Blocked Website

[Craig83]

Hi,

For a few days, I have had these popups come up a few times.

Obviously, these are popup websites that are being blocked and I appreciate that. It is just annoying and I also don't want whatever virus is attempting to attack actually to attack.

How do I stop these and remove them from my PC?

Running Windows 11.

See the screenshot of the detection history.

Let me know if you need any more info.

Thanks

 

[Porthos]

Please post a log from the curvyalpaca block.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[Craig83]

Hi Porthos,

See attached logs for the three that pop up a lot, they are all associated with msedge.exe

Thanks

xml.mobipromote.txt 157 IP Address.txt curvyalpaca.txt

[Craig83]

This just popped up now if it helps

 

[Porthos]

I am going to move this to the malware removal section since these are outgoing blocks.

To begin, Please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

 

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thanks

[Craig83]

Hi,

See attached logs.

Thanks

mbst-grab-results.zip

[AdvancedSetup]

Hello  and       @Craig83

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow all steps in the provided order and post back all requested logs
• Please attach all log files to your post, unless otherwise requested
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
• Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
• Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim. Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections. If there are any on the system you should uninstall them before we proceed.
• Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
• If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[Craig83]

Hi,

So attached are the reports. Unfortunately, AdwCleaner crashed my PC (blue screen of death) when I click continue after I click Quarantine. I have attached a screenshot with the error.

Hope that helps.

Thanks

MWB Report 07-03-2023.txt Addition.txt FRST.txt

[AdvancedSetup]

Does the computer start and run okay without using AdwCleaner?

 

[AdvancedSetup]

The logs show multiple errors

 

System errors:
=============
Error: (03/07/2023 12:38:30 PM) (Source: HTTP) (EventID: 15005) (User: )
Description: Unable to bind to the underlying transport for 127.0.0.1:50001. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number.

Error: (03/07/2023 12:37:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The csvol service failed to start due to the following error:
A device attached to the system is not functioning.

Error: (03/07/2023 12:37:24 PM) (Source: Microsoft-Windows-WER-SystemErrorReporting) (EventID: 1001) (User: NT AUTHORITY)
Description: 0x000000ef (0xffffd789e85cf180, 0x0000000000000000, 0xffffd789f83570c0, 0x0000000000000000)C:\WINDOWS\MEMORY.DMP8e87d0ab-eace-4048-a1a2-c1625cf2885a

Error: (03/07/2023 12:37:11 PM) (Source: volmgr) (EventID: 162) (User: )
Description: Dump file generation succeded.

Error: (03/07/2023 12:37:23 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 12:21:25 PM on ‎3/‎7/‎2023 was unexpected.

Error: (03/07/2023 12:24:25 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk2\DR2.

Error: (03/07/2023 12:16:25 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk2\DR2.

Error: (03/07/2023 12:10:25 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk2\DR2.

 

It also looks like something ran on your computer and disabled portions of Windows Defender security at the end of last year and earlier this year.

Date: 2023-01-28 15:48:23
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
Severity: Severe
Category: Tool
Path: regkeyvalue:_hklm\software\microsoft\windows defender\\DisableAntiSpyware
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.381.2309.0, AS: 1.381.2309.0, NIS: 1.381.2309.0
Engine Version: AM: 1.1.19900.2, NIS: 1.1.19900.2

Date: 2022-12-08 08:09:19
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid=37020&name=VirTool:Win32/DefenderTamperingRestore&threatid=2147741622&enterprise=0
Name: VirTool:Win32/DefenderTamperingRestore
Severity: Severe
Category: Tool
Path: regkeyvalue:_hklm\software\microsoft\windows defender\\DisableAntiSpyware
Detection Origin: Unknown
Detection Type: Concrete
Detection Source: System
Process Name: Unknown
Security intelligence Version: AV: 1.381.106.0, AS: 1.381.106.0, NIS: 1.381.106.0
Engine Version: AM: 1.1.19900.2, NIS: 1.1.19900.2
Event[0]

 

Let me know if the computer is starting and working before we continue

You also need to check on this. This indicates one of your hard disks is having an issue

Error: (03/07/2023 12:16:25 PM) (Source: disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk2\DR2.

 

 

[Craig83]

Hi,

Thank you so much for your quick response.

The PC runs fine when rebooted.

The driver detected a controller error on \Device\Harddisk2\DR2.

Thanks for this, I will have a look at this, I think I know what this is.

What is the next step to get rid of that curvyalpaca?

[AdvancedSetup]

I would start by cleaning up all the cookies, cache, and check all settings in Microsoft Edge.

More than likely it was just a redirect script or Ad that caused it.

If that does not correct it you could export your bookmarks and write down the extensions you use, then do a RESET of MS Edge

Let me know if cleaning Edge helps to correct this

Thanks @Craig83

I can help you track down DR2 if needed

 

[Craig83]

Hi,

Will give it a try and let you know. I would appreciate finding out about the DR2.

Thanks

[AdvancedSetup]

Please save the attached file to:  C:\Users\craig\Downloads 

Then right-click on the following file and run it with Admin rights.

C:\Users\craig\Downloads\FRSTEnglish.exe

Then click the FIX button and post back the FIXLOG.TXT file.

fixlist.txt

Thanks @Craig83

[Craig83]

Here you go

Fixlog.txt

[AdvancedSetup]

The drive listed below appears to be the disk that is reporting an error.

 

DriveLetter   : C:
Number        : 0
Label         : OS
Manufacturer  :
Model         : WD Blue SN570 1TB
SerialNumber  : E823_8FA6_BF53_0001_001B_444A_49D2_6BB7.
Name          : WD Blue SN570 1TB
FirmwareRev   : 234100WD
PnPID         : SCSI\DISK&VEN_NVME&PROD_WD_BLUE_SN570_1T\5&329DFB2&0&000000
SCSIPort      : 2
FileSystem    : NTFS
MediaType     : Fixed hard disk media
PartitionKind : GPT
BootDisk      : True
TotalSpace    : 910,354
FreeSpace     : 215,925
UsedSpace     : 694,429
Drive         : Win32_LogicalDisk: C: (DeviceID = "C:")
Partition     : Win32_DiskPartition: Disk #0, Partition #1 (DeviceID = "Disk #0, Partition #1")
Disk          : Win32_DiskDrive: WD Blue SN570 1TB (DeviceID = "\\.\PHYSICALDRIVE0")

DriveLetter   : D:
Number        : 2
Label         : CRAIG_WORK_
Manufacturer  : WD      
Model         : My Passport 2665
SerialNumber  : WX22D228E31Z
Name          : WD My Passport 2665 USB Device
FirmwareRev   : 2007
PnPID         : USBSTOR\DISK&VEN_WD&PROD_MY_PASSPORT_2665&REV_2007\57583232443232384533315A&0
SCSIPort      : 0
FileSystem    : exFAT
MediaType     : External hard disk media
PartitionKind : GPT
BootDisk      : False
TotalSpace    : 4657,205
FreeSpace     : 3760,75
UsedSpace     : 896,455
Drive         : Win32_LogicalDisk: D: (DeviceID = "D:")
Partition     : Win32_DiskPartition: Disk #2, Partition #1 (DeviceID = "Disk #2, Partition #1")
Disk          : Win32_DiskDrive: WD My Passport 2665 USB Device (DeviceID = "\\.\PHYSICALDRIVE2")

DriveLetter   : F:
Number        : 1
Label         : Munier
Manufacturer  : Seagate
Model         : BUP Slim BK     
SerialNumber  : NAAP1LHC
Name          : Seagate BUP Slim BK SCSI Disk Device
FirmwareRev   : 0304
PnPID         : SCSI\DISK&VEN_SEAGATE&PROD_BUP_SLIM_BK\7&7F5386B&1&000000
SCSIPort      : 3
FileSystem    : exFAT
MediaType     : External hard disk media
PartitionKind : MBR
BootDisk      : False
TotalSpace    : 1862,956
FreeSpace     : 19,735
UsedSpace     : 1843,221
Drive         : Win32_LogicalDisk: F: (DeviceID = "F:")
Partition     : Win32_DiskPartition: Disk #1, Partition #0 (DeviceID = "Disk #1, Partition #0")
Disk          : Win32_DiskDrive: Seagate BUP Slim BK SCSI Disk Device (DeviceID = "\\.\PHYSICALDRIVE1")

DriveLetter   : G:
Number        : 3
Label         : CRAIG_WORK_2
Manufacturer  : TOSHIBA
Model         : EXTERNAL_USB    
SerialNumber  : F90880070011202
Name          : TOSHIBA EXTERNAL_USB USB Device
FirmwareRev   : 0   
PnPID         : USBSTOR\DISK&VEN_TOSHIBA&PROD_EXTERNAL_USB&REV_0\20211007008809F&0
SCSIPort      : 0
FileSystem    : NTFS
MediaType     : External hard disk media
PartitionKind : GPT
BootDisk      : False
TotalSpace    : 3725,896
FreeSpace     : 10,36
UsedSpace     : 3715,536
Drive         : Win32_LogicalDisk: G: (DeviceID = "G:")
Partition     : Win32_DiskPartition: Disk #3, Partition #0 (DeviceID = "Disk #3, Partition #0")
Disk          : Win32_DiskDrive: TOSHIBA EXTERNAL_USB USB Device (DeviceID = "\\.\PHYSICALDRIVE3")

 

[Craig83]

And that is a brand new HDD as well. Only about a month old.

How do I fix the error?

Also, a new block popped up on MWB: Is there any way to just delete msedge? I don't use it except through the Facebook app. All these problems seem to be attached to Edge.

[AdvancedSetup]

If you're certain you don't want or need anything from Microsoft Edge then try resetting it.

Copy and Paste the following into the address bar and press the Enter key

edge://settings/profiles

Then click to Reset it

 

 

As for the hard drive. I would do at least the following and then keep an eye on it.

From an elevated Admin command prompt copy and paste the following and press the Enter key

CHKDSK D: /F

That should ask about dismounting, say yes and let it run.

 

 

[Craig83]

Thanks so much.

Will let you know what happens

[AdvancedSetup]

Sounds good. I'll check back on you again some time tomorrow

Have a good one

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks