Malwarebytes - Blocked Fraud Website Popped up 9/30/20

[Nilfid]

I'd had scans and did manual scans before never found anything. But, while on youtube, facebook, and other websites from big companies I had a pop up saying blocked website for trojan. Thing is I'm not sure what website that is since all I get is an IP address and I searched that IP address and found its location is in  Hangzhou, China. And none of the websites at the time stamp of 5:58pm seemed suspicious. So, I'm wondering if it took malwarebytes until 5:58pm to block the site way past me visiting the site or was immediate block at that time stamp. Also, makes me wonder if I'm infected and can't find anything malicious on my pc. The pics are details of the trojan. Since, I don't have a website I can't cross reference with my internet history.

[AdvancedSetup]

Hello @Nilfid

About the only way one can prevent an inbound connection is with your firewall to add an entry. However, it is very common for remote scans to take place as a probe to try and find a weak spot on your system.

We can go ahead though and do some scans to make sure there is nothing going on.

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[Nilfid]

I'll have to do this tomorrow cause of work, just wondering since you said disable antivirus do I disable malwarebytes too when installing all 3 of the programs?

[AdvancedSetup]

You do not need to uninstall any antivirus. For Malwarebytes if  you're using the Premium version just right click over the Task Tray icon and exit out of the program.

For you antivirus it probably has a setting to temporarily disable real-time protection.

I'll check back on you in the morning then.

Thank you @Nilfid

 

[Nilfid]

Sorry for the really late reply. I couldn't find Microsoft Smartscreen under the instructions and found mine under Windows Security - App & browser control, so not sure if this affects my results. I got another notification popup today at 9:12pm and the IP address leads to somewhere in Iran, so feel like there probably an attack going on using botnet or VPNs, possibly from single user since the attacks seem to be once a day that Malwarebytes notices when I'm on for few hours. Screenshots are from the new detection, but this time its compromised blocked website then trojan one. I posted the results for the 3 steps you listed yesterday. 0 results on anything other then Adwcleaner finding PUP.Optional.Legacy and quarantined it. Don't think Farbar Recovery Scan Tool found anything. I think these issues are connected when a Steam friend got hacked and sent me a link that I clicked "https://www.faceleague.fun/" and did some loading screen dns then Russian text then error message. The MalwarebytesResults is for the 1st step you listed and the MBRTPdetectionTrojan is the first detection history and MBRTPdetectionCompromised is the detection history today. Thanks for any help.

 

MalwarebytesResults.txt AdwCleaner[C00].txt AdwCleaner[S00].txt Addition.txt FRST.txt MBRTPdetectionTrojan.txt MBRTPdetectionCompromised.txt

[AdvancedSetup]

Yes, overall the logs look good. I don't believe there is any real issue but go ahead and temporarily disable Webroot antivirus and run the following scanner.

 

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not

Thanks

 

[Nilfid]

Didn't find anything. So, I assume that website I clicked probably knows of my existence and is the one that Malwarebytes is blocking, but no malware, spyware, etc made it through to my pc due to all the 0 results?

[Nilfid]

Thing is I got another trojan block notification from Malwarebytes from IP address in Dallas Texas. I notice my internet going really slow and I'm using an ethernet. I closed down everything that would require internet usage and my speeds are back to normal, and all I had open was youtube, steam game, and webpages for apple. Its possible the youtube was slowing me down, but I've had 20 youtube tabs opened before and never felt that sluggish. If I am getting ddos, is there a work away around that with malwarebytes or other tools?

[Nilfid]

Reportblockedwebsite..txt

[AdvancedSetup]

This is just an inbound probe. Very normal to see and normally they go away on their own within a few hours. In rare cases it can be a day or two.

As for slow network that sadly is also common as I'm sure you've seen many times before if you've been using computers very long. Constant high-speed access every where you go on the Web is never guaranteed for many various reasons.

Unless you have a sustained attack you can ignore the block.

Here are some tips on helping to better protect your computer data and privacy

 

 

[Nilfid]

Yeah, I've had slow internet days its why I went ethernet and upgraded speed, it just felt too coincidental to have the probe and 3 mbps speeds at the same time.

[Nilfid]

But, thanks really hope these probes end and don't lead to anything.

[AdvancedSetup]

Write down or review the block logs for the IP. If you continue to see the block then you can add the IP to your firewall

https://www.interserver.net/tips/kb/add-ip-address-windows-firewall/

 

[Nilfid]

Well the problem with that is the ip are all different just had 4 today when past 2 days it only been 1 a day. Kinda wondering though if I'm being used as a bot or if these are attacks. Btw is the detection history and blocking websites a feature of premium?

[AdvancedSetup]

 Yes, it comes with Trial and Paid Premium as those run Real-Time protection modules

 

[Nilfid]

Ok thank.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you