LDachinger Posted September 13, 2019 ID:1334596 Share Posted September 13, 2019 I have a similar issue. Here are the log details. How do I fix this? Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 9/12/19 Protection Event Time: 8:47 PM Log File: 0441ce7e-d5c0-11e9-8d78-204747f09d1c.json -Software Information- Version: 3.8.3.2965 Components Version: 1.0.625 Update Package Version: 1.0.12443 License: Premium -System Information- OS: Windows 10 (Build 17763.737) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Trojan Domain: IP Address: 74.115.50.111 Port: [53097] Type: Outbound File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (end) Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334597 Share Posted September 13, 2019 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 13, 2019 Root Admin ID:1334638 Share Posted September 13, 2019 Hello @LDachinger Please follow the instructions from the following topic and let me know if that corrects the issue or not Thanks Ron Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334671 Share Posted September 13, 2019 unfortunately that did not work, still getting the popup from Malwarebytes, and it still does not show up on scans Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334672 Share Posted September 13, 2019 its only happening when I try to connect to my online store. Here are my steps: Connect to Square Up (online POS) click through to my store - gets me to Weebly dashboard click on manage my store which brings me to my list of items and that is when Malwarebytes kicks in and tells me there is a Trojan (screenshot above and below) When it started yesterday, I didn't realize what was happening and proceeded to upload a bunch of product pictures (which obviously failed) and that is when I started to try to figure it out. thanks so much for your help! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 13, 2019 Root Admin ID:1334735 Share Posted September 13, 2019 Can you please try the same thing in Mozilla Firefox and let me know if that works properly or not. https://www.mozilla.org/en-US/firefox/ Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334738 Share Posted September 13, 2019 installed firefox, went to squareup to log in. will not accept my username/pswd in firefox browser. site will accept my username/pswd in chrome browser Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334741 Share Posted September 13, 2019 my bad - square blocked me because of the new browser. Ok to log into square, but as I continue on to the store, same thing happens. below is the screenshot of the popup Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 13, 2019 Root Admin ID:1334756 Share Posted September 13, 2019 I checked and we are blocking this site. Let me check with the Research Team and see what's up and get back to you Link to post Share on other sites More sharing options...
Staff Zynthesist Posted September 13, 2019 Staff ID:1334759 Share Posted September 13, 2019 We are in contact with the hosting company about this block. Once we hear back from them we will update this post. I see they have taken action recently by removing one of the malicious files I provided them the info to. So they are being proactive on this. Directly on IP itself: http://74.115.50.111/uploads/1/2/0/9/120925418/b (Miner) https://www.virustotal.com/gui/file/77bdbc82713640f2581aa300bc4b68b55bcd65e0b207c4555d9c658fbf2e2c90/detection Removed by hosting: http://126948494-541801340935368688.preview.editmysite.com/uploads/1/2/6/9/126948494/documento387.exe (Backdoor.Avemaria) Link to post Share on other sites More sharing options...
LDachinger Posted September 13, 2019 Author ID:1334760 Share Posted September 13, 2019 thank you so much for your help!!! Greatly appreciated!! Link to post Share on other sites More sharing options...
Staff Zynthesist Posted September 14, 2019 Staff ID:1334856 Share Posted September 14, 2019 Hosting is taking action and removing reported files so block is being removed. Link to post Share on other sites More sharing options...
LDachinger Posted September 14, 2019 Author ID:1334862 Share Posted September 14, 2019 That's great, thank you! How long does it take until the block is removed? Link to post Share on other sites More sharing options...
LDachinger Posted September 14, 2019 Author ID:1334901 Share Posted September 14, 2019 2:45pm and I seem to be back in business! Thanks so much for your help!!! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 16, 2019 Root Admin ID:1335123 Share Posted September 16, 2019 Glad that everything is back working again @LDachinger Did you need anything else then before I close your topic? Thanks Ron Link to post Share on other sites More sharing options...
LDachinger Posted September 17, 2019 Author ID:1335338 Share Posted September 17, 2019 I'm all set. Everything is working great. Thanks again for your help! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 17, 2019 Root Admin ID:1335466 Share Posted September 17, 2019 If you're not backing up your data and you're still using Google Chrome then you're just not serious about Privacy, Safety, and protecting your data. Malwarebytes is a fantastic program but you still need to back up your data and you still need to block scripts and Ads in your browser. If you're still using Google Chrome I would highly suggest you consider using Firefox instead. For more advanced users you might consider installing NoScript as well (it does have a higher learning curve though) Help Secure your browsers You may be interested in using our new Malwarebytes Browser Guard to help protect your browser from items that uBlock or others don't target. Please install uBlock Origin for your browsers to better protect your system. FireFox, Chrome, Opera , Safari, Microsoft EdgeAdBlock for Internet Explorer How to use uBlock Origin to protect your online privacy and security | uBlock Origin tutorial 2018This video tutorial above explains how to use uBlock Origin in advanced user mode and all the advanced settings to protect your online privacy and help prevent unwanted sites from changing your browser settings Delete Cookies Automatically Cookie AutoDelete pluginChrome | Firefox Browser push notifications: a feature asking to be abusedHTTPS EverywhereNOTHING TO HIDE documentary Review your email and Office choices Quit Gmail for free encrypted email - TutanotaWhy ProtonMail Is More Secure Than GmailLibreOffice - Free and open source office suite Use Password Management software BitwardenKeePass Password Safe Make sure you use a strong master password Then set the key transformation settings (the link below helps provide information on how to choose good settings)https://pthree.org/2016/06/29/further-investigation-into-scrypt-and-argon2-password-hashingKeePass Password Manager: Full Detailed Setup (good YouTube video on setup and using Keepass but choose the Argon2 method for Key transformation) Encrypted Instant Messenger and Voice Calls RiotSignalWireWickr Me Follow-up Reading Everything you need to know about cybercrime 10 easy ways to prevent malware infection Keep your data backed up Thank you for choosing Malwarebytes as your preferred security protection software and tell your friends and family too. We're here to help. Ron Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 17, 2019 Root Admin ID:1335476 Share Posted September 17, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts