Website Blocked Due to Malware Keeps Popping Up

[klent313]

I keep having this notification pop up and it is always from a different IP Address. I have scanned my PC and everything comes back clean. I am afraid there may be some spyware on my computer. Any help figuring this out?

[klent313]

1 minute ago, klent313 said:

I keep having this notification pop up and it is always from a different IP Address. I have scanned my PC and everything comes back clean. I am afraid there may be some spyware on my computer. Any help figuring this out?

I will add that these are Outbound connections all from Port 0.

[Maurice Naggar]

Hello @klent313  

In order to begin to help you properly, I will need a diagnostic report in order to review & diagnose.
Specifically the FRST Farbar diagnostic report.  It is safe to get & use. Be very sure you SAVE it first.
https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

Attach FRST.txt + Addition.txt with your reply.  You may if you wish, ZIP the 2 into a zip file & then attach.
{ just please do not copy, paste their contents in main body of reply box here.) 

For Your Information:

The Block notices from Malwarebytes web protection do mean that Malwarebytes is keeping your pc safe from potential harm.
A block notice is an advisory of the "block".
A "malicious website blocked" is entirely different from a "malware detected" event.

The website  Block message indicates that a potential risk was blocked by the malicious website protection.
The Malwarebytes web protection, by default, will always show each IP block occurrence.
The Malwarebytes Webs protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.
 
See our info page https://www.malwarebytes.com/lp/ip-blocking/?ipblock=true
 
Incoming block notice can be ignored, our software is blocking the threat and there is nothing more that can be done.
On Outbound blocks, any attempted connection was stopped.
 
No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).
 A browser is not required to be running, just an active Internet connection with processes running,
such as Instant messenger clients, SKYPE or Peer-to-peer software, to trigger these alerts.

These are also triggered by banner ads running on websites which is the most common form of alert.

[klent313]

FRST.txt and Addition.txt attached.

Addition.txt FRST.txt

[Maurice Naggar]

Thank you. One other report. Look for the most recent 'Block' event in Malwarebytes history section and post that copy in a reply. 

1. Open Malwarebytes for Windows.
2. Click the Detection History card.
3. Click the History tab.
4. Look for the most-recent-dated report.
5. Hover your cursor over the report you want to view and click the eye icon (  ).
6. A Summary window displays to show the threat details, the protection date and time, and the action executed. 
7. click the Advanced tab in this window.
8. we want to download the full report, click Export, then click either Copy to Clipboard or Text File (*.txt).
9. attach that with your next reply, please.

[klent313]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 4/10/22
Protection Event Time: 12:10 PM
Log File: cae04372-b8e8-11ec-a6cd-408d5ce1960b.json

-Software Information-
Version: 4.4.10.144
Components Version: 1.0.1499
Update Package Version: 1.0.53459
License: Trial

-System Information-
OS: Windows 10 (Build 18362.1139)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, System, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: Malware
Domain:
IP Address: 194.110.115.18
Port: 0
(No malicious items detected)
Type: Outbound
File: System

 

(end)

[Maurice Naggar]

Hello @Klent313
This system has a old (out of support) build of Windows 10. More on that later. For now, the following:
Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use thuis guide https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.htmlNEXT

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. This is really just housekkeping.

We will use FRST64  on the D:\Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script is for  Klent313  only / for this machine only.

 

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .  It will rebuild the Winsock. 

NOTE-2: It will attempt to run a quick scan with MS Defender antivirus. It will attempt to help with the IP block.

NOTE-3: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. 

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome,  and Opera  & BRAVE caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

•  
• Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   D:\Downloads   folder

Fixlist.txt           <<< - - - - -

Then, Start the Windows Explorer and then, go  to the D:\Downloads   folder.

RIGHT click on FRST64    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity.

[klent313]

Fixlog.txt attached.Fixlog.txt

[Maurice Naggar]

Thank you for the log. Overall, a good run. Now we continue.
[ A ]
Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it

https://support.malwarebytes.com/hc/en-us/articles/360038520054-Download-and-install-Malwarebytes-AdwCleaner

 

Then be sure to close all web browsers.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

https://support.malwarebytes.com/hc/en-us/articles/360038520114-Malwarebytes-AdwCleaner-scan-and-clean

Attach the clean log.
{ B ]
Be real sure you let me know, IF the Block notice has gone away ( Malwarebytes real-time web protection) ??

[klent313]

I did some looking around and I think the issue stems from my VPN. I am using PIA and the IP Addresses seem to be associated with them.

[Maurice Naggar]

ohh ? How did you verify that ?

[klent313]

I looked up a few of the IP Addresses and noticed there were others with the same issue while using PIA and Malwarebytes. That being said, I have not had any of those pop-ups since starting my PC a half hour ago.

[Maurice Naggar]

Ok. Alright. See how it goes from here thru Monday.

[Maurice Naggar]

Good morning, @klent313 How is it going ? Do you still need help ?

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you