Jump to content

Malwarebytes warning me of Trojan threats many many times a day

cammun

By cammun
in Resolved Malware Removal Logs

 Share

Recommended Posts

cammun

cammun

Posted
Posted

I keep getting the same pop-up from Malwarebytes saying that it is blocking a Trojan threat. I get it every 1-2 minutes the whole time I'm online. Doesn't matter what website I'm on. I use Chrome and Firefox browsers and it shows up on both.

It started yesterday (9/17/22). It's always from the exact same domain. Here's a screenshot:

image.thumb.png.5737938611794a1d0614cadaa41be1ab.png

One popped up while I was typing into this forum. Here's another screenshot showing the detection history:

image.thumb.png.60d0ca6c8e510fa1bbf86df9edcf6ea0.png

I've run multiple virus scans yesterday and today using Malwarebytes, AdwCleaner, Webroot, and Windows Defender. All of them show no problems and no infected files. 

I tried blocking that domain. It still keeps trying and the Malwarebytes notice keeps popping up that it's being blocked. Beyond that, I don't know what to do because I'm not very technical.

This is bugging me so much and I'm scared that some kind of malware is on my computer. Why does this keep happening and how do I stop it for good?

 

image.png

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @cammun

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler
 
 
 
 
Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

image.png

image.png

image.png

 



STEP 01

  • If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
  • If you don't have Malwarebytes installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and select Scan and let it run.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Double-click to run the program
  • Accept the End User License Agreement.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, if items are found please click Quarantine.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
  • Please attach the Additions.txt log to your reply as well.
  • On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

Link to post
Share on other sites
cammun

cammun

Posted
  • Author
Posted

Once again, I need to emphasize that I am not very technical.

Some of your instructions didn't make sense to me like disabling my antivirus. Something keeps trying to attack my computer nearly every minute I'm online. The minute I'm online with no antivirus working, won't malware get into my computer? Plus, if I disable my antivirus, how can I run a scan if I've turned it off? So I didn't.

Other instructions indicated certain items or actions would be visible or pop up after the scan and that didn't happen. So I did the best I could.

While I ran several scans yesterday using most of these programs, I did it again based on your instrucation. I think I have everything you asked for, but I'm not sure. Anyway, I've attached the files here. 

I want this website [h parrable] to stop trying to attack my computer for good. 

Addition.txt AdwCleaner[S05].txt FRST.txt malwarebytes-scanResults-19Aep22.txt

  • Like 1
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Thank you for the logs @cammun

I'm off work for the next couple of days, but please get me some other logs and I'll check them and get back to you as soon as I can.

When you temporarily disable your Webroot SecureAnywhere antivirus the built-in Windows Defender antivirus will take over and protect the computer so you're not without protection.

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello, @cammun

These blocks appear to be from h.parrable.com 

Please shut down and exit out of Google Chrome and use Firefox browser. If you don't have Firefox please download it and install it temporarily.

https://www.mozilla.org/en-US/firefox/new/

Once you have Firefox installed, shut down Google Chrome and exit out of it.

Then see if you're still getting the block with Firefox or not and let me know.

 

Link to post
Share on other sites
cammun

cammun

Posted
  • Author
Posted

As I stated in my first post, I get the blocks from [h parrable] on both browsers--Google Chrome and Firefox. In that first post, I included a screenshot showing the block and that it was {h parrable} trying to attack my computer.

Why does this keep attacking my computer? How do I get it to stop for good? Is there some way to destroy it for good? Aren't these attacks illegal?

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

It looks like this code was injected into many websites. @cammun

parrable.com being one of them

They took their site offline to clean up. We will remove this block and you should hopefully no longer see it for now.

 

You can read more about it from the following links.

https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/

https://twitter.com/MBThreatIntel/status/1571949584943054848

 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Yes, it's quite possible other sites you have bookmarked, or visit may have this code still injected or a link that points to it.

Restart the computer one more time. Then if the blocks continue, grab me some new logs and I will review.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites
cammun

cammun

Posted
  • Author
Posted

I restarted my computer a couple of times in the last 18 hours. I always shut down and turn it off when I'm not using it. The pop-up block notices are still continuing on both Chrome and Firefox. So I went through the steps again and have attached the logs. 

