TheSirPancake Posted April 13, 2018 ID:1232640 Share Posted April 13, 2018 Hello all, Everytime I open chrome I get a notification telling me that malwarebytes has blocked "api.testrequest.info" and there is usually a 1-4 after api. I have scanned with malwarebytes and used adwcleaner but the problem still persists. Anybody got an idea of how to fix this? Link to post Share on other sites More sharing options...
Staff Malwarebytes Posted April 13, 2018 Staff ID:1232641 Share Posted April 13, 2018 ***This is an automated reply*** Hi, Thanks for posting in the Malwarebytes 3 Help forum. If you are having technical issues with our Windows product, please do the following: Spoiler If you haven't done so already, please run these two tools and then attach the logs in your next reply: NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Farbar Recovery Scan Tool (FRST) Download FRST and save it to your desktopNote: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run FRST and when the tool opens click "Yes" to the disclaimer Press the "Scan" button This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions MB-Check Download MB-Check and save to your desktop Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" This will produce one log file on your desktop: mb-check-results.zip This file will include the FRST logs generated from the previous set of instructions Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area One of our experts will be able to assist you shortly. If you are having licensing issues, please do the following: Spoiler For any of these issues: Renewals Refunds (including double billing) Cancellations Update Billing Info Multiple Transactions Consumer Purchases Transaction Receipt Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 Thanks in advance for your patience. -The Malwarebytes Forum Team Link to post Share on other sites More sharing options...
vbarytskyy Posted April 13, 2018 ID:1232649 Share Posted April 13, 2018 @TheSirPancake Could we get some logs to look into? Download and run the Malwarebytes Support Tool Accept the EULA and click Advanced Options Choose Gather Logs, and once it's done, upload the zip file it creates on your desktop (mbst-grab-results.zip) Link to post Share on other sites More sharing options...
TheSirPancake Posted April 13, 2018 Author ID:1232655 Share Posted April 13, 2018 Hi, I have attached the log. Hopefully this gets resolved! mbst-grab-results.zip Link to post Share on other sites More sharing options...
vbarytskyy Posted April 13, 2018 ID:1232664 Share Posted April 13, 2018 Thank you for the logs. I am going to move this topic to our malware removal section so our experts can take a look. Link to post Share on other sites More sharing options...
AndiShabanaj Posted April 14, 2018 ID:1233062 Share Posted April 14, 2018 I'm experiencing the same thing, has there been a sloution found yet? Link to post Share on other sites More sharing options...
TheSirPancake Posted April 15, 2018 Author ID:1233159 Share Posted April 15, 2018 Nope. Link to post Share on other sites More sharing options...
Staff CatByte Posted April 16, 2018 Staff ID:1233565 Share Posted April 16, 2018 Hello TheSirPancake. Your Windows Defender has alerted on this Chrome extension CHR Extension: (Adblocker for Youtube™) - C:\Users\Isaac\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhhhfgfhbjnkpaoedekoofphhbagpooj [2018-04-08] I do recommend uninstalling that extension: NEXT There does appear to be infection present. Please upload the following to Virus total is still present C:\Program Files (x86)\FpyEWGzDFWVVpLycIFR\RyJgGGl.dll C:\Program Files (x86)\muZPPgwvU\vcPFlq.dll C:\Program Files (x86)\GYHHaWMnbkQU2\wvhcEPmFVlCqx.dll These actual names might not be there but random names using the same format might still be if you could upload those please: http://www.virustotal.com Use the browse button on that page to navigate to the location of the file to be scanned. In the right hand panel, click on the file "C:\Program Files (x86)\FpyEWGzDFWVVpLycIFR\RyJgGGl.dll" then click the open button. The file will now be displayed in the submit box. Scroll down a bit and click "send file", wait for the results If you get a message saying File has already been analyzed: click Reanalyze file now Once scanned, copy and paste the link to the results page in your next reply. Make sure you have copied and saved the results before continuing. Do the same for the following files: C:\Program Files (x86)\muZPPgwvU\vcPFlq.dll C:\Program Files (x86)\GYHHaWMnbkQU2\wvhcEPmFVlCqx.dll NEXT Please do the following: Download the attached fixlist.txt file and save it to the Downloads folder, where FRSTEnglish.exe is saved. Fixlist.txt NOTE. It's important that both files, FRSTEnglish.exe and fixlist.txt are in the same location or the fix will not work. Run the FRSTEnglish.exe program and press the Fix button just once and wait. The tool will make a log in the same folder as where the FRST program is saved. (Fixlog.txt). Please attach it to your reply. (note: sometimes the program will need to reboot - please allow it to do so) NEXT Please run the following: Please download AdwCleaner from the following link and save it to your desktop or downloads folder. adwCleaner Please wait and look toward the top or bottom of your browser for the option to Run or Save. Click Save to save the file. Double click on AdwCleaner.exe to run the tool. Click on the Scan Now button After the scan has finished... click on the Clean and Repair button. (A reboot will be required) Press OK again to allow AdwCleaner to restart the computer and complete the removal process. After rebooting, a log file report AdwCleaner.txt will open automatically. If it does not > click on Log Files on the left, find the most recent scan log and open it, save it to your desktop. Attach that log file to your next reply. Please let me know if there are any outstanding issues. Link to post Share on other sites More sharing options...
TheSirPancake Posted April 16, 2018 Author ID:1233593 Share Posted April 16, 2018 Hi, I cannot seem to find a .dll file in any of my x86 folder. Nor can I see it in regular program files. Moving on, I have attached the two other files. Thanks for the help so far, and I am hopeful this will get resolved. Kind regards, TheSirPancake AdwCleaner[S05].txt Fixlog.txt Link to post Share on other sites More sharing options...
Staff CatByte Posted April 16, 2018 Staff ID:1233595 Share Posted April 16, 2018 ok, How are things running now, are you still getting IP blocks with chrome? Link to post Share on other sites More sharing options...
TheSirPancake Posted April 16, 2018 Author ID:1233596 Share Posted April 16, 2018 Hi, Somehow the IP blocks are gone. I hope this is the end of my issues! I thank you, CatByte and vbarytskyy for your help. It's astounding how easy this was! Best wishes, TheSirPancake. Link to post Share on other sites More sharing options...
Staff CatByte Posted April 16, 2018 Staff ID:1233597 Share Posted April 16, 2018 you are quite welcome Link to post Share on other sites More sharing options...
Staff CatByte Posted April 16, 2018 Staff ID:1233598 Share Posted April 16, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts