what is lt.lunrac.com?

[BreadmanYan]

Malwarebytes has warned me of this site twice today and I have no idea where it's coming from. I really hope this isn't going to be another 2018 where I gotta play whack-a-mole until it magically disappears.

[BreadmanYan]

It seems to be triggered by re-opening chrome.

[Maurice Naggar]

Hi,    

My name is Maurice. I will be helping and guiding you, going forward on this case.

Let me know what first name you prefer to go by.

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible.

Please know I help here as a volunteer.  and that I am not on 24 x 7.

Help on this forum is one to one.  

 

Please only just attach   all report files, etc  that I ask for as we go along.

The goal of this sub-forum is to help you to check about whether or not there is a malware infection.  The block notice message is how the program lets you know in real time that it is protecting your system.  That is the real time web protection.

Do you recall what Chrome was used for or what website it was on at that "block" moment ?   Were you reading Emails online ?   If the latter, it could be advertising embedded in email that is trying to go to a link that is identified as a threat.

The block event should not be considered as a finder of a infection.    We will do several scans to check for any malware presence.

Tell me, Have you done a scan with Malwarebytes for Windows ?

.

These here are only just the starter steps, for now focused on the Chrome browser.

[   1  ]

Using Chrome browser go to https://www.google.com/settings/chrome/sync and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok".

[   2    ]

See this article on our Malwarebytes Blog
https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

 

You want to disable the ability of each web browser on this machine from being able to allow "push ads". That means Chrome, Firefox, or Edge browser (on Windows 10), or on Opera.

Scroll down to the tips section "How do I disable them".

 

[   3   ]

I suggest you install the Malwarebytes Browser Guard for Chrome.

To get & install the Malwarebytes Browser Guard extension for Chrome,

Open this link in your Chrome   browser: 

https://chrome.google.com/webstore/detail/malwarebytes/ihcjicgdanjaechkgeegckofjjedodee

 

Then proceed with the setup.

[   4    ]

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history"

Check mark the line "Download history"

Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )

 [    5    ]

After that, make real sure that Chrome is "NOT" set to reload the pages from the last session

Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the adress bar

Then look deeper in SETTINGS

 

 

Make real sure it is "NOT" set to "continue where you left off"

 

[    6     ]

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.

Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan.

Adwcleaner  detects factory Preinstalled applications too!

 

Please download  Malwarebytes AdwCleaner  https://downloads.malwarebytes.com/file/adwcleaner
 

Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

 

Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it.

At the prompt for license agreement, review and then click on I agree.

 

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).

Then click on Dashboard button.

Click the blue button "Scan Now".

 

allow it a few minutes to finish the Scan.   Let it remove what it finds.

NOTE:  When it comes to the section "

Pre-installed applications

 

You can skip that.

Please find and send the Adwcleaner "C" clean report.

In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".

Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

 

That C clean report will be the one with the most recent Date and time at folder  C:\AdwCleaner\Logs

[     7      ]

Please do the steps outlined on this pinned topic    https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Sincerely.

Edited March 21, 2020 by Maurice Naggar

[Maurice Naggar]

For Your Information:

 

The Block notices from Malwarebytes web protection do mean that Malwarebytes Premium is keeping your pc safe from potential harm.

A block notice is an advisory of the "block".

 

It  indicates that a potential risk was blocked by the malicious website protection. 

The Malwarebytes web protection, by default, will always show each  block occurrence.

The Malwarebytes Webs protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.

 

See our info page https://www.malwarebytes.com/lp/ip-blocking/?ipblock=true

 

Incoming block notice can be ignored, our software is blocking the threat and there is nothing more that can be done.

On Outbound blocks, any attempted connection was stopped.

 

No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).

 A browser is not required to be running, just an active Internet connection with processes running,

such as Instant messenger clients, SKYPE or Peer-to-peer software, to trigger these alerts.

 

These may  also be triggered by banner ads running on websites which is the most common form of alert.  These may perhaps happen when reading emails that happen to have embedded links to ads, or malvertising.

.

[Maurice Naggar]

To Zalpal:
This case / thread is only for BreadmanYan only.   Your post will be split off.
Do the steps outlined on this pinned topic & attach the reports there
https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

The malware-removal-help section of this forum is not a group thing.  Help is one-to-one.
Anyone else with a similar issue, make your own Topic
https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

[AdvancedSetup]

Please note that this link was removed from our database the other day. Please make sure you update Malwarebytes to the latest version and let us know if the block continues

 

[Maurice Naggar]

Good morning.

Please just do an Update in Malwarebytes for Windows.

In Settings,  and then on the General tab, you want to press the button "Check for Updates"

That will insure that the Malwarebytes program is all up to date.   You should then not be seeing any new block message about "lunrac.com".

I would appreciate hearing back from you.

Sincerely.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks