123.123.123.123 Website blocked due to trojan

[lithiumFM]

Hello,

I was doing a custom scan yesterday for the first time with Premium features on and as I was doing so I received a pop-up notification from Malwarebytes about a blocked connection (I'll paste the logs at the end of my message). This only occurred once yesterday but it happened again today minutes after I launched another scan this morning. It looks like it only happens when I launch a custom scan but I have no idea.

Here are the logs (that I'll also attach to this message if you need them):

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/27/18
Protection Event Time: 12:30 AM
Log File: c3beb338-c1db-11e8-97d5-00ffadb60f27.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.463
Update Package Version: 1.0.7031
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, , Blocked, [-1], [-1],0.0.0

-Website Data-
Category: Trojan
Domain:
IP Address: 123.123.123.123
Port: [137]
Type: Outbound
File:

 

(end)

 

I have no idea if my computer is infected with something or not, I don't know what to do.

Thanks.

 

 

connection log.txt

[lithiumFM]

Hi,

Here are my scan results from MalwareBytes and FRST as asked by the "I'm infected - What do I do now?" pinned thread. I didn't include them yesterday because I didn't notice the thread, I'm sorry.

Addition.txt

FRST.txt

mbscan.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Your logs are clean.

These attacks are stopped by Malwarebytes and you are notified accordingly.

Check the Notifications settings.
Change the setting Show Malwarebytes Notifications to Off
https://content.invisioncic.com/Mmalware/monthly_2018_05/2018-05-22_10-28-24.png.a3502457b1398cbb8a3d56e78531dcbd.png

===

Let me know if all is well.

[lithiumFM]

Hi, thanks a lot for your help. The last notification I received was on Thursday at 12:34 PM so it pretty much stopped as fast as it started. What do you think happened for me to be seemingly randomly attacked like that for two days? Could it be a false positive or something similar? Will I be at risk after the trial for premium ends?

Thanks again.

[nasdaq]

Hi,

Will I be at risk after the trial for premium ends?

For the real time protection yes.
If you have any issues form it you will have to run the Malwarebytes yourself and clean what MBAM will find.

I will leave this topic open for a few days.

[lithiumFM]

It just happened again, same IP address and port. It looks like I only get a notification when I launch a scan with Malwarebytes.

 

Here it is if you wanna take a look:

 

notificationsunday.txt

[nasdaq]

These attacks are stopped by Malwarebytes and you are notified accordingly.

Check the Notifications settings.
Change the setting Show Malwarebytes Notifications to Off
https://content.invisioncic.com/Mmalware/monthly_2018_05/2018-05-22_10-28-24.png.a3502457b1398cbb8a3d56e78531dcbd.png

===

[lithiumFM]

I don't know if there's a link but web protection turned itself off and I can't turn it back on.

[nasdaq]

Hi,

Do you have the latest MBAM version.

Check it out.

===

Was Avast previously installed on this computer?

===

Are you syncing this computer with an other device?

 

[lithiumFM]

Hi,

My version is now the latest but I didn't think to check back when web protection turned itself off. What I did was reboot my computer and it turned itself back on, nothing out of the ordinary happened since.

Yes Avast was installed on this computer years ago.

The only thing I've synced my computer with is the printer which is in another room and my stereo with an audio jack from time to time.

Thank you for your time.

[nasdaq]

Hi,

Avast Does not give up so easily

I suggest you Download and Run their uninstaller.
https://www.avast.com/en-ca/uninstall-utility

Restart the computer when done.

How is the computer running now?

[lithiumFM]

Hi,

Thanks for the link, I'll download and run their uninstaller.

Computer is running fine actually, I haven't received any notifications about blocked connections since October 30, the same day I decided to block port 137 on my firewall and disable netbios. I have no idea if there's a link but nothing has happened ever since and I hope it will last.

[nasdaq]

Hi,

I hope you mean September 30.

Stay safe.

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks