]

Hi Kevin,

Here are the logs. So far I haven't seen any outbound calls but I just got back to my computer.

Thanks again you for your help!

Fixlog.txt

zoek-results.log

[kevinf80]

Zoek log is not complete...?

[Steve2018]

Should I run it again?

[kevinf80]

Yes please....

[Steve2018]

Here are the zoek results.

zoek-results.txt

[kevinf80]

Thanks Steve, what is happening with your PC, any odd behaviour. Have the outbound calls ceased.

Thanks,

Kevin..

[Steve2018]

No extreme odd behavior except Chrome keeps crashing/stalling. It was the warning from Malwarebytes about the outbound calls that first got my attention. And so far no outbound calls - just booted it up 2 hours ago though.

Thanks!

[kevinf80]

Yes the outbound calls were from Chrome, i`d expect Zoek would have fixed that problem. If Chrome is still having problems maybe a better option is a clean install.... Do the following:

If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Remove all synced data from Chrome go here: https://support.google.com/chrome/answer/6386691?hl=en-GB follow those instructions... It is essntial that any/all synced data is removed when the browser is hijacked or exploited in anyway... Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Install Google Chrome : Install Adblock Plus to Chrome: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb Install DrWeb Link Ant-virus Link Checker: https://chrome.google.com/webstore/detail/drweb-anti-virus-link-che/aleggpabliehgbeagmfhnodcijcmbonb?hl=en Does that help..?

[kevinf80]

Any progress...?

[kevinf80]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!