RTP outbound connections

[LucidKarma]

Hey, I need some help, as of right now malware bytes has been repeatedly sending me alerts of outbound connections being blocked. I have attached what it says on malwarebytes history. It has included lots of different types of details ranging from, Trojan, Compromised and RiskWare and with various different IPs and Ports. I have scanned used malware bytes lots of times and nothing seems to come up, however I have done a little testing and these events usually happen in batches when I begin a download on a game launcher (in this case it is wargaming)

Thanks in advanced

[Maurice Naggar]

Hello  

I will guide you along on looking for remaining malware. Lets keep these principles as we go along.

• Removing malware can be unpredictable
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply
• The IP block actions by Malwarebytes are keeping the machine safe from potential threats.
• I do need the support zip reports to see more detail  ( the screen grabs just do not have full details + those screens give no clue as to what processes are running.

[LucidKarma]

Ok thank you for the reply, I have attached the files you have requested however you said you need the "support zip reports" i'm not sure what you mean by that but if it is not included in what I attached please let me know, thank you for your help

mbst-grab-results.zip

[LucidKarma]

Hello, are there any updates on my problem yet

Thanks

[Maurice Naggar]

( 1 )

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article
Please use this Guide

( 2 )

These are just first steps.

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

( 3 )

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.
Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.

When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable these repair actions on that tab-window
by clicking their button to the far-right for ON status

Delete IFEO keys
Delete tracing keys
Delete Prefecth files
Reset Proxy
Reset IE Policies
Reset Chrome policies
Reset Winsock

Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

This can take several minutes.
When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.

AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean. 
Click on the “Continue” button to finish the removal process.

Guide article

Attach the clean log from Adwcleaner when all completed.

( 4 )

This here you can start & once it is under way, you can leave the machine alone & let it run over-night. No need to keep watch once it starts the actual scan run. 

Next, This will be a check with ESET Onlinescanner for viruses, other malware, adwares, & potentially unwanted applications.

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"

• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started.

 

• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes
• When prompted for scan type, Click on Full scan

Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on Start scan button.

• Have patience. The entire process may take an hour or more. There is an initial update download.

There is a progress window display. You may step away from machine &. Let it be.  That is, once it is under way, you should leave it running.  It will run for several hours.

• At screen "Detections occurred and resolved" click on blue button "View detected results"
• On next screen, at lower left, click on blue "Save scan log"
• View where file is to be saved. Provide a meaningful name for the "File name:"
• On last screen, set to Off (left) the option for Periodic scanning
• Click "save and continue"
• Please attach the report file so I can review

Please understand that there is no single-solution / magical one-step for the situation on this machine.  We will be doing more actions after you finish these here. The "block" actions by Malwarebytes are keeping the pc safe from potential harm.

[LucidKarma]

Ok I have followed your steps and I am currently waiting for the ESET tool to complete it's scan. I have attached the AdwCleaner Log File and it seems I have no adware as of right now. Also when you say there will be more actions will the next actions depend on the results of the ESET scan?

Thanks for your assistance

AdwCleaner[C01].txt

[Maurice Naggar]

That is a very good run of the Adwcleaner. You need to first finish the ESET run and then attach its log for my rview.

Do have patience. I first want to see the content of the log, and I will want to also know whether the "block" notices have ceased.

[LucidKarma]

By the looks of things the antivirus scan will last overnight so I will let you know in 7 hours how the scan went

[Maurice Naggar]

Simply leave it to run on its own.  No need to rush.

[LucidKarma]

I have just come back and it seems to have finished and there seems to be no more outbound connections but I will wait and see

 

eset scan.txt

[LucidKarma]

Have there been any updates on my problem? I have just turned my computer back on and I have got another blocked website.

 

[LucidKarma]

Since my last message there have been 15+ block alerts from malware bytes. I have provided details in screenshots attached. It seems all of the files in the reports are operaGX my browser of choice.

 

[Maurice Naggar]

For Your Information:

The Block notices from Malwarebytes web protection do mean that Malwarebytes is keeping your pc safe from potential harm.
A block notice is an advisory of the "block".
A "malicious website blocked" is entirely different from a "malware detected" event.

The website  Block message indicates that a potential risk was blocked by the malicious website protection.
The Malwarebytes web protection, by default, will always show each IP block occurrence.
The Malwarebytes Web-protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC.
 
 
Incoming block notice can be ignored, the Malwarebytes real-time protection is blocking the threat and there is nothing more that can be done.
On Outbound blocks, any attempted connection was stopped.
 
No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56).
 A browser is not required to be running, just an active Internet connection with processes running,
such as Instant messenger clients, DISCORD or SKYPE or Peer-to-peer software, to trigger these alerts.

These are also triggered by banner ads running on websites which is the most common form of alert.

I do not need any further screen grabs of Malwarebytes windows or notices.

I will be providing you a custom-script ( soon) to do more checks on this Windows system.  Thanks for your patience.

Meantime, please do this.  

This is a good point to emphasize not playing online games or games in general, while the case is on-going.
I would also emphasize to reduce the auto-started applications that start with Windows down to the absolute minimum. Which would basically be just security applications.
Apply these principles now from the following How-to
How to perform a clean boot in Windows
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

 

[LucidKarma]

I will not be using my computer for a while so when you have provided me with the script I will only then turn it on and continue to use it. Is this clean boot necessary if I'm not using it?

