MalwareBytes keep blocking explorer.exe/Website blocked, outbound

[Wonza]

Hello all,

This is my second post and my problem is identical to what I experienced last time. For this I am sorry as it seems I've made the same mistake by visiting a harmful website.

Malwarebytes Premium is currently the protection I am using for my system and it is popping off with messages telling a website has been blocked because of malware and a Trojan. This happens every minute similar to last time.

I have attached images of the MB log.

Attached is also the mbst-grab-results from the Malwarebytes Support-tool. I figured you would ask for these.

I was hoping we could take another round at removing this as we did last time.

 

Sincerely

Wonza

mbst-grab-results.zip

[Maurice Naggar]

Hello. My name is Maurice. I will guide you.

• Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

  Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

 

(   3   )

This is only a first step. Download and save a file named Iexplore.exe from here https://www.bleepingcomputer.com/download/rkill/dl/11/

and once the browser has finished the download, can you RUN that from there.

That Iexplore is another name for the tool known as RKILL by Bleepingcomputer. 

(   4   )

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here:   https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
• Save Autoruns.zip to your computer. Then locate it and extract it to a new folder where you can find and run it.
• Once it starts you may not be able to easily stop the scan but you can try to press the Escape key on your keyboard.
• Once scanning is stopped, click on the Options menu at the top of the program and select Scan Options... 
• Then place a check mark on the following items Verify Code Signatures, Check VirusTotal.com, and Submit Unknown Images
• Then click the Rescan button. Agree to the VirusTotal EULA
• Once the new scan has been completed, please click on the File button at the top of the program and select Save, or use the Save icon, and save the Autoruns.arn file to your desktop and close Autoruns.
• Right-click on the Autoruns.arn file (it will typically be the name of your computer) on your desktop or where you save it, and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the Autoruns.zip folder (your computer name.zip) you just created to your next reply.

 

[Wonza]

Thank you.

Attached is the file.

DESKTOP-QESBO5B.zip

[Wonza]

MB still blocking outbound connections every minute.

[Maurice Naggar]

Please have much patience. There is not a quick magical single "cure". Further, the screen grab does not have the necessary details. I am in the process of digging thru all your file reports !!  Allow me the opportunity to get that completed. In the meantime, there are a couple of actions you can take.

The latest Malwarebytes release is Malwarebytes 4.6.4.286 with  component package 1.0.2163. I would like you to get that update.

First some housekeeping.  
Start Malwarebytes. Click Settings ( gear ) icon. Next, let us make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

• now Click the General tab.
• Under Application updates, click the Check for updates button.

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.  

 

(   2   )

 

With Malwarebytes, click the Settings ( gear-wheel-icon{ to get to Settings. Then click the tab "NOTIFICATIONS".

Look at the line "Show all notifications in Windows notification area"  and click the choice to the LEFT side. So that it is OFF.

Look at the line below that says "Close non-critical notifications after" and from the drop-down choice list select "3 seconds".

When completed, close Malwarebytes window. All notifications will still be logged on the Malwarebytes logs. 

 

(   3   )

 

An additional measure to take so that the minimum of programs are auto-loaded / auto-started with Windows.

This is a good point to emphasize not playing online games or games in general, while the case is on-going.
I would also emphasize to reduce the auto-started applications that start with Windows down to the absolute minimum. Which would basically be just security applications.
Apply these principles now from the following How-to
How to perform a clean boot in Windows

Edited October 6, 2023 by Maurice Naggar

[Wonza]

Steps taken.

Regarding the screen grab I just wanted to show what the pop-up from MB looked like. I'm a novice.

Appreciate your time greatly.

[Maurice Naggar]

No worries. We are all novices at some point. No worries. We are ready to take some actions. I need you to be real sure to turn OFF the FAST start option setting for Windows ! !  

• Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

 

Next, we do a custom run.

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will remove a suspicious rogue named  secureboot.exe . It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

FRSTENGLISH.exe  program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Edited October 6, 2023 by Maurice Naggar
amended

[Wonza]

Thank you very much.

Fixlog.txt attached.

Fixlog.txt

[AdvancedSetup]

Very sorry for the delay @Wonza

It looks like @Maurice Naggar may have missed the system alert or perhaps the system did not alert that you had replied.

How is the computer running now?

Do you still need further assistance?

Thank you

 

[Maurice Naggar]

Hello @Wonza I regret overlooking your reply. My bad. 

Next, some housekeeping, and then one Scan.  There will be more later after all this.
Start Malwarebytes. Click Settings ( gear ) icon. Next, let us make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

• now Click the General tab.
• Under Application updates, click the Check for updates button.

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

 

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

 

[Maurice Naggar]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks