Malwarebytes detecting an outbound Trojan on Everything Variation 3

[timber]

I have got the same problem as the person who created this topic..

This topic also refers to the first topic.

As asked by nasdaq: I've already followed the first steps and the scan made the FRST.txt file and the Attached.txt file.

FRST.txt

Addition.txt

[TwinHeadedEagle]

Hello,

 

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

fixlist.txt

[timber]

Hello TwinHeaderEagle, 
Thank you for the fast response!

An update on my post: yesterday I've installed HitmanPro and scanned my pc. It found the Trojan virus and deleted it. Since then, I haven't gotten any more Outbound Connection notifications from Malwarebytes. I've rescanned with the FRST-tool. The results are attached below.

Now I've also done the fix with fixlist. That log is also attached. 

Thanks! 

Addition.txt

FRST.txt

Fixlog.txt

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

 

 

 

How is the situation after this fix?

fixlist.txt

[timber]

Hi, 

This is the new fixlog file. 

Thansk for helping me! 

 

Fixlog.txt

[TwinHeadedEagle]

How is the situation now?

[timber]

Still good! Since I've tried to delete the trojan horse with HitmanPro, I haven't gotten any more Outbound Connection notifications from Malwarebytes everytime I open a website. All the other malfunctions like a slow internet connection also disappeared. 
However, everytime my PC is started, the following Outbound Connection is triggered: 
 

[TwinHeadedEagle]

Can you get another set of logs? I would like to see HitmansPro's scan report as well?

[timber]

This is the Hitman pro scan report: 

HitmanPro_20181210_2055.log

[timber]

This is one of the reports of malwarebytes about the outbound connection: 

 

malwarebytes-report.txt

[TwinHeadedEagle]

Go to Chrome settings > Advanced > Privacy and Security.

Click Manage Certificates and then click on Trusted Root tab. 

Can you make a picture of everything that is in there?

[timber]

Here are the screenshots. I took multiple screenshots because windows didn't allow me to expand the popup.

screenshots.zip

[timber]

@TwinHeadedEagle, do you've got an update on my problem? I keep getting the same outbound connections. 
 

Thanks in advance!

[TwinHeadedEagle]

Sorry. There are certificates with this pattern ???????-????-????-????-?????????????

Do you know what they belong to?

[timber]

I have no idea what they belong to. Should I delete them? 

[TwinHeadedEagle]

Yes, please try to do so.

[AdvancedSetup]

Helo @timber

Are you still with us? Do you still need help?

 

Thanks

Ron

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks