I keep getting a blocked website notification from the same website

[Flomin]

Hi there.

I downloaded this app and i keep getting this website blocked notification.

Looking at the location. I see that it is a reg file and I don't know if I should just delete this file?

Will it harm my pc in anyway

 

Please could anyone advise me on what to do.

[kevinf80]

Hello Flomin and welcome to Malwarebytes, Lets grab some logs and see whats going on, continue with the following: Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab. Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans"   Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... Thank you, Kevin....

[Flomin]

Hi there

I have done the scan and there is no history of me doing the scan for some reason.

If this is any help i just put a log of the blocked website report.

Here is the export:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 5/23/21
Protection Event Time: 9:27 AM
Log File: 4cfacf52-bb98-11eb-854f-2cf05ddd57c2.json

-Software Information-
Version: 4.3.3.116
Components Version: 1.0.1292
Update Package Version: 1.0.40806
License: Trial

-System Information-
OS: Windows 10 (Build 19042.985)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Phishing
Domain: craft.ooguy.com
IP Address: 23.19.58.60

 

Please let me know if i have done anything wrong. I'm not too sure about the first scan log but i followed your steps exactly.

 

Thank you 
Port: 1981
Type: Outbound
File: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

(end)

 

Here is the adware log:

# -------------------------------
# Malwarebytes AdwCleaner 8.2.0.0
# -------------------------------
# Build:    03-22-2021
# Database: 2021-05-17.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    05-23-2021
# Duration: 00:00:00
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKLM\Software\Wow6432Node\\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.

*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1480 octets] - [23/05/2021 09:25:07]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
 

 

 

FRST_23-05-2021 09.36.55.txt Addition_23-05-2021 09.36.55.txt

[kevinf80]

Hiya Flomin,

Use the instructions at the following link to reset Chrome, when complete see if the blocks cease..

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

Thank you,

Kevin...

[Flomin]

Hi Kevin

 

I have followed these steps and I am still getting this notification.

 

Is there anything else i could do?

 

Thank you

Flomin

 

[AdvancedSetup]

Hello @Flomin

While you wait for @kevinf80 to return please run the FRST program again and click on SCAN and post back both new logs.

Kevin will follow up with you again as soon as he is back online.

Thank you

 

[Flomin]

Hi there 

 

Here are the logs

FRST_24-05-2021 09.55.08.txt Addition_24-05-2021 09.55.08.txt

[kevinf80]

Hiya Folmin,

Thans for those logs, you mention at the start of your thread the following:

Quote

I downloaded this app and i keep getting this website blocked notification.

Which app did you download and install..? I`d also like you to attach the last three RTP logs..

To get the RTP Detection log from Malwarebytes do the following: Open Malwarebytes....   Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the RTP Detection log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply... Do these blocks only happen when you are using Chrome (your default browser) or does it affect any other browsers... Thank you, Kevin.

[Flomin]

Hi there i downloaded the Malware bytes app

Here are the 3 logs.

And no it is a notification that pops up from malware bytes once every 30 seconds so i get about 2 notifications a minute.

I disabled the pop ups from coming onto my screen because it was really frustrating. But I often check the detection history and it has been detecting this "attack" for the past 3 days now 

RTP 3.txt RTP.txt RTP 2.txt

[kevinf80]

Hiya Flomin,

Thans for those logs, I wanted to know if these blocks only happen when your Browser was in use just to prove a point. I guess you`ve cleared that up if the blocks are happening regardless...

It would seem that something on your system is trying to connect to a malicious site through C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe. Have you recently installed or started using any ASUS software.?

Thanks,

Kevin.

[Flomin]

Hi Kevin

 

I have no recollection of installing any ASUS software

Can i not just delete the file?

 

Flomin

[kevinf80]

Hiya Flomin,

The file being blocked is genuine and belongs to your system, it cannot be deleted...  Try the following:

Please download the correct portable version (32-bit or 64-bit) of RogueKiller for your system and save the file to your computer Desktop.   Right-click on the RogueKiller file and select Run as administrator to start the tool. Click Yes to accept the UAC security warning that may appear. Click Accept to agree with the EULA (End User License Agreement) and close the browser tab it will open. Now click the Scan blue button and under the Standard Scan (recommended) click on the Scan button. When the scan is complete, click on Results button. NOTE: DO NOT delete any found entries. All listed entries will be carefully analyzed. Then click on Report button. Click Export button and select "Text file". Give a name to the file such as RKlog.txt and save it to the Desktop or in a location where you can easily find it. Click the Finish button and close RogueKiller window. Copy and paste the entire contents of that log into your next reply. Thanks, Kevin..

[Flomin]

Hi Kevin 

 

I downloaded another Anti virus and ran a scan and I had a few detections. I removed them and now i see in malware bytes it has stopped that detection. but i ran the RK software anyway

so here is the log 

Thanks

Flomin

RKlog.txt

[kevinf80]

Hiya Flomin,,

Thanks for the RK log and information update. Can you post the log from the AV you used, information of what was removed is beneficial for future reference..

Can you zip up the following folder and attach to next reply...

C:\Windows\schemas\Scripts

You may have to copy the folder and save to you Desktop first...

Thank you,

Kevin.

 

 

[Flomin]

I cannot seem to find the logs from the AV i used, there is no option to look for previous scans

 

Here is the scripts file

Scripts.rar

[Flomin]

Hi 

I managed to find it Here is the log file

ESET log file.txt

[kevinf80]

Hiya Flomin,

Unfortunately ESET log is empty, a copy of the resultant scan log is stored here: C:\Users\{your username}\AppData\Local\Temp\log.txt

You will need to show hidden files and folders to view that log:

https://support.microsoft.com/en-us/windows/view-hidden-files-and-folders-in-windows-10-97fbc472-c603-9d90-91d0-1166d1d9f4b5

Regarding Scripts folder, open that folder and delete the following:

activator.cmd

hwid.kms38.gen.mk6.exe

HWID.log

The rest of the files are inert, your choice to delete or keep..

Thank you,

Kevin..

[Flomin]

Hi Kevin

So I don't have a licensed windows

I have a cracked version as I cannot afford to buy a genuine windows copy.

If i delete these wont it affect my windows?

[kevinf80]

Yes it will....!

[Flomin]

Okay i didn't delete it should i just leave it?

[Flomin]

Also I realized that i have installed ASUS software. I installed it for my RGB lights in my PC

[kevinf80]

What is happening with your system now, I cannot go any further as you have a cracked version of Windows..

[Flomin]

Okay but just one more question

Since the detections are not happening should i still be concerned or not?

[kevinf80]

Hiya Flomin,

If the blocks have ceased you should be ok.. The ESET scan is also very thorough, running that will have done a good job.. Just need to clean up:

Right click on FRST here: C:\Users\Flomin\Downloads\FRST.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Condsider the following: Disable Remote Desktop: https://www.tenforums.com/tutorials/92433-enable-disable-remote-desktop-connections-windows-10-pc.html Disable Windows Telemetry: https://helpdeskgeek.com/windows-10/how-to-disable-windows-10-telemetry/ Malwarebytes Browser Guard (Free) for Firefox: https://addons.mozilla.org/en-GB/firefox/addon/malwarebytes/ Malwarebytes Browser Guard (Free) for Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee Will also work for Opera and Edge.. PatchMyPC, keep all your software upto date - https://patchmypc.com/home-updater#download From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

Edited May 25, 2021 by kevinf80

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you