In the last couple of hours, I was on MSN.com, ontvtonight.com, JCPenney.com, and a couple of other shopping sites. The pop-up block notices starting coming every 2-3 minutes.

Of course, I don't want my computer infected with any kind of malware so I'm glad that Malwarebytes is blocking this h.parrable.com. But I don't understand why it continually goes at my computer. I'm trying to stay away from any sites that might trigger it, but it seems to be triggered by most sites. 

Anyway, I attached the logs. Hopefully a solution is in there somewhere.

Thanks.

mbst-grab-results.zip

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Your version of Google Chrome appears to be rather old and is installed in a 32-bit folder instead of a 64-bit folder

https://www.urtech.ca/2022/08/solved-why-is-64-bit-google-chrome-installed-in-cprogram-files-x86/

x86 installation:
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

x64 installation:
"C:\Program Files\Google\Chrome\Application\chrome.exe"

 

 

Do you have any History, Data, Passwords, Login data, etc. that you want or need to keep for Google Chrome?

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

You have a few choices.

1. Locate exactly which cookie, cache, javascript, .json, .cfg, url, .places, etc. is reaching out from Google Chrome on your own. There is no way that I can do it for you.
2. Add a Content Blocker such as uBlock Orgin and Malwarebytes Browser Guard that may already block this for you.
3. Exclude detections in Malwarebytes for Windows
4. Disable Web Protection (not recommended)
5. Wait for a while and see if Malwarebytes updates can help to correct this later on
6. Let me help you export and save your current bookmarks and get a list of your extensions and then clean up and remove Google Chrome and then reinstall it fresh.
7. Use some web browser you've never used before or clean up another browser such as your Firefox and see if that one will run without getting these alerts.
8. Ignore the Alerts
9. Possibly even try creating a NEW Profile on Google Chrome and see if that one also gets the alert. My guess is it would, but you could try.
10. We could even edit your HOSTS file to redirect it to your local computer so it never reaches out to get a block alert.

Let me know what you'd like to do please and I'll be happy to assist you.

 

 

Link to post
Share on other sites
cammun

cammun

Posted
  • Author
Posted

Thanks for all your suggestions. 

I don't have enough technical knowhow for a couple of your suggetions. I'm not sure on some of the other suggestions. 

Also, since I pay for a Malwarebytes subscription, I thought that Malwarebytes Browser Guard was part of that. Is it?

I decided that right now the best option is to uninstall Google Chrome and reinstall it. I already copied all my bookmarked sites/URLs into a Word document (I decided to go old school on this) and deleted them from the bookmarks folder. I don't know what extensions I have, so I'll need some help with that. Then I'll uninstall Google Chrome.

Thank you for your help.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Malwarebytes Browser Guard is free, and offered during the install of Malwarebytes but some customer choose not to install it.

Uninstalling Google Chrome will not clean it up. Almost ALL the settings and references are not removed. When you reinstall all or most of any bad items will still be there.

If you really want to do a clean removal of Google Chrome, let me know and I can give you a script to clean up all the left over junk before you reinstall.

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please make sure you have exported and saved anything you want from Google Chrome. Once this script has been run you will not be able to recover anything from it.

Go to Control Panel, Programs, Programs and Features and uninstall Google Chrome.

 

Then restart the computer. After that, save the attached FIXLIST.TXT file to the same folder as the Farbar program

Then run the Farbar program with Admin rights and click on the FIX button.

After the removal the computer will be restarted again. It will also create a FIXLOG.txt file in the same folder as the Farbar program, please attach that your next reply.

 

fixlist.txt

Thanks @cammun

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Great, let me have you run the following, please and we'll check out other potential program issues.

 

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

  • Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
  • If Microsoft SmartScreen blocks the download, click through to save the file
  • This tool is safe.   Smartscreen is overly sensitive.
  • If SmartScreen blocks the file from running click on More info and Run anyway
  • Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
  • You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

image.png

image.png

image.png

 

Thank you

 

 

Link to post
Share on other sites
  • 1 month later...
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.