fladventurerob Posted November 16, 2018 ID:1281398 Share Posted November 16, 2018 I have this exact same issue which just started today also. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281406 Share Posted November 16, 2018 How could it have just started for you @fladventurerob ? You just signed up an hour ago. Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281410 Share Posted November 16, 2018 3 minutes ago, AdvancedSetup said: How could it have just started for you @fladventurerob ? You just signed up an hour ago. How do you correlate how long ago I signed up on a forum with the length of time I have had any particular issue? That's like saying I must not like peanut butter because I just signed up an hour ago, it makes no sense. However, I will make the general comment that I signed up an hour ago because I saw someone with the same problem as me, which just started on my Malwarebytes today. I was under the presumption that someone involved in investigation and problem-solving would have come to this easy conclusion, since the initial issue was posted just 6 hours ago by Gruber013. I see that I came to the wrong place to get an answer to this annoying problem. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281415 Share Posted November 16, 2018 I'm sorry @fladventurerob I apologize. I had another tab open in my browser for a user replying about a forum view issue. I didn't realize the tab had changed when I replied to you. For your issue let me have you run the following and we'll see what's causing it. Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thank you Ron Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281424 Share Posted November 16, 2018 #1 20 mins into the "quick scan" and zero identified items (I have Malwarebytes Corporate) #2 Attached #3 site is down I am extremely vigilant and think this is an issue related to a windows update, rather than any infection or malware. AdwCleaner[S00].txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281425 Share Posted November 16, 2018 It very well could be a false positive. Do you have the protection log that detected it? Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281428 Share Posted November 16, 2018 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281430 Share Posted November 16, 2018 Can you please open or export out the log so that I can see the entire log information. Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281431 Share Posted November 16, 2018 There is no way for me to export it but there is nothing else to see. It looks as though powershell is self-executing. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281432 Share Posted November 16, 2018 This link should still be valid. https://download.bleepingcomputer.com/maint/FRST64.exe This is for x64 Please download that and run it and post back the log Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281433 Share Posted November 16, 2018 No, its not a valid link Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281434 Share Posted November 16, 2018 Yeah, I just clicked it and it's down for me too. One moment. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281435 Share Posted November 16, 2018 Please click on Start and type in CMD.EXE and when it shows, right click and choose "Run as administrator" then type in the following or copy/paste and then post back the log on your desktop called ScheduledTasks.txt SCHTASKS /Query /FO LIST /V >"%USERPROFILE%\desktop\ScheduledTasks.txt" That should show us if any unexpected PowerShell scheduled tasks are being kicked off Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281436 Share Posted November 16, 2018 Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281437 Share Posted November 16, 2018 ScheduledTasks.zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281439 Share Posted November 16, 2018 No PowerShell scheduled in that list. Has Windows done an update and rebooted the box recently? Can you check for updates and see. Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281440 Share Posted November 16, 2018 Yes, it did last night and is up to date. I just checked again. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281443 Share Posted November 16, 2018 Which version of Malwarebytes are you running? The screenshot looks like you're running a standalone version of Malwarebytes Anti-Exploit, is that correct? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281444 Share Posted November 16, 2018 I'm checking to see if we have any known false positives from PowerShell being reported. Are the blocks still happening? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281445 Share Posted November 16, 2018 The site appears to be back up again. Can you please download and run the following for me. Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to the disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks, Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 16, 2018 Root Admin ID:1281447 Share Posted November 16, 2018 Okay, looks like you may be gone for the evening. I'll check back on you again sometime tomorrow. I've put in a request to verify if this was a false positive. Thank you again and have a great evening. Ron Link to post Share on other sites More sharing options...
fladventurerob Posted November 16, 2018 Author ID:1281586 Share Posted November 16, 2018 Attached FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 17, 2018 Root Admin ID:1281680 Share Posted November 17, 2018 You have an old, compromised version of Java. Please uninstall all versions of Java. If possible I'd highly recommend trying to use your computer without Java. If you really have to have it then always keep it up to date - https://java.com Don't see anything related to PowerShell being launched in the logs. Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks, Ron Link to post Share on other sites More sharing options...
fladventurerob Posted November 17, 2018 Author ID:1281698 Share Posted November 17, 2018 What do you mean "compromised" Link to post Share on other sites More sharing options...
fladventurerob Posted November 17, 2018 Author ID:1281701 Share Posted November 17, 2018 Is it just out of date and the potential exists, or has it been truly compromised somehow? Link to post Share on other sites More sharing options...
Recommended Posts