Website blocked due to Trojan (66.42.80.240)

[anig]

Hi,

I have a constant "website blocked due to Trojan" message popping up from malwarebytes although it shows that my computer is clean.

I tried several antivirus programs besides malwarebytes but nothing works.

The IP it's trying to connect to is: 66.42.80.240
The port keeps changing on every popup.
Type is: Outbound Connection.
Category: Trojan

 

Please help!

 

[anig]

I discovered that "System" process, NT Kernel & System, the one with PID 4 (ntoskrnl.exe) is connecting to 66.42.80.240

But I don't know why and how to solve it.

Please help.

 

[kevinf80]

Hello anig and welcome to Malwarebytes,

Run this please..

Scan with Autoruns Please download Sysinternals Autoruns from the following link: https://live.sysinternals.com/autoruns.exe save it to your desktop. Note: If using Windows Vista, Windows 7, Windows 8/8.1 or Windows 10 then you also need to do the following:   Right-click on Autoruns.exe and select Properties Click on the Compatibility tab Under Privilege Level check the box next to Run this program as an administrator Click on Apply then click OK   Double-click Autoruns.exe to run it. Once it starts, please press the Esc key on your keyboard. Now that scanning is stopped, click on the Options button at the top of the program and verify that the following are checked, if they are unchecked, check them: Hide empty locations Hide Windows entries   Click on the Options button at the top of the program and select Scan Options... then in the Autoruns Scan Options dialog enable/check the following two options: Verify code signatures Check VirusTotal.com   Once that's done click the Rescan button at the bottom of the Autoruns Scan Options dialog and this will start the scan again, this time let it finish. When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the file to your desktop and close Autoruns. Right click on the file on your desktop that you just saved and hover your mouse over Send To and select Compressed (zipped) Folder Attach the ZIP folder you just created to your next reply Thank you, Kevin...

[anig]

It's attached.

 

Thank you very much!

 

DESKTOP-85SV6T9.zip

[kevinf80]

Can you navigate to c:\windows\system32\drivers\nfstat.sys right click on nfstat.sys and select "rename" then rename to nfstat.sys.vir

Reboot and see if the problem clears

[anig]

Hi kevin,

yesterday MalwareBytes performed the automatic update and then the trojan was finally detected and cleaned. See the attached report.txt

No more message popping up!

Well done, guys!

Thank you very much

[kevinf80]

Yes Malwarebytes definitions will have been updated to deal with that infection.... Good to hear your system is now clean...

Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks