Malwarebytes blocking explorer.exe, outbound connection

[bapkei]

Hello, 

Have been having issues since yesterday, having repeated notifications of Malwarebytes blocking explorer.exe outbound connection to many random websites, between 1-5 minute intervals. I have run scans using Malwarebytes but scans do not show any threats detected. Very unsure on how to proceed as it seems like the repeated attempts of connection has blocked my ability to use sites like Steam. 

In addition to the blocking of explorer.exe, very very occasionally it seems like conhost.exe was also blocked in between. 

Attached are the threat scan reports from Malwarebytes, FRST and Addition text file.

Advance thank you for any guidance and assistance that can be provided.

malwarebytes scan.txt Addition.txt FRST.txt

[1PW]

Hello @bapkei and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

[AdvancedSetup]

Hello @bapkei

Please post the requested logs so that we can assist further.

Thank you

 

[bapkei]

Hi,

Here are the requested logs.

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the logs @bapkei

What are these files for? Generally speaking no files belong at the Parent folder here. It should be all folders. C:\Users\User\AppData\Roaming

2022-04-22 20:12 - 2022-04-22 20:12 - 000000068 ____C () C:\Users\User\AppData\Roaming\changzhi_leidian.data
2022-04-22 20:12 - 2022-04-22 20:12 - 000000128 ____C () C:\Users\User\AppData\Roaming\changzhi_leidianmac.data
2023-02-15 21:49 - 2023-02-15 21:49 - 000000992 ____C () C:\Users\User\AppData\Roaming\nikke_launcher.reg
2022-08-14 00:31 - 2022-08-14 00:31 - 000001024 ____C () C:\Users\User\AppData\Roaming\tof_launcher.reg

 

 [ 1 ]

Please go to Control Panel, Programs, Programs and Features, Uninstall a program

Then right-click and uninstall the following

• CCleaner (computer experts no longer recommend this program)

 

 [ 2 ]

Please run the following fix. It will also create a ZIP file on your desktop with today's DATE and TIME as the name. Please attach that on your next reply.
It will be a copy of your scheduled tasks so that we can review them deeper to see if we can find something trying to run that should not be running

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\User\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed in most, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks