Exty Posted July 15 ID:1577736 Share Posted July 15 Please help as something is actively trying to infect my computer. Here is the blocked website report from malwarebytes: Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 7/15/23 Protection Event Time: 11:11 PM Log File: 850ca0cc-235c-11ee-9485-2cf05d257f61.json -Software Information- Version: 4.5.31.270 Components Version: 1.0.2047 Update Package Version: 1.0.72479 License: Trial -System Information- OS: Windows 10 (Build 19045.3086) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Malware Domain: IP Address: 94.142.138.147 Port: 48665 Type: Outbound File: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe (end) Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 15 ID:1577745 Share Posted July 15 (edited) Hello I will guide you along on looking for 'potential' problems. Let's keep these principles as we go along. The Malwarebytes real-time web protection is keeping your machine safe from potential harm. Please don't run any other scans, download, install or uninstall any programs while I'm working with you. Only run the tools I guide you to. Do not run online games while case is on-going. Do not do any free-wheeling web-surfing. The removal of malware isn't instantaneous, please be patient. Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure. Please stick with me until I give you the "all clear". If your system is running Discord, please be sure to Exit out of it while this case is on-going. I would like a report set for review. This is a report only. Please download MALWAREBYTES MBST Support Tool Once you start it click Advanced >>> then Gather Logs Have patience till the run has finished. Attach the mbst-grab-results.zip from the Desktop to your reply. For Your Information: The Block notices from Malwarebytes web protection do mean that Malwarebytes is keeping your pc safe from potential harm. A block notice is an advisory of the "block". A "malicious website blocked" is entirely different from a "malware detected" event. The website Block message indicates that a potential risk was blocked by the malicious website protection. The Malwarebytes web protection, by default, will always show each IP block occurrence. The Malwarebytes Web-protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC. Incoming block notice can be ignored, the Malwarebytes real-time protection is blocking the threat and there is nothing more that can be done. On Outbound blocks, any attempted connection was stopped. No action is required unless you’re also experiencing malware symptoms or there are multiple (different) IPs (ex;123.23.34 and 4.44.56). A browser is not required to be running, just an active Internet connection with processes running, such as Instant messenger clients, DISCORD, or Instagram, SKYPE or Peer-to-peer software, to trigger these alerts. These are also triggered by banner ads running on websites which is the most common form of alert. Edited July 15 by Maurice Naggar Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18 ID:1578221 Share Posted July 18 Hello @Exty Kindly provide status update. Link to post Share on other sites More sharing options...
Exty Posted July 18 Author ID:1578223 Share Posted July 18 Hello and sorry for late reply, something deleted malwarebytes system services from my computer how do I install them back? Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18 ID:1578224 Share Posted July 18 Please, get this report so that I can review. That is the necessary first step. I would like a report set for review. This is a report only. Please download MALWAREBYTES MBST Support Tool Once you start it click Advanced >>> then Gather Logs Have patience till the run has finished. Attach the mbst-grab-results.zip from the Desktop to your reply. Link to post Share on other sites More sharing options...
Exty Posted July 18 Author ID:1578228 Share Posted July 18 mbst-grab-results.zip Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 18 ID:1578263 Share Posted July 18 Please set File Explorer to SHOW ALL folders, all files, including Hidden ones. Use OPTION ONE or TWO of this article Please use this Guide ( 2 ) Please run the following custom script. Read all of this before you start. This is intended to check integrity and to do some housekeeping. We will do more checks after this run. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers. It will attempt to clear temporary file areas. It will reset the Hosts file. It will rebuild the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more. This run is like a housekeeping run and a mini tune-up. Please Close all open work before you actually do begin this run. Farbar FRSTENGLISH program location: C:\Users\azizb\Downloads folder. The tool is already on system. That is what we will use. Please download the attached fixlist.txt file and save it to Downloads folder Fixlist.txt <- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. With File Explorer go to folder C:\Users\azizb\Downloads folder Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the C:\Users\omar sh\Downloads\Programs folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply from Downloads. NOTICE: For potential outside readers, This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm. Link to post Share on other sites More sharing options...
Exty Posted July 18 Author ID:1578290 Share Posted July 18 I accidentally paused the script shortly after it began, and then I attempted to restart my computer. my computer is no longer turning on and it’s in a restart loop sorry Maurice can you help me Link to post Share on other sites More sharing options...
Solution Exty Posted July 18 Author Solution ID:1578299 Share Posted July 18 Never mind I fixed it thanks Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 19 ID:1578316 Share Posted July 19 Tell me, What exactly did you do? and, Have you run my Fixlist run ? https://forums.malwarebytes.com/topic/300211-website-blocked-due-to-malware-keeps-popping-up/?do=findComment&comment=1578263 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 25 Root Admin ID:1584912 Share Posted August 25 Due to the lack of feedback, this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread. Tips to help protect from infection Thanks Link to post Share on other sites More sharing options...
Recommended Posts