Malwarebytes blocked website

[MSinghM]

I have been getting this warning when I started my Malwarebytes premium trial which was a couple of days ago. I performed a full scan and quarantined a few things, yet this still persists. The Port is different whenever the notification for the blocked website comes up. The file is always svchost.exe. I have attached the FRST and Threat Scan files. Please advise me on what to do, and help is always appreciated.

FRST.txt Addition.txt malwarebytesthreatscan.txt

[kevinf80]

Hello MSinghM and welcome to Malwarebytes, Continue with the following: Open Malwarebytes, select > "settings" > "security tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Single click on the target sight above scanner window. In the new window select Report Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Export toTxt - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Export to Txt" then attach the log to your reply... Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Kaspersky Virus Removal Tool (KVRT) from here: https://www.kaspersky.com/downloads/thank-you/free-virus-removal-tool and save to your Desktop. Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\{your user name}\DESKTOP\KVRT.exe will now show in the run box. add -dontcryptsupportinfo Note the space between KVRT.exe and -dontcryptsupportinfo C:\Users\{your user name}\DESKTOP\KVRT.exe -dontcryptsupportinfo should now show in the Run box. That addendum to the run command is very important, when the scan does eventually complete the resultant report is normally encrypted, with the extra command it is saved as a readable file. Reports are saved here C:\KVRT_data\Reports and look similar to this report_20200727_103821.klr Right click direct onto that report, select > open with > Notepad. Save that file and attach to your reply. To start the scan select OK in the "Run" box. The Windows Protected your PC window will open, select "More Info" A new Window will open, select "Run anyway" A EULA window will open, tick both confirmation boxes then select "Accept" In the new window select "Change Parameters" In the new window ensure all selection boxes are ticked, then select "OK" The scan should now start... When complete if entries are found there will be options, if "Cure" is offered leave as is. For any other options change to "Delete" then select "Continue" When complete, or if nothing was found select "Close" Attach the report information as previously instructed.... Let me see those logs in your reply.... Thank you, Kevin

[MSinghM]

Thanks for the assistance Kevin.

I have attached the logs with this reply.

kasperskyvrtreport.txt AdwCleaner[C00].txt malwarebytesscan2.txt

[kevinf80]

Kaspersky log is corrupt, or format is not correct... Can you zip up and attach the "Reports" folder from here: C:\KVRT_data\Reports

[MSinghM]

report_20200815_095653.klr.enc1.txtThe report is corrupted again, however the program did not detect anything

[kevinf80]

How is your PC responding now, any remaining issues or concerns...?

[MSinghM]

The original issue still persists unfortunately

[kevinf80]

Run the following please:

Scan with Autoruns Please download Sysinternals Autoruns from the following link: https://live.sysinternals.com/autoruns.exe save it to your desktop. Note: If using Windows Vista, Windows 7, Windows 8/8.1 or Windows 10 then you also need to do the following:   Right-click on Autoruns.exe and select Properties Click on the Compatibility tab Under Privilege Level check the box next to Run this program as an administrator Click on Apply then click OK   Double-click Autoruns.exe to run it. Once it starts, please press the Esc key on your keyboard. Now that scanning is stopped, click on the Options button at the top of the program and verify that the following are checked, if they are unchecked, check them: Hide empty locations Hide Windows entries   Click on the Options button at the top of the program and select Scan Options... then in the Autoruns Scan Options dialog enable/check the following two options: Verify code signatures Check VirusTotal.com   Once that's done click the Rescan button at the bottom of the Autoruns Scan Options dialog and this will start the scan again, this time let it finish. When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the file to your desktop and close Autoruns. Right click on the file on your desktop that you just saved and hover your mouse over Send To and select Compressed (zipped) Folder Attach the ZIP folder you just created to your next reply

[MSinghM]

autornsscan.zip

[kevinf80]

Hello MSinghM,

Do not see anything on your system to be worried about. Malwarebytes is just doing its job and stopping inbound web attacks. The inbound sniffer is listed as based in Russia, are the blocks still happening, usually they will cease after several attempts are blocked...

Thank you,

Kevin..

[MSinghM]

They are still happening, even when my PC is idle, I don't feel safe using the computer to be honest.

[kevinf80]

Hello MSinghM,

I understand your frustration, also I note that Malwarebtes is at trial so will revert to the free version shortly... The blocks are inbound so are not associated to anything on your PC that we have found with some very comprehensive scanning tools. Lets try an offline scan with Windows Defender...

Offline scan for windows 10 Open the search function, type or copy/paste Windows Defender Security Center then select ok to open that option. In the new window select Virus and Threat Protection then select Scan Options The scan options window will open, from there select Windows Defender Offline Scan You will be given the option to save any opened work etc, then select Scan from there when the scan completes Windows will reboot.. To check for found entries: Select Start , and then select Settings > Update & Security > Windows Security > Virus & threat protection . On the Virus & threat protection screen select Protection history. If entries are shown as "Found" the time and date will be same as the offline scan just completed..... Logs should be here: C:\Windows\MicrosoftAntimalware\Support   Thank you,   Kevin

 

[MSinghM]

No entries were found yet the issue still persists.

[kevinf80]

Reset your router, instructons available at the following link: http://setuprouter.com/networking/how-to-reset-your-router/ Follow those instructions very carefully. Next, Download and unzip DNSJumper to your Desktop, the tool is portable no installation necessary. Tool can be downloaded here: http://www.sordum.org/downloads/?dns-jumper   Right click on Dnsjumper.exe and select "Run as Administrator" to start the tool, For XP just double click to run. From the left hand pane select "Flush DNS" From the main interface select the dropdown under "Choose a DNS Server" From the list select either "Google Public DNS" or "Open DNS" From the left hand pane select "Apply DNS" When done re-boot your system....

[MSinghM]

Done

[kevinf80]

Any improvement..?

[MSinghM]

I'll let you know if the issue persists

[kevinf80]

Thanks for the update MSinghM, if the issue does not return we can clean up. See how things go for maybe 24 hours..

 

[MSinghM]

Alright, thanks for the help so far.

[kevinf80]

You`re very welome...

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you