Frequent "Website blocked due to malware" Outbound

[JPoff]

I am receiving "Website blocked due to malware" pop-ups at the rate of about 15 to 20 per hour. It is an RTP for IP 95.217.105.184. The file is C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe.

Malwarebytes scans do not find anything. It started about noon today.

[Porthos]

@JPoff

While you are waiting for the next qualified/approved malware removal expert helper to take on your case, even though you may have run the following Malwarebytes utility or its subsets, please carefully follow these instructions: Do not try any other cleaning of any kind after running the support tool. Use the computer as little as possible, or even better don’t use it at all except to check this topic and follow the instructions given.

First, Restart the computer.

Then do the following after restart.

WARNING: Do Not click the Repair System under Advanced unless requested by a Malwarebytes support agent or authorized helper

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent.

Thank you.

[JPoff]

Attaching logs

mbst-grab-results.zip

[Maurice Naggar]

Hello  @JPoff My name is Maurice. I will guide you. Let's keep these principles as we go along.

• The malwarebytes program is keeping your computer safe from potential harm.
• Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

  Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

There is an extremely suspicious "startup link & executable" that most likely is the source that triggers the IP Block event. Malwarebytes is keeping the pc safe from potential harm. That exe will be removed after this next custom run has finished.

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will remove a rogue EXE. It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

FRSTENGLISH.exe  program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[JPoff]

I did as instructed above. The fix process completed and rebooted twice. On the second reboot there was a notation on the screen that the fix process was finishing. It never did fully reboot. It stopped at a blue screen asking for a bit locker key. I was not expecting this. Since I do not use bit locker on my desktop system drive I am concerned and confused. How should I proceed?

[Maurice Naggar]

If it is at a Command-prompt window, try to type in the command

whoami

ro see which user-account is shown, Jot that down.

Push the power OFF button all the way down, until you can sense that the disc is not spinning. Then do a regular Power ON startup. Let us see if it goes into normal Windows signon.

IF it does not get into a regular / normal Windows login, then........

If you still have the same screen, what did it list below the top ? Did it say something like, your computer did not start correctly?

Instead of pressing the "Restart" we want to press the button "Advanced Options".

then select "Troubleshooting" if you see it there. Next click on "Advanced Options"

Then Click on "Command Prompt". That will put the machine into the Windows Repair Environment --- a special super Command prompt.

You should see a line at bottom

X:\windows\system32

Note the X: on the displayed line. That is a major clue that machine is at the Windows Repair Environment.

There we can do some inquiries and attempt potential adjustments. Let me know when you get to that spot.

[Maurice Naggar]

Please do not put private information on the forum. Also, I cannot call.  You are saying that the machine is now at the command prompt, and showing 

X:\windows\system32

The following is a first step, just to recheck the integrity of this system.

at the Command prompt, type & do the two checks outlined.

Next carefully yupe this whole line as-is

SFC /scannow /offbootdir=C:\ /offwindir=C:\windows

there is a space after SFC
there is a space after scannow
there is a space after /offbootdir=C:\
press Enter-key when ready

Then see whether now the DISM applet proceeds to run.  Once it starts, just have much patience until after it gets back to flashing cursor.

Once that has completed, or if it has not, then go ahead and type this next line as is

DISM /image:C:\ /cleanup-image /restorehealth

there is a space after DISM
there is a space after /image:C:\
there is a space after /cleanup-image

I will check on you later this evening, as opportunity permits. It will be quite late. Just post your results

 

[JPoff]

I tried the sfc command. Results attached.

[Maurice Naggar]

Now do the second command I listed.

I apologize that I first misread

Edited September 15, 2023 by Maurice Naggar

[JPoff]

Second command results attached.

[Maurice Naggar]

On the command window, type 

C:

And tap enter

Type

Sfc /scannow

[JPoff]

It would not accept c:. Said the drive was encrypted. I did not know this. I did not do it. Must have come from Dell that way. I found the key on my Microsoft account. Will enter it and see what happens then. Will reply later.

[JPoff]

I entered the bitlocker key. It accepted it and proceed to boot. Then the boot failed and put me back where I started.

I think I need to give up on the fix approach. I am going to flatten my PC and rebuild it.

Thank you so much for your efforts.

[Maurice Naggar]

Do you have a backup of this system?

[JPoff]

My data is largly backed up. System and apps I will reinstall. I was successful getting into the c drive for recovery using the bitlocker key. Now grabbing a few more files. I am assuming the saving some files and folders will not bring along the malware. What do you think?

[Maurice Naggar]

Saving the files is good.

Later on though, before restoring them to the new system, you want to scan them with antivirus, and second time with Malwarebytes.

[AdvancedSetup]

Hello @JPoff

How are things going now?

Please post a status update when you have a moment

Thanks

 

 

[JPoff]

System fully recovered. No malware per scans. The msbuild.exe in the task list, and the entries in startup for msbuild.exe have not returned.

Actually neither Malwarebytes nor Microsoft Defender detected the malware in the first place. Of course very happy Malwarebytes blocked the attempted outbound attempts.

So all good now. Thanks for assistance. If you have an open case, you can close it as far as I am concerned.

[Maurice Naggar]

Hi. Glad to hear the good news. We can proceed with cleanup of tools we used.

To remove the FRSTENGLISH tool & its work files, do this. Go to your Downloads folder. Do a RIGHT-click on

FRSTENGLISH.exe

& select

RENAME

& then change it to

UNINSTALL.exe

.
Then run that ( double click on it) to begin the cleanup process.

Delete mb-support-1.9.2.982.exe
Delete mbst-grab-results.zip on the Desktop.
Any other download file I had you download, you may delete.
Consider using PatchMyPC, keep all your software up-to-date - https://patchmypc.com/home-updater#download

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

I am marking this case for closure.
I wish you all the best. Stay safe.
Sincerely.

Maurice

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you