Thank you for your support 

[Maurice Naggar]

I would like for you to Download & to SAVE the FRST64.exe tool to the Downloads folder. Please download & save a new copy of the tool FRST64.exe from this link https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

( 2 )

This next custom-fix is mainly intended to run Windows' SFC & DISM to check the system for integrity. To clear temporary cache on Edge & Chrome & Firefox. To rebuild the Winsock. To attempt to check the system with Microsoft Defender antivirus.

This is not a cure-all. Rather, it is meant as general check & cleanup.

This custom script is for  LucidKarma machine  only / for this machine only.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt <<< - - - - -

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRST64.exe  on the Downloads folder    to run a custom script .    The system will be rebooted after the script has run. 

Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

•    If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.
• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start. Lots of patience.  Please attach the Fixlog.txt with your next reply. 

( 3 )

Let me suggest that you get your browsers each, as applicable, to have the Malwarebytes Browser Guard.

See Support article how-to

https://support.malwarebytes.com/hc/en-us/articles/360038520374-Install-Malwarebytes-Browser-Guard

See Support article how-to for Firefox
https://support.malwarebytes.com/hc/en-us/articles/4413298841747--Install-Malwarebytes-Browser-Guard-on-Firefox-browser

For the EDGE browser https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser

Note: If your pc also has Opera or Brave or Vivaldi browser, you can install the Chrome version of the Malwarebytes Browser Guard ( on each as appropriate).
 

[LucidKarma]

Ok so I have started this scan, does the tool automatically use the fix list you attached to your reply without me doing anything - they are both in the downloads folder and I haven't changed the name of the text

 

Thanks

[LucidKarma]

I have completed the fix, and just as a note these blocks are still happening, does this mean I'm still infected or is it something else. I understand you are trying to help me as much as possible and Malwarebytes is also keeping me safe so thank you.

Fixlog.txt

[Maurice Naggar]

Windows Resource Protection found corrupt files and successfully repaired them.

For Your Information:

The Block notices from Malwarebytes web protection do mean that Malwarebytes is keeping your pc safe from potential harm.
A block notice is an advisory of the "block".
A "malicious website blocked" is entirely different from a "malware detected" event.

The website  Block message indicates that a potential risk was blocked by the malicious website protection.
The Malwarebytes web protection, by default, will always show each IP block occurrence.

 

Be sure that you have installed Malwarebytes Browser Guard on each of your web browsers.

 

Next please run this other security scanner. It scans for viruses, trojans, or potential malicious malware, if any.
This with Kaspersky KVRT tool.

Download Kaspersky Virus Removal Tool (KVRT) from here: https://www.kaspersky.com/downloads/thank-you/free-virus-removal-tool and save to your Desktop.

Next, Select the Windows Key and R Key together, the "Run" box should open.



Drag and Drop KVRT.exe into the Run Box.



C:\Users\jake_\DESKTOP\KVRT.exe will now show in the run box.



add 

-dontencrypt

 Note the space between KVRT.exe and -dontencrypt

C:\Users\jake_\DESKTOP\KVRT.exe -dontencrypt 

should now show in the Run box.



That addendum to the run command is very important.


To start the scan select OK in the "Run" box.



The Windows Protected your PC window will open, select "More Info"



A new Window will open, select "Run anyway"



A EULA window will open, tick both confirmation boxes then select "Accept"



In the new window select "Change Parameters"

 

• In the new window ensure the following boxes are ticked:
  • System memory
  • Startup objects
  • Boot sectors
  • System drive

• Then select "OK" and „Start scan“.

The Kaspersky tool is very thorough so will take a considerable time to complete, please allow it to finish. Also while Kaspersky runs do not use your PC for anything else..

• completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
• Usually, your system needs a reboot to finish the removal process.
• Logfiles can be found on your systemdrive (usually C: ), similar like this:

Reports are saved here C:\KVRT_data\Reports and look similar to this report_20221129_103821.klr

• Right click direct onto those reports, select > open with > Notepad.
• Save the files and attach them with your next reply

[LucidKarma]

Here is the report

report_2022.11.29_19.26.07.txt

[Maurice Naggar]

Bravo ! The Kaspersky KVRT found no malware. Do tell me, How is the system at this point now ?

[LucidKarma]

So when I last checked these alerts are still happening, the system itself is fine but I still believe I am infected, and for the last few alerts I have got have been from a different IP and what I have noticed is that the different files have different IPs attached to them, this may be a coincidence though.

[Maurice Naggar]

My next tip  and first thing to cover is to systematically power down all your system, and recyle your router, and then power on in order.
It is now a very good idea to reset the router for the internet connection service.  
First, shutdown windows and be sure the power is OFF.

now, Unplug the power plug to the Modem and the Router. Wait for about a minute, please.

now, Plug the power into just the Modem (unless you have a modem/router combo) When all the lights come up, plug in the power to the Router (unless combo of course)

Now, power on the computer and get Windows restarted.   One Windows system at a time.

Secure your router by resetting it and then setting a strong password to sign into the router, and a strong wireless key to sign into your network. You can find your router manual by googling the exact model (on bottom) to follow the reset instructions, set the password and wireless key, optimize Security and Performance per these articles:
https://www.lifewire.com/resetting-a-home-network-router-818061
https://www.techradar.com/broadband/how-to-change-your-router-password
 

Edited December 1, 2022 by AdvancedSetup
Corrected font issue

[LucidKarma]

Before I go ahead with this would factory resetting the computer solve this problem once and for all or is it possibly something that isn't fixed by that.

[Maurice Naggar]

My sense is that a factory restore would not be called for.  That that would be too far. My sense is that you should proceed with my last suggestions. Which cover the hardware router and the whole power off/power on.  That will really help.

[LucidKarma]

Alright thanks I am unable to do it right now but I will asap