Osnail Posted January 17, 2019 ID:1293131 Share Posted January 17, 2019 Hi, My copy of Malwarebytes has started blocking vbc.exe from making an outbound call. vbc.exe is Visual C++ if I'm not mistaken. Why would this happen? I did look at removing the Visual C++ but I have 22 instances of them (ranging from 2005-2017) Any help appreciated... Here is one of the reports; Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 17/01/2019 Protection Event Time: 18:55 Log File: 688bda16-1a89-11e9-a577-80fa5b0d19a1.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.508 Update Package Version: 1.0.8824 Licence: Premium in Grace Period -System Information- OS: Windows 10 (Build 17134.523) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Trojan Domain: dcmkrebglpgzc.cloudfront.net IP Address: 54.230.0.238 Port: [25976] Type: Outbound File: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe (end) Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 18, 2019 Root Admin ID:1293209 Share Posted January 18, 2019 Hello @Osnail and Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan Now. When finished, please click Clean & Repair. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. RESTART THE COMPUTER Before running Step 3 STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
Osnail Posted January 18, 2019 Author ID:1293240 Share Posted January 18, 2019 Thank you Ron - I've attached the files as requested! Adw found a couple of things but programs I've been using for a long time now, feel free to suggest if I should be using alternatives? Really appreciate your help.. Malwarebytes log.txt AdwCleaner.txt FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 18, 2019 Root Admin ID:1293372 Share Posted January 18, 2019 Thanks @Osnail Give me some time to review your logs and get back with you. In the meantime, please uninstall all versions of Java as older versions contain compromised code. If possible I'd recommend not using Java but if you have to have it then after you've removed all versions and rebooted then go ahead and reinstall the latest version again from https://java.com Java 8 Update 161 Java 8 Update 161 Java 8 Update 171 Java 8 Update 171 Java 8 Update 172 Java 8 Update 172 Java 8 Update 181 Java 8 Update 181 Java 8 Update 191 Java 8 Update 191 Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 19, 2019 Root Admin ID:1293442 Share Posted January 19, 2019 Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks Ron Link to post Share on other sites More sharing options...
Osnail Posted January 19, 2019 Author ID:1293469 Share Posted January 19, 2019 Thank you @AdvancedSetup Ron... Attached is the output. All look ok? Thank you very much for your help! Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 20, 2019 Root Admin ID:1293564 Share Posted January 20, 2019 Yes, log looks good. Please let me know if you continue to get the blocked message any more or not. Thank you Ron Link to post Share on other sites More sharing options...
Osnail Posted January 20, 2019 Author ID:1293584 Share Posted January 20, 2019 5 hours ago, AdvancedSetup said: Yes, log looks good. Please let me know if you continue to get the blocked message any more or not. Thank you Ron @AdvancedSetup Hi Ron, Looks great.. No pop ups and running smoothly again! Thank you very much for your support! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 21, 2019 Root Admin ID:1293674 Share Posted January 21, 2019 Great, glad to hear. You're quite welcome. Take care and stay safe out there Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 21, 2019 Root Admin ID:1293675 Share Posted January 21, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts