Jump to content

Website blocked Inbound Connection Trojan Again

ronaldmyth

By ronaldmyth
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @ronaldmyth

You can't really stop inbound except with a firewall. There are millions of computers out there that are already owned and used by criminals and part of what they do is probe computers around the clock looking for openings so they can control your computer too for illegal use.

Please do the following scans for me so that we can ensure the computer has not current threats on it. Normally long term probing is rare. Once they probe and don't find something normally they move on. If it's the same IP over and over you can add it to your firewall to block it.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, please click Clean & Repair.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

Link to post
Share on other sites
ronaldmyth

ronaldmyth

Posted
  • Author
Posted

So probing by hackers is happens often and nearly everyone in the world that connected to internet have the same problem like mine? I noticed every month at least there are 3 until 8 notification that either trojan or malvertising with different IP, there's a gap between a few days, rare occasion hours.

Can i block the port instead of the IP? I made 2 rules that block incoming inbound local port 123, 135, 1900 and 139, 445, 3389 but one of them got blocked again by malwarebytes, so i guess the rules didn't work.

Should i just ignore the notification since malwarebytes did the job blocking the inbound connection? The scan show no infection on my PC.

Addition.txt

FRST.txt

Log.txt

Scan.txt

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted (edited)

Do you know what Alternate Data Streams are and do you use them on your own?

I ask because the computer has some that are on the system and pretty big compared to what one normally sees in logs. Normally I just remove them but if you've created them yourself for some reason I don't want to blindly remove them. 

 

Your computer is also having the following issue according to the Event Logs. Something we need to check into further for resolution or explanation.

Error: (01/18/2019 01:46:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

These are all very ancient program entries. Please confirm if you're still using any of them. Most are almost a decade old.

 

HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [37888 2009-04-11] ()
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [83240 2008-03-20] (Cyberlink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2007-12-14] ()
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [91432 2008-03-21] (cyberlink)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)

 

 

 

Edited by AdvancedSetup
Updated information
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Let's clean your computer up some before we make any other decisions.

 

Assuming you've not created the Alternate Data Streams yourself please run the following fix which will remove them as well as some other potentially invalid files that don't belong on the computer.


Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted (edited)

Log looks good. See how things go now and if the blocks die down any or not.

 

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

 

Thank you for choosing Malwarebytes
 

Edited by AdvancedSetup
updated links
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Yes, I believe you're right about the uBlock. I've checked with some others and they provided this link for me. I will adjust my reply message for that. Thank you.

https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-completely-unrelated-to-the-web-site-ublock.org

 

Link to post
Share on other sites
ronaldmyth

ronaldmyth

Posted
  • Author
Posted

Hi Ron i rechecking FRST after updated my windows and notice there's another ADS appearing in Addition.txt, i'm not sure where that ADS come from.

AlternateDataStreams: C:\Users\Mike\Application Data:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\Mike\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]

 

Addition.txt

FRST.txt

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Not sure, maybe I missed it before or antivirus put it in, I've seen that from some antivirus programs before.


Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Ron

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

I did update the information about adding an Ad Blocker above to the following

 

 

Help Secure your browsers

Please install uBlock Origin for your browsers to better protect your system

FireFox, Chrome, Opera , Safari, Microsoft Edge
AdBlock for Internet Explorer

Follow-up Reading

Everything you need to know about cybercrime
10 easy ways to prevent malware infection 
Keep your data backed up

 

Thank you for choosing Malwarebytes
 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

That was just a minor removal and it went well.

Overall the computer should be doing okay. If you're still having signs of infection though please let me know. As I said before, we can't really do much about inbound probes but you can add IP addresses to your firewall if needed.

Let me know

Thanks

Ron

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.