Outbound website connection blocked

[Kouga18]

This started yesterday, I allowed malwarebytes to block the connection, then ran both it and avast separately as administrator to try to find any possible infections.
Nothing came up, and I thought it was fine so I went on with what I was doing, watching youtube, looking at an email, etc. Starting today I keep getting this blocked
outgoing connection, which was the same as yesterday.
Info:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 11/17/17
Protection Event Time: 9:13 AM
Log File: e0622f5c-cba9-11e7-b0d8-3863bb813a2b.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3282
License: Trial

-System Information-
OS: Windows 8.1
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Domain: b3ff2cfeb6f49e.com
IP Address: 5.11.87.236
Port: [49482]
Type: Outbound
File: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

 

(end)

If needed, I can get the json file?

[kevinf80]

Hello Kouga18 and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

[Kouga18]

Alright, I have the three logs. Here they are

Malwarebytes scansumm.txt

Addition.txt

FRST.txt

[kevinf80]

Thanks for those logs, continue as follows: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Please download Zemana AntiMalware and save it to your Desktop.   Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them. Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.   Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message. Next, Download Sophos Free Virus Removal Tool and save it to your desktop. If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete..... Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...   Double click the icon and select Run Click Next Select I accept the terms in this license agreement, then click Next twice Click Install Click Finish to launch the program Once the virus database has been updated click Start Scanning If any threats are found click Details, then View log file... (bottom left hand corner) Copy and paste the results in your reply Close the Notepad document, close the Threat Details screen, then click Start cleanup Click Exit to close the program If no threats were found please confirm that result.... The Virus Removal Tool scans the following areas of your computer: Memory, including system memory on 32-bit (x86) versions of Windows The Windows registry All local hard drives, fixed and removable Mapped network drives are not scanned. Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan. Let me see those logs, also tell me if there are any remaining issues or concerns... Thank you, Kevin

 

fixlist.txt

Edited November 17, 2017 by kevinf80

[Kouga18]

Alright, all but Sophos gave me a .txt. I've named the zemana one by adding it's name to the .txt name.

Sophos came back with no threats found, adwcleaner came up with a few false positives on some stuff I trust but removed anyway, and zemana showed two things and I let it clean those.

AdwCleaner[C0].txt

Fixlog.txt

zemana2017.11.17-14.30.09-i0-t92-d3.txt

[kevinf80]

Hello Kouga18,

What is the current status of your system, does it boot up/down correctly. any odd or erratic behaviour. Does your default browser respond as expected, any odd or erratic behaviour, any redirects....

Thanls,

Kevin...

[Kouga18]

My system boots up like it usually does, a little slow because I have a couple of games and whatnot(idles for programming, etc), and it shuts down just fine. Firefox runs like it usually does and has been for a few years. Sometimes it won’t properly close and I have to end it with task manager but that’s been going on before the redirect attempts malwarebytes keeps blocking. Also the redirects seem to be sweeping available ports to find a way to connect out. 

[kevinf80]

Hiya Kouga18,

Are the outbound IP blocks still happening..?

Thanks,

Kevin...

[Kouga18]

Yeah, the outbound blocks are still happening, and it's about every 30 minutes or so.

[kevinf80]

Download RogueKiller and save it on your desktop, ensure to download correct version.. RogueKiller (X86) RogueKiller (x64)   Exit all running applications. Double-click on RogueKiller.exe to launch the tool. On its first execution, RogueKiller will disply the software license (EULA), click on "Accept" to continue. If RogueKiller is unable to load, do not hesitate to try launching it several times or rename it winlogon. Click "Start Scan" to begin the analysis. This may take some time. Once the scan is complete, click the "Open TXT" button to display the scan report. Copy/Paste it's content in your next reply. Do not use the delete option until i`ve had a look at the log..

[Kouga18]

This is the resulting log file of the scan with RogueKiller

rk_E880.tmp.txt

[kevinf80]

Can you rerun RogueKiller, when done checkmark those four (4) entries and use delete option.. Reboot your PC when done, see if the outbound IP blocks are still happening

[Kouga18]

Right now it seems like the outbound IP blocks have stopped. If they come back or don't, I'll update one last time some time tomorrow. Thank you so much for the help.

Also, if I were to keep the programs you've suggested installed, would they possibly cause conflicts or should I remove them? If they don't conflict, would it be a good idea to keep these and scan with all of them ever so often?

[kevinf80]

Thanks for the update, yes please post back to confirm if the IP blocks have ceased... Regarding tools we`ve used, I always prefer that they are removed to make sure there is no conflict with your system/security....

Delete RogueKiller portable from your Desktop, also delete this folder: C:\ProgramData\RogueKiller Next, Uninstall Sophos AV and Zemana http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Also remove this folder if still present: C:\ProgramData\Sophos Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[Kouga18]

The articles definitely were helpful, and the outbound blocked ip connections are no longer happening. I was honestly wondering if there was more than just avast as trustworthy antivirus and the first article helped with that.
Is there any that you might personally recommend other than avast?

Also, thank you so much for all of your help. I would not have been able to figure out how to remove that problem by myself

[kevinf80]

You`re very welcome Kouga18, comeback anytime. Regarding security, I use Windows own Firewall, Windows Defender and Malwarebytes Premium. I also use the following:

McShield - http://mcshield.net/

Unchecky - http://unchecky.com/

Understanding Windows Firewall - https://www.online-tech-tips.com/windows-10/adjust-windows-10-firewall-settings/

Windows Defender - https://www.howtogeek.com/225385/what’s-the-best-antivirus-for-windows-10-is-windows-defender-good-enough/

Malwarebytes - https://www.malwarebytes.com/premium/

Regards,

Kevin.......

[Kouga18]

Alright, thanks again!

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!