Blocks this domain name everyday all day! What is it?

[MarO]

Hello. I hope someone can help me. Everytime I open Chrome, every time on search on google, it even happens when I go to certain sites...... a notification pops up from Malwarebytes that this domain has been blocked. What is it and how do I get it removed so the threat is gone?

Thanks in advance!

BlockedWebsite.txt

[AdvancedSetup]

Hello @MarO

Please follow the directions from the following topic and let us know if that corrects the issue or  not

 

Thank you

 

[MarO]

I did what was stated here on my desktop and my cell phone. This issue is still happening. 😬 The scanner shows that there is nothing being found.

Report.txt

[MarO]

I also should note that when I opened chrome (haven't even signed in or turned sync back on yet) the notification still popped up

[AdvancedSetup]

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed click on the View Report button, then the Export button and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a checkmark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

[MarO]

Here are the results of your next steps. Thanks

Threat Report.txt AdwCleaner[C00].txt FRST.txt Addition.txt

[AdvancedSetup]

Really think this is due to not cleaning Google Chrome well enough.

Please review this entire article for help in cleaning Chrome.

https://forums.malwarebytes.com/topic/258938-resetting-google-chrome-to-clear-unexpected-issues/

 

These entries here are enough to trigger our Malwarebytes Browser Guard and even uBlock Origin blocks it as well.

You also allow multiple sites to update and send you alerts to your desktop

CHR StartupUrls: Default -> "hxxps://www.google.com/","hxxp://websearch.exitingsearch.info/?pid=1481&r=2014/03/13&hid=7364127227255511606&lg=EN&cc=US&unqvl=50","hxxps://www.google.com/"
CHR Profile: C:\Users\Test\AppData\Local\Google\Chrome\User Data\Guest Profile [2020-07-13]
CHR Profile: C:\Users\Test\AppData\Local\Google\Chrome\User Data\Profile 1 [2020-07-20]
CHR Notifications: Profile 1 -> hxxps://33230060470277.webpush.freshchat.com; hxxps://isecretshop.com; hxxps://pepetools.com; hxxps://www.instagram.com; hxxps://www.youtube.com
CHR HomePage: Profile 1 -> file:///C:/Users/MaeMae/Documents/!!AM_MyTuts/!!CT%20STUFF/~!!%20Helpful%20Stuff%20For%20My%20Tuts/BlogBanners
CHR StartupUrls: Profile 1 -> "hxxp://websearch.exitingsearch.info/?pid=1481&r=2014/03/13&hid=7364127227255511606&lg=EN&cc=US&unqvl=50"

 

Are you sure you have not enabled or allowed Push Notifications on your browser?

https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

Turn notifications on or off - Google Chrome

Web Push notifications in Firefox

 

I would also recommend going to Control Panel, Programs, Uninstall and remove Bonjour

 

What exactly is mDNSResponder.exe?

https://www.groovypost.com/howto/howto/what-is-mdnsresponder-exe-and-why-is-it-running/

MDNSResponder, also known as Bonjour, is Apple’s native zero-configuration networking process for Mac that was ported over to Windows and associated with MDNSNSP.DLL.  On a Mac or iOS device, this program is used for networking nearly everything.  On Windows, this process is only necessary for sharing libraries via iTunes and other Mac applications like the Apple TV that were ported to Windows.  Bonjour allows different computers running iTunes to communicate with each other regardless of network configuration, this is because it enables automatic network discovery.

What Is mDNSResponder.exe / Bonjour and How Can I Uninstall or Remove It?
https://www.howtogeek.com/howto/6456/what-is-mdnsresponder.exe-bonjour-and-how-can-i-uninstall-or-remove-it/

 

 

 

[MarO]

I have uninstalled Bonjour. Looks like I have some work ahead of me cleaning up Chrome. Thank you so much for your help. I am also sorry that by the looks of it, I posted this in the wrong spot. I will be back if all this don't work LOL. Thanks again!

[AdvancedSetup]

All good, this is the correct forum for help with all possible infections.

 

[AdvancedSetup]

Hello @MarO

Just following up to see how things are going. Do you still need further assistance?

Please post a status update when you have a moment.

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks