toonbon Posted October 27, 2017 ID:1176562 Share Posted October 27, 2017 I'm running the premium MB3 and after a scan it says "Awesome! No threates detected" but every minute, or less, a screen from piet2eix3l.com tries to pop up in my Chrome browser. MB usually catches ant pops up it's own screen (see attached MB2). How can I keep piet2eix3l.com from sending these popups and how can I keep MB2 from popping up its own screen everytime one come in? Thanks Steve Link to post Share on other sites More sharing options...
kevinf80 Posted October 27, 2017 ID:1176567 Share Posted October 27, 2017 Hello Steve and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin Link to post Share on other sites More sharing options...
toonbon Posted October 27, 2017 Author ID:1176594 Share Posted October 27, 2017 Thanks. FRST.txt and Addition.txt are attached. MB scan is below: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 10/27/17 Scan Time: 8:57 AM Log File: 7b3bcb0e-bb2f-11e7-a047-90b11c6a1b02.json Administrator: Yes -Software Information- Version: 3.2.2.2029 Components Version: 1.0.212 Update Package Version: 1.0.3112 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: T3600\Steve -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 436948 Threats Detected: 0 (No malicious items detected) Threats Quarantined: 0 (No malicious items detected) Time Elapsed: 5 min, 50 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) (end) Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted October 27, 2017 ID:1176612 Share Posted October 27, 2017 Thanks for those logs Steve, continue with the following... Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Scan with ZOEK Please download ZOEK by Smeenk from here: http://hijackthis.nl/smeenk/ and save it to your desktop (preferred version is the *.exe one) *.exe Mirror http://smeenk.247fixes.com/Tools/zoek.exe Temporary disable your AntiVirus and AntiSpyware protection - instructions here or here Right-click on icon and select Run as Administrator to start the tool. Wait patiently until the main console will appear, it may take a minute or two. In the main box please paste in the following script: Quote createsrpoint; autoclean; emptyclsid; emptyalltemp; ipconfig /flushdns >>"%temp%\log.txt";b iedefaults; FFdefaults; CHRdefaults; Make sure that Scan All Users option is checked. Push Run Script and wait patiently. The scan may take a couple of minutes. When the scan completes, a zoek-results logfile should open in notepad. If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive) Please include its content in your next reply. Don't forget to re-enable security software! Let me see those logs, also let me know if outbound calls/blocks have ceased.... Thank you, Kevin... fixlist.txt Link to post Share on other sites More sharing options...
toonbon Posted October 27, 2017 Author ID:1176712 Share Posted October 27, 2017 Here's Fixlog.txt. Working on ZOEK. Fixlog.txt Link to post Share on other sites More sharing options...
toonbon Posted October 28, 2017 Author ID:1176716 Share Posted October 28, 2017 Not sure how to disable current antivirus. The only antivirus icon in my system tray is Malwarbytes. How do I disable that? Steve Link to post Share on other sites More sharing options...
toonbon Posted October 28, 2017 Author ID:1176778 Share Posted October 28, 2017 Here's the zoek-resultgs file. zoek-results.log Link to post Share on other sites More sharing options...
toonbon Posted October 28, 2017 Author ID:1176779 Share Posted October 28, 2017 Actually, it doesn't look like zoek finished. It ran for 5 hours, but it never opened the results in notepad and Task Manager shows it's still running. So not sure what happened or what you're gong to find in the zoek-results. I'll let it run overnight, though I don't like leaving Malwarebyrtes disabled that long. Steve Link to post Share on other sites More sharing options...
kevinf80 Posted October 28, 2017 ID:1176792 Share Posted October 28, 2017 Hello Steve, Yes Zoek log is not complete, I assume you are running Zoek one more time..? you can disconnect internet if you are unsure about leaving security disconnected whilst the scan runs.. Thanks, Kevin Link to post Share on other sites More sharing options...
toonbon Posted October 28, 2017 Author ID:1176811 Share Posted October 28, 2017 Unable to stop zoek. Clicking X on its window or even attempting to kill it with Task Manmager, just opens a fresh window that says zoek is running and then that window fills with the log entries that were in the old window. So how do I stop zoek and run it again? Link to post Share on other sites More sharing options...
kevinf80 Posted October 28, 2017 ID:1176924 Share Posted October 28, 2017 Power your system off, then reboot.. let me know what is happening after the reboot, is your PC responding as expected, have the blocks ceased.. Link to post Share on other sites More sharing options...
toonbon Posted October 28, 2017 Author ID:1176967 Share Posted October 28, 2017 Before you responded, above, I rebooted (didn't do a power off/on) and it came up clean as far as I can tell. I've been using it for about 8 hours and I haven't seen the popups. Do you still want me to run zoek again? Steve Link to post Share on other sites More sharing options...
kevinf80 Posted October 29, 2017 ID:1177019 Share Posted October 29, 2017 (edited) Hiya Steve, If the popups have ceased there is no need to go any further, run the following to clean up: Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down:"Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we may have used. Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Edited October 29, 2017 by kevinf80 Link to post Share on other sites More sharing options...
kevinf80 Posted October 30, 2017 ID:1177293 Share Posted October 30, 2017 Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts