Trojan Inbound and Outbound connections almost daily

[HappyNotSad]

Hey,

so I noticed that almost every day I get random Inbound or Outbound connections that are blocked my malware bytes as Trojan or Malware.

The Inbound ones can be when I don't even have internet browser or anything open, but I don't think I get outbound ones randomly, most likely just when I go to some webiste (havent been paying much attention to when they pop up)

I run malwarebytes daily as I have the premium, also ran adwcleaner and have avast running and it found nothing, but should i be concerned that i get those inbound connections daily?

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

We need additional information.

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file:
In the Reply section in the bottom of the topic Select Click the Choose a File.
Navigate to the location of the File.
Click the file. It will appear in section.
Click the Saving button.

Please post the logs for my review.

Wait for further instructions
====
 

[HappyNotSad]

Addition.txt FRST.txt

[nasdaq]

Hi,

Sorry for this long delay. I missed your reply.
If I do not give you a reply in the next 24 hours please send me a personal message.

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

If the problem persists and you are Syncing Firefox it with other Devices reset it.

Navigate to this page and Remove it as suggested.

https://support.mozilla.org/en-US/kb/remove-synced-device-firefox-accounts

When done restart the computer normally.

If all is well.

Return to your Firefox Account and Click the Connect button.

Reset the sync.

Restart the computer normally.
<<<>>>

Please post the Fixlog.txt and let me know if the problem is solved.

fixlist.txt

[HappyNotSad]

Fixlog.txt

[nasdaq]

Hi,

The fix reset the netsh int ip reset

This is what is was.
==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{42a8d0ff-8a80-4816-8cba-bbe90748a17d}: [NameServer] 118.127.6.6,8.8.8.8
Tcpip\..\Interfaces\{a0af04a4-5cb0-4140-bdb5-ccc985f9159c}: [NameServer] 10.200.200.6,10.200.200.10
Tcpip\..\Interfaces\{d71efe86-a0a8-4a15-8355-f3ffd150802b}: [NameServer] 10.200.200.6,10.200.200.10
Tcpip\..\Interfaces\{ebaf8ff2-21ab-490f-929e-b15f9b8d213a}: [NameServer] 100.120.128.1

You can check with your Internet Provider and see what they suggest.

This article may help you restore the NAT.
https://www.windowscentral.com/how-get-open-nat-xbox-one-enabling-upnp

Hope is helps.

[HappyNotSad]

I will try to get my NAT open back somehow as now its back to strict no matter what I try. Did anything else change my IP or router configs some how?

 

Also, is this final, or anything else you require me to do to clen the PC?

Thank you

[nasdaq]

Hi,

Lets find out what was changed in the Tcpip settings

Execute the Farbar program and post only the FRST.TXT log for my review.

[HappyNotSad]

Here it is, but I messed with my settings today already and got it open, so it should be okay and also I havent recieved any notifications from malwarebytes anymore.

I did find out my router was in DMZ tho, I heard a while back its not a good idea to have it there, but I dont know.

FRST.txt

[nasdaq]

Hi,

The TCPIP's are the same as before.

Glad to see that all is well.

Read about DMZ

Check this article.
https://www.tp-link.com/ca/support/faq/28/?utm_medium=select-local

Is the DMZ set as suggested for your Router?

If you still have issues please start a new topic in this Networking Forum.
https://www.bleepingcomputer.com/forums/f/21/networking/

An expert will be able to guide you.
This is not caused by malware and not my forte

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks