Jump to content

Website Blocked Due to riskware

Sachi

By Sachi
in Resolved Malware Removal Logs

 Share
Go to solution Solved by Maurice Naggar,

Recommended Posts

Maurice Naggar

Maurice Naggar

Posted
Posted

Hello :welcome: 

I will guide you along on looking for malware. Lets keep these principles as we go along.

  • Removing malware can be unpredictable
  • Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
  • Only run the tools I guide you to.
  • Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
  • The removal of malware isn't instantaneous, please be patient.
  • Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
  • Please stick with me until I give you the "all clear".
  • If your system is running Discord, please be sure to Exit out of it while this case is on-going.

New scan with Malwarebytes

As much as possible, close other opened-window-user apps.  As much as possible, close as many browser-windows as possible before pressing "scan" button.

Do a new scan with Malwarebytes for Windows.

Do a Check for Update using the Malwarebytes Settings >> General tab.

See this Support Guide https://support.malwarebytes.com/hc/en-us/articles/360042187934-Check-for-updates-in-Malwarebytes-for-Windows

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes sca

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

MB4_scan_tick_ALL.jpg.d5c4071c62ed66534301fbb217b93bc0.jpg

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

MB4_scan_all_Quarantine2.jpg.6c45445994d4125c0b617ac7c5551e03.jpg

 

Then next ...

I would like a report set for review.   This is a report only.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

  • Please attach  mbst-grab-results.zip    to your reply
  • The  block actions by Malwarebytes are keeping the machine safe from potential threats.
  • I do need the support zip reports to see more detail  as well as old logs and history of Malwarebytes app.
Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Very curious about a couple of things. On or about 30 NOV did you run ESET Online scanner ? what did it report ?

On or about 30 NOV did you run Hitmanpro ? what did it report? What else, if any, have you run?

I do need for you to get back into Malwarebytes and to UNDO whatever exclusion you just did about "powershell". The Block is protecting this machine !!

There is a bunch of cleanup work yet to be done on this machine. It seems to me there are multiple issues here. Have patience. I am working on the next steps.

Link to post
Share on other sites
Sachi

Sachi

Posted
  • Author
Posted

 

18 minutes ago, Maurice Naggar said:

ESET Online scanner

4 driver files and a couple of applications (install files) in the driver pack solutions folder and 3 files from the systems 32 folder. I am running the scan again to make sure everything is all right.

 

18 minutes ago, Maurice Naggar said:

Hitmanpro

only tracking cookies found.

Malwarebytes scan had issues with the cheat engine files

Link to post
Share on other sites
  • Solution
Maurice Naggar

Maurice Naggar

Posted
  • Solution
Posted

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

Select View → Show → File name extensions

>

There seems to be multiple infections here, over & above the "driverpack" threat & the notice(s) about a "block" action. There is some sort of rogue executable, plus, Windows update is disabled, plus MS Defender antivirus is disabled. 

This next custom-fix is mainly intended to run Windows' SFC & DISM to check the system for integrity. To clear temporary cache on Edge & Chrome & Firefox. To rebuild the Winsock. To attempt to check the system with Microsoft Defender antivirus. It will delete temporary file areas. A rogue EXE file will be removed. 

This is not a cure-all. However hopefully it will help clear the major issues-at-hand.

This custom script is for  Sachi  only / for this machine only.

  • Please save the (attached file named) FIXLIST.txt   to the   D:\Downloads\software   folder

Fixlist.txt <<< - - - - -

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRST64.exe  on the D:\Downloads\software folder     to run a custom script .    The system will be rebooted after the script has run. 

Start the Windows Explorer and then, go  to the D:\Downloads\software    folder.


RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  •    If the tool warns you the version is outdated, please download and run the updated version.
  • IF Windows prompts you about running this, select YES to allow it to proceed.
  • IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

  • on the FRST window:

Click the Fix button just once, and wait.

PLEASE have patience when this starts. You will see a green progress bar start. Lots of patience.  Please attach the Fixlog.txt with your next reply. 

Please only attach logs, reports as we go along.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

a) you are welcome. b) don't go away yet. c) lets get a general report for my review.

Temporarily disable Microsoft SmartScreen to download the next software below 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

When all done, you may go back to turn ON the EDGE Smartscreen protection.

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Here are things needed your attention, per the SecurityCheck.
The elevation prompt for administrators disabled
^It is recommended to enable (default): Win+R typing UserAccountControlSettings and Enter^

TeamViewer v.15.35.5  Warning! Download Update

Microsoft SQL Server 2008 Setup Support Files  v.10.3.5500.0  Warning! This software is no longer supported.

Node.js v.18.12.1  Warning! Download Update

Microsoft SQL Server 2012 Native Client  v.11.4.7462.6  Warning! This software is no longer supported.

7-Zip 19.00 (x64) v.19.00  Warning! Download Update
Uninstall old version and install new one.

ProtonVPN v.2.2.0  Warning! Download Update

Java 8 Update 341 (64-bit) v.8.0.3410.10  Warning! Download Update
Uninstall old version and install new one (jre-8u351-windows-x64.exe).

Audacity 3.1.3 v.3.1.3  Warning! Download Update

Microsoft Edge v.107.0.1418.42  Warning! Download Update

Bonjour v.3.0.0.10  Warning! Uninstall this. You do not need it.

JioCinema v.1.0  Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it

Glary Utilities 5.197 v.5.197.0.226  Warning! Any registry cleaner or fixer-upper or tweaker should be treated with super caution.

YTD Video Downloader 4.9 v.4.9  Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it

Registry cleaners range from the non-effective snake-oil to the ok ones --- but they can lead to causing more harm than good.
Some can even lead to removing actually needed entries.
I rarely suggest that folks use these "tools".

Please see Ed Bott's blogpost "Why I don’t use registry cleaners"
http://www.edbott.com/weblog/2005/04/why-i-dont-use-registry-cleaners/

In the context of the notion of a registry cleaner, I would refer you to  Mark Russinovich's ( at Microsoft ) statement (from Registry Junk: A Windows Fact of Life ).   http://blogs.technet.com/b/markrussinovich/archive/2005/10/02/registry-junk-a-windows-fact-of-life.aspx

Quote

I haven't and never will implement a Registry cleaner since it's of little practical use on anything other than Win2K terminal servers and developing one that's both safe and effective requires a huge amount of application-specific knowledge.

There has not been a real need for registry cleaners ever since Win XP and later o.s. came out.
Also see http://miekiemoes.blogspot.ca/2008/02/registry-cleaners-and-system-tweaking_13.html
 

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

You are very welcome. I am glad to have worked with you.

We can proceed with cleanup of tools we used.

To remove the FRST64 tool & its work files, do this. Go to your D:\Downloads\software folder. Do a RIGHT-click on FRST64.exe & select 

RENAME

& then change it to

Quote

UNINSTALL.exe

.
Then run that ( double click on it) to begin the cleanup process.

Delete mb-support-1.8.7.918.exe
Delete mbst-grab-results.zip on the Desktop.

Adwcleaner you may keep and use as needed.
Any other download file I had you download, you may delete.
Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

I am marking this case for closure.
I wish you all the best. Stay safe.
Sincerely.

Maurice

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.