Website blocked to to Trojan every 1 minute (Controlpanel29.com)

[DimitrisLaiman]

Hello all.

I am getting this message from yesterday every 1 minute.

I cannot find out what triggers it and I dont know how to fix.

 

 

 

Any ideas how to solve?

 

Thank you

 

 

[Porthos]

2 minutes ago, DimitrisLaiman said:

Any ideas how to solve?

Let's get the info to get the malware removal process started.

Please do the following so that we may take a closer look at your system for any possible infections.

Do these 2 steps FIRST so that files and folders are set to SHOW, plus also, Turn OFF Windows Fast Start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool. The tool also downloads and runs a file called FRSTEnglish. Please allow it to run.
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
  Then be patient for the next expert to take your case.

Thank you

[DimitrisLaiman]

19 minutes ago, Porthos said:

 

 

 

Here is the file requested.

Thank you

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the logs @DimitrisLaiman

Please give me a few moments to review

[AdvancedSetup]

Please run the following fix

 

Please temporarily disable Bitdefender real-time protection before running this fix.

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\laidi\Downloads\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[DimitrisLaiman]

Thank you for the solution.

I checked all the actions that fixlist will do and I must say i am kind of worried on the changes it will make.

Before running it as a final solutio.. is there a way to see what actually causes the incident? What is calling and with what parameters the explorer.exe?

 

[AdvancedSetup]

You can hire someone to setup auditing. Without auditing I'm not sure it can be sliced down exactly as you want. That is what the initial logs are for, to try to locate the exact item being called. In many cases it is not specifically shown.

This script that is shown has had 99% of it run by hundreds of customers with no issues. I've run the script on my own computer with no issues many times. There are simply a couple of lines added specifically that relate to your computer settings.

 

[AdvancedSetup]

The website that is being blocked is very recently added to our block list. It's possible you have something in your Google Chrome cache or settings that may be calling that site.

You can clean Chrome and see if the issue remains.

 

Please follow the directions from the following topic for a more extensive article on cleaning Google Chrome

Resetting Google Chrome to clear unexpected issues
 

Thank you

 

[AdvancedSetup]

One of my colleagues pointed this out.

You can manually delete all of the following and I believe this should stop it.

Task: {6D0D04BF-62CA-4D34-A09B-CB12F6C1955D} - System32\Tasks\ConfigSecurityPolicy => C:\Program Files\SystemSecurity\config\ConfigSecurityPolicy.exe [2289515268 2023-05-17] () [File not signed] <==== ATTENTION
C:\Program Files\Google\Libs\WR64.sys
C:\Program Files\SystemSecurity
S3 AIDA64Driver; \??\C:\Users\laidi\AppData\Local\Temp\kerneld.x64

 

[AdvancedSetup]

Are you still with us @DimitrisLaiman

